Qualys Inc (QLYS) 2018 Q1 法說會逐字稿

Good day, everyone, and welcome to Qualys' First Quarter 2018 Earnings Conference Call. This call is being recorded. (Operator Instructions) I would now like to turn the call over to Joo Mi Kim, Vice President, FPA and Investor Relations. Please go ahead, ma'am.

Thanks, Bryan. Good afternoon, and welcome to Qualys' First Quarter 2018 Earnings Call. Joining me today to discuss our results are Philippe Courtot, our Chairman and CEO; and Melissa Fisher, our CFO.

Before we get started, I would like to remind you that our remarks today will include forward-looking statements that generally relate to future events or our future financial or operating performance. Actual results may differ materially from these statements.

Factors that could cause results to differ materially are set forth in today's press release and in our filings with the SEC, including our latest Form 10-Q and 10-K. Any forward-looking statements that we make on this call are based on assumptions as of today, and we undertake no obligation to update these statements as a result of new information or future events.

During this call, we will present both GAAP and non-GAAP financial measures. A reconciliation of GAAP to non-GAAP measures is included in today's earnings press release.

As a reminder, the press release, prepared remarks and an accompanying investor presentation with supplemental information are available on our website.

With that, I'd like to turn the call over to Philippe.

Thank you, Joo Mi, and welcome, everyone, to our Q1 earnings call. As we previewed with many of you, we have shortened our prepared remarks to allow more time for questions and discussion.

Melissa and I are pleased to report another great quarter that included both strong revenues and leading profitability. Melissa will go through those details in a moment. These results reflect our position as the leading security and compliance cloud-based platform that is centrally managed and self-updating and which provides for the 5 key tenets of security today: visibility, accuracy, scale, immediacy and transparent orchestration.

In Q1, our go-to-market capabilities expanded as follows: in partnership with the Cloud Security Alliance, we launched the inaugural CIO/CISO Interchange to enable security experts to share best practices on securing the digital transformation; expanded integration of the Qualys cloud platform, including Qualys Vulnerability Management, VM, and Policy Compliance, PC, cloud apps, with the DXC threat and vulnerability management MSS portfolio; we fully integrated the Qualys Cloud Platform with Ernst & Young cybersecurity innovation and operations centers that EY opened in July 2017 to [help joint] clients stay ahead of emerging threats; and we released 2 free groundbreaking services, CloudView and CertView, providing companies of all size the instant ability to track and monitor digital certificates and cloud resources.

Most recently, we announced the following product achievements: The acquisition of 1Mobility, which enable us to uniquely provide enterprises discovery, inventory, security, compliance and response on both enterprise-owned as well as employee-owned endpoints, expanding our footprint within our customer base. Our ability to then provide global asset IT inventory as well as cloud inventory in 2 seconds will be unmatched by competitive offerings. Integration with Illumio to deliver the industry's first vulnerability-based micro-segmentation; and integration also with the Cloud Security Command Center, Cloud SCC, for Google platform GPC (sic) [GCP].

RSA Conference 2018 was clearly a turning point for our company as our platform, which uniquely provides full visibility across on-premise, endpoints, cloud environments and soon mobile, resonated extremely well with both customers and partners, including the release of new services and demonstration of new technologies to come.

We showcased CertView and CloudView, 2 new free groundbreaking services to help organizations gain visibility of their digital certificates via CertView and track and monitor public cloud assets and resources via CloudView. We released out-of-the-box Jenkins integration, Swagger support and new Chrome Browser Recorder extension for our Web Application Security app, enabling further automation and streamlining our REST APIs for the DevOps teams.

We demonstrated live our forthcoming passive scanning technology that delivers near real-time network profiling and monitoring for continuous asset discovery of all devices that appear on the network, including mobile and IoT devices. The passive scanner monitors network traffic in a nonintrusive manner to discover and fingerprint devices to determine topology, services and network threats.

At the RSA Conference, we also saw a greater interest in our platform from our partners as cybersecurity services is becoming a more strategic offering for them. They recognize that the Qualys Cloud Platform helps customers regain visibility across their hybrid cloud environment, consolidate their security and compliance stack and enable their digital transformation by helping them build security and not bolt it on.

Our Qualys Cloud Platform user -- used by our 10,300 customers, serves also as a natural distribution channel, making instantly available new solutions and improvements across the globe to customers, thus providing us and our partners with both operational and financial leverage.

With that, I would turn the call over to Melissa to discuss our financial results.

Thanks, Philippe, and good afternoon. Before I start, I'd like to note that except for revenue, all financial figures are non-GAAP, unless stated otherwise.

As Philippe mentioned, we continue to see strong demand driven by our strategic positioning as the leading cloud platform in our markets, reflected in the following financial and operational highlights: Revenues for the first quarter of 2018 were $64.9 million, which represents 22% growth over the same quarter last year. The percentage of enterprise customers with 3 or more Qualys solutions rose to 34% this quarter, up from 27% a year ago. The percentage of enterprise customers with 4 or more Qualys solutions rose to 16% this quarter, up from 9% a year ago.

Average deal size continued to increase in Q1, growing 17% year-over-year. 7.3 million Cloud Agents were purchased over the last 12 months, a 23% increase over the last quarter. And we saw good growth from both Cloud Agent and threat protection bookings. New products released since 2015 contributed approximately 15% of total bookings in the quarter, up from 8% in Q1 2017.

Our scalable model continues to drive industry-leading margins and significant cash flow, as reflected in adjusted EBITDA for the first quarter of 2018 of $24.6 million, representing a 38% margin as compared to 32% for the same quarter last year. For comparability purposes, Q1 adjusted EBITDA margin would be 37%, adjusted for the impact of 606, specifically the amortization of commissions. And operating cash flow for the first quarter of 2018 increased by 33% year-over-year to $43 million.

We continue to invest our cash in Qualys. Capital expenditures, including principal payments under capital lease obligations, were $6.7 million in the first quarter of 2018. And in Q1, we repurchased 21,288 shares. We have $98.5 million remaining in our share repurchase authorization.

Driven by our great results, our momentum in the marketplace and our scalable operational model, we're raising the low end of our fiscal year 2018 revenue guidance, and therefore, our midpoint. Our current fiscal year 2018 revenue guidance is now a range of $276.8 million to $278.5 million. We are raising our fiscal year 2018 non-GAAP EPS guidance from a range of $1.39 to $1.44 to a range of $1.43 to $1.48. We expect capital expenditures for the second quarter of 2018 to be in the range of $6 million to $7 million. And we have a strong current deferred revenue balance of $147.7 million as of March 31, 2018, 23% greater than our balance as of March 31, 2017.

We look forward to sharing with you our vision, strategy, product road map and financial outlook at our virtual QSC user and analyst and investor events June 13 to 14.

With that, Philippe and I would be happy to answer any of your questions.

(Operator Instructions) Our first question will come from the line of Alex Henderson with Needham.

I was hoping you could talk a little bit about the decline in deferred -- or the slower growth in bookings. The growth, I think, has slowed down to -- from almost 20% down to 10.25%. Was there anything in that -- anything to do with the change in the accounting that accounted for that? Is it just seasonal? Anything along that, that give us some sense to that would be helpful.

Yes. So remember, we had a great quarter, and we have a very healthy outlook. As we discussed before, what you're -- the 10% you're referring to is a total billings calculation. And as we said, if you are going to look at a billings metric, the proper metric would be current billings because our noncurrent deferred revenue is driven by the number and amount of multiyear prepaid deals, which is customer driven. We don't incent our sales force on that, and so that fluctuates. So that's why we focus on current deferred revenue growth, which is 23% year-over-year. Also, remember, as we've discussed, that billings is not a perfect proxy for bookings on a quarterly basis. Over time, it comes close but on a quarterly basis, it may differ, for example, by the impact of the timing of invoicing. So we may have a number of deals coming on March 31 that we end up invoicing on April 1. So we really emphasize the [trajectory] of our annual revenue guidance is the best proxy for business momentum because certainly current bookings inform our guidance.

And our next question will come from the line of Sterling Auty with JPMorgan.

This is actually Ugam Kamat on for Sterling. So Melissa, you mentioned that new products constituted 15% of total bookings in the quarter. Just to dig in a level deeper, if you just exclude the Cloud Agents, how does the other products fare in terms of their contribution to the total bookings?

Yes. It's still primarily Cloud Agent bookings and -- from a proportion perspective. But this as a group, both the Cloud Agent and threat protection, which is the other larger category, continued to do very well. In total, they grew over 100% year-over-year.

Okay. And just as a follow-up with that previous question, how much are you planning to have it within your base with the Cloud Agents, just to think in terms of how much up-sell opportunities left?

Yes, that's a great question. There's still a lot of opportunity. At this point, only about 12% of our customers have the Cloud Agent. So there's still a lot of upside for us.

Yes. And I would add one point. We are starting now to see more deployment on the endpoints, like we did with one customer who has deployed [380,000] agents on the endpoints. So we can see our agent moving now from the traditional servers to make vulnerability management and policy compliance more real-time, more effective, less -- more precise, in fact. Now we see our agent really moving very well on, one hand, on the endpoints as well as in cloud environment.

And our next question will come from the line of Howard Smith, First Analysis.

One for Philippe, one for Melissa. For Philippe, your CloudView, CertView, the free offering, a nice way to acquire some customers. I know it's very early days just coming out a couple of weeks ago, but I was wondering if you could give any color on reception, downloads, commentary from people you've discussed it with that you're hearing.

Yes, I can certainly give you some color. So vis-a-vis the CloudView, it was totally GA. And so we have today about on CloudView, right about more than 1,000 free sign-in. And remember, this is a full-service, so this is for people who essentially have the complete view of their inventory across all of their clouds. So that's very good news, obviously. The CertView, which is the free service component, is for any company in the world, small or large, the ability to track their digital certificates, Internet-facing digital certificates, when, where are they, who signed them and when they're going to expire. And that is just now entering full GA. So we have of course -- we are expecting to see, on this one, a significant uptake as well.

Great. And Melissa, your cash flow is very strong this quarter. If I remember correctly, last first quarter, there was some stock-based comp and the accounting that comes in there, did that repeat? Or was this just working capital items seasonally just coming in strong?

Actually, if you look at the year-over-year comparison, it's actually the increased profitability that drove it. Last year, we actually had an impact of a lot of multiyear prepaid deals being collected. We actually didn't have that. So it was really much more driven by the profitability.

And our next question will come from the line of Melissa Franchi with Morgan Stanley.

So just following up on earlier question about the adoption of multiple solutions. So one of are the metrics that -- can you sort of -- is the number customers adopting 4-plus solutions? And so you mentioned Cloud Agent and threat protect, but I'm just wondering beyond those solutions, what are you seeing good traction in?

It's really across all of our solutions. But obviously, it's also going to include the older ones, which have been out longer. So for example, customers who are VM customers that were adopting Web Application Scanning or Policy Compliance would try that as well or vice versa. Customers that might have been Policy Compliance-only adopting the vulnerability management.

Yes. It's pretty across all of our services. And in fact, what really people appreciate more and more now is that we have essentially -- it's one single platform. And the analogies that you could -- that I could really give is that if you look at your phone today, you have multiple apps. But these apps are disjointed in the sense that you've got an Uber and you're going to have your credit card there and you're going to pay, there's a different application. With Qualys, all these apps that you have, they are -- they speak between each other, which, by the way, they improved -- they essentially add value to each other. But then they are absolutely on one single platform. And that's really the customers are starting now to realize the benefits of that and especially with the amount of services that now we provide. So I think it's very clear that the strategy, that all the work that we have done to really create that significant back end, which integrates all of these applications, is really paying off. And now by the way, we're also working to really create a front end, which even more smoothly integrate all of these applications.

That's great. And just one quick follow-up for Melissa. So just kind of parsing through the comments that you made earlier in terms of the deferred revenue. So is it fair to say that the contract duration was shorter this quarter than a year ago? It sounds like that's kind of the conclusion. And just wondering, if you could maybe like put some numbers around it in terms of like what's the average length this quarter versus a year ago.

Yes. It's been around 1.1 for the last few quarters. I think it may have gotten increased to like 1.2 a year ago, so these are kind of small moves.

Yes. And also it's because -- one thing is that when you look at the length of our contract, we have a lot of very small customers who typically are 1 year.

That's right.

And so when we see -- if you look at the real trends, we see our enterprise customers moving more and more to 3-year contract, while the SME, SMB, they still stay at about a year.

Right. And then even separately from that, as I mentioned, our noncurrent deferred revenue is going to be impacted by the number of customers within that multiyear bucket that actually decide to prepay, which is obviously not all of them as well.

Our next question will come from the line of Matt Hedberg with RBC Capital Markets.

Philippe, maybe starting with you. I'm wondering if you can give us a little bit more color on geographic performance. I'm curious if you guys have started to see any real benefit from GDPR yet?

So that's two questions. So geographic performance has been good everywhere. Europe, doing very well and not really because of GDPR. I think we were not seeing yet really the direct GDPR correlation. Obviously, there is one. But it's because we see our customers in Europe deploying more and also adopting more new solutions. And we have a very good customer base in Europe, which, in the past, was essentially mono-product and now they are starting to finally move into adopting more solutions. And therefore, these are getting a bit bigger, and therefore, what would be very good growth. And the upsides are bigger. So today -- the 3 markets, U.S. -- the Americas, Europe, and Asia are doing very well.

And then maybe one other one. On one of your newer product launches that's still in beta I'm curious for your Container Security solution, it seems like an interesting product. I'm wondering, if there's any -- I know it's early and it's still private beta. But any feedback on that product? Who's sort of been interested in it? And what does the competitive landscape look like for that?

So again, this is the same, but that's a very good question. So container's very hot, including for ourselves. I mean, we're now containerizing the entire infrastructure of Qualys. So we are also using ourselves our solutions there. So there's a huge interest for containers. What again people like compared with the other solution that this is again totally integrated with the Qualys' platform. So all of our existing customers are really, really bullish, [that part] is coming close to GA. And I think this is still an early market, but it's becoming a very strategic market as companies are really moving into containers and moving into the cloud as well. So both CloudView and the Container Security, again, all of that out of the same platform, which is the analogy I was giving earlier. Think of having all of your apps in the phone being centrally managed, set of dealing with the same pay, everything the same...

Interoperable.

Interoperable, all the cost that you can eliminate. And then on the top of that, the ability for you also to create an app that also brings the data to you the way you like it through our customizable customers. So that's what we have done. And I think it will -- resonated significantly, and our partners were absolutely floored. We showcased the passive scanning, which is also again totally integrated. So now we can detect mobile and IoT devices, any devices that connect on the network. So we are on track to deliver the -- our passive scanning capabilities fully integrated by late summer.

And our question will come from the line of Srini Nandury with Summit Insights Group.

Melissa, I have a question for you. You mentioned the average deal size grew 17% year-over-year. Can you provide some color why -- what is driving this growth? And also, can you comment on the length of sales cycles in general? Have you seen any compression with the last year or so? I have a follow-up for Philippe.

Yes. Srini, a couple of different factors that have been impacting the increase in deal size. We've really seen it continue quarter-after-quarter to increase. One is we're seeing larger deployments of existing solutions. So whether it's new customer starting out bigger than traditionally we had seen or it's customer expanding with, let's say, their VM capabilities, that's part of it. But then it's also they're adding on new solutions. So it's really multiple drivers that are driving up the deal sizes.

And also our sales cycle -- on our traditional market, I think, the cycles are about the same. There are no significant changes. What we can see, but this is again -- this is early, is that on the cloud -- for people who are looking at the cloud solutions that we can see that their selling cycle should be shorter because, of course, this is a new -- this is greenfield. And people have -- need the visibility. And that's why an indication of that is clearly the 1,000-plus -- the people who registered for the free CloudView service.

Okay. Philippe, on the -- on your recent acquisition, 1Mobility, can you provide some color on what does it do? When is the acquisition expected to close? And who does it compete against the market?

So 1Mobility is a fantastic acquisition that we made. The acquisition has closed. So this is a done deal. The team is already integrated in Pune, India, totally. And essentially, what they provide is -- what they have done is a very nice mobile application, which -- with a very well-architected agent that goes into every version of Android, of Apple iOS as well as Microsoft mobile. And if I recall correctly, i think also Blackberry. And so that essentially is a similar agent technology that the one that we have for the traditional devices. And so we are bringing that into Qualys, which means it's going to extend all the capabilities that we currently have with the Qualys to the mobile environment. And that's something that every customer demands. It's actually -- I've got these -- and I'm sure this is your case as well. I've got this app -- I use, myself, an Apple tablet. So today, the only thing that you have is essentially mobile management devices. But in terms of the security of the devices, of being able to quarantine the device if there's something which has been detected, which it's not capable, there is really nothing out there. So I think this has increased significantly the strategic value of Qualys. And in terms of when are we going to have that to market, well, the current plan is to have, in fact, their solution, which we are integrating into the platform -- as you know, everything we do, when we acquire these companies, we don't continue selling what they have already because we put all of our effort to integrating that into the platform. The reason is because once the solutions are integrated into the platform, not only it makes a lot of -- it makes it much easier and much more cost effective for our customers, but also we can distribute this application instantly across the globe to all of our customers. And again -- and then they are also centrally managed and self-updating. So again, so we are very coherent with our architecture. So we're anticipating to have their solution totally integrated with Qualys in the first quarter of next year.

And our next question will come from the line of Erik Suppiger with JPMorgan Securities.

Actually, with JMP. But two questions. One, you're new products, they have been growing -- the percentage of revenues generated by new products have been growing pretty rapidly if you go back a few quarters. They've leveled off in the last 3 quarters. I think they were 14%, 15% and 15%. Can you give us a sense of how -- what kind of expectation we might have for that going forward? Is there any reason why that wouldn't reaccelerate? Or what are your thoughts there? And then secondly, can you give us the metrics for Cloud Agent? How many additional agents you deployed in the quarter?

Yes. So let me take the first question first. So our new products have actually been doing very well. As I mentioned, bookings actually grew over 100% year-over-year. Remember, the percent of total company bookings is relative to how the rest of the solutions are doing at any point in time. So for example, in quarters where other solutions are growing very well, like this, quarter vulnerability management, Web Application Scanning did very well, the overall mix isn't going to shift much. So it's a little bit hard to predict. And remember that we focus on total company revenues because we're selling a platform and we don't incent our sales force by products because we don't want them to push customers on products that they're not going to renew. So I think that's why we provided the additional color to let you know that these solutions are doing very well and the mix in any one quarter may change.

Yes. The one thing that I would add to what Melissa said is that, of course, as we deliver more and more services, obviously, you would naturally expect that, of course, the volume of new solutions as compared to the existing ones will grow, so.

So does that -- a quick question on that front. Does that suggest that over the longer term we should expect that 15% to reaccelerate? Or is it just difficult to know how the VM side is going to perform?

I would say probably is the most -- yes, absolutely. VM is doing very well because, again, because we are now becoming much more strategic. People realize they need to have the visibility on everything. And so, of course, we have expansions still in our existing customers. Still, there's a lot of companies which are not really doing fully VM. So we have that behind us. So that will continue. But I think, at some point in time, the massive new services that we are bringing to market, which is quite impressive, of course, is going to overtake.

Yes. And I was going to add that, that's because we're also -- we're going to get the leverage from the additional new solutions coming out. Today, it's primarily still Cloud Agents, threat protection. For example, FIM, IOC, they're still very early. We will not only have additional revenues from those, but as well as the new solutions that we're talking about GA-ing, the cloud geo-assessment as management of digital certificates as well as Container Security. So we will have

[Threat] management.

Right. Just by numbers, more of it, that should drive it. It's just hard to predict sort of the actual specific numbers over which period in time.

Okay. And the Cloud Agent?

Yes. So I had mentioned that Cloud Agents, we had sold $7.3 million over the last 12 months. We reported last quarter $6 million Cloud Agents. So the difference is $1.3 million net.

And our next question will come from the line of Jayson Noland with Baird.

Philippe, I wanted to ask on RSA. You called it a turning point. How did conversations with customers and potential customers a couple of weeks ago differ from conversations last year? And did it result in better or higher-quality lead generation?

No, no, I think the customers, when -- because of all the demonstration that we make and our customers seeing that we're really delivering everything that is really coming together, very well integrated, so it was a kind of an aha moment. Yes, this is it. Qualys is there. And we saw the same reactions from our partners. Our partners which typically were looking at us much more like the VM solution that they have and they are very happy with and suddenly they realize all these additional services that they can leverage. So I think it was a kind of an aha moment. And at the time, which is interesting, when you contrast that with the cacophony of RSA, which you have so many solutions, so many vendors, everybody is lost including ourselves. So seeing Qualys bringing all these applications today in a very rational way, in a very well-integrated way, again, everything's centrally managed, everything's self-updating out of this one single platform, that was really, really music to the ears of both of our customers and our partners.

And just to follow up there. We had a large integrator at the show tell us -- or he was joking, saying everyone claims to be cloud now. And that's the market coming toward you. But does that change the competitive landscape or confuse the buyer at all?

I think the buyers -- no, our customers are becoming, of course, less and less confused in a way because, obviously, they realize that they made the right investment in the past, so they are pretty happy. And now today, with all these new services and we start to really, I think, [ease] up and have the ability to essentially start to accelerate our penetration of the market, which is already pretty high. So that's why we came out of that RSA very bullish. We did that one initiative with the Cloud Security Alliances, which is quite significant, which is essentially -- we're embarking with the Cloud Security Alliance, which, as you may recall, it's about 100 chapters in the world with 80,000 volunteers, which are all security professionals. And really, they have been focusing since -- like us, since 2009 on the metrics to secure the cloud. And now today, they are embarking into what do we need to do to really secure, enable the digital transformation. So we are going to embark into conferences and to forums everywhere in the world to essentially bring our customers and, of course, other users to -- with experts to discuss about enabling the digital transformation. So that's a significant initiative. We had done something very similar many years ago. I did that with the late Howard Schmidt when -- at the time when vulnerability management was looked as kind of a secondary application. So we went with our customers, with our early adopters and with Howard and myself and a few other experts, really evangelized why vulnerability management was important because you've got to know your vulnerabilities simply before the hackers can find them. And so [only] took that long, so -- I've been evangelizing the cloud as well for so long, but now the time is there. And so we saw what we called transparent orchestration, the full integration with Azure that we did. So people -- a lot of people speak about orchestration, but that orchestration is still the old way, which is, essentially, you have workflows when, at the end of the day, everything could be totally transparently integrated. And that's what we showcased also at the Cloud Security Alliance summit. Actually.

(technical difficulty)

showing that full integration that we have with Microsoft Azure, which is absolutely remarkable. And again, in order to do that, you have to have the right architecture, which we go back to your question, which is there is a lot of people talking about are -- we've got a cloud platform, but how many really do have one. So there's not that many because that's not something that you do that easily.

And our next question will come from the line of Rob Owens with KeyBanc Capital.

I think in your prepared remarks you mentioned 12% of your customers have the Cloud Agent. Can you remind me how that's been trending? And I guess, if you can slice it one other way with new customer acquisition in the quarter, kind of what's the hit rate of those new customers taking Cloud Agents?

Yes. So that's right, it's 12% this quarter Rob. It was 11% last quarter. So it's kind of been moving 1% to 2% over the last few quarters. In terms of what new customers buy, it varies quarter by quarter in general, and I would say it's true of this quarter. They actually tend to disproportionately buy our newer service solutions. So obviously, our newer solutions are bought by a mix of existing and new, but we see a higher uptake with new in general.

Can you put any color on, is it 1/4, half or something of that nature?

Yes. We haven't disclosed that historically, but it's something we can look at providing going forward.

Okay. And then secondly, as you look kind of at the traditional VM market and some of the acceleration, can you speak to a little bit just relative to scanning in the cloud versus scanning on-prem? And it seems like cloud has had a much higher attach rate. If you look within your installed base, how much of VM do you think is coming from scanning with an AWS or Azure at this point?

So let me make one first comment is that scanning in the cloud and scanning a network are totally different. Scanning in the cloud, you want to have the Qualys agents because putting a scanner in the cloud doesn't make really any sense. So the architecture that we have for the cloud is really the right one. That's what we did with Microsoft. So any Qualys customer today -- any Microsoft Azure customer can, at a click of a mouse, go to the security center. And then at a click of a mouse, automatically, a Qualys agent is provisioned, which gave them the view of their security and corporate posture on Azure. And then they can also automatically go to the remediation in the console of Azure. And of course, we can do the same thing in ours. So you need that architecture. So as we sit today, of course, a very good uptake on our agent in the cloud, but again, this is more of a new compared to the huge installed base that we have on the enterprise, the cloud is relatively newer.

And our next question will come from the line of Michael Kim with Imperial Capital.

With the expansion in your product suite over the last 12, 18 months and you have a pretty strong product road map for '18, can you talk about more broadly how you're maybe changing your selling motion and how you capture more wallet share without potentially impacting deal velocity? Any thoughts on your go-to-market strategy?

Yes. So our market strategy has not fundamentally changed but, of course, has evolved. So on one hand, we see -- as I was mentioning earlier, we've already built significant partnerships out there with all Indian outsourcers being Qualys customers, all Indian outsourcers becoming -- being Qualys owners. We have also very large customers and partners, like Ernst & Young, PwC, et cetera. So we have the uptake of this world. So what we see today now is that -- in the past, again, these channels were more looking at us as the vulnerability management solution. And now today, they see the benefits of everything that we have done. So we are becoming more and more strategic for them. So what we are doing with them is, of course, training them more on our new solutions. So that's one thing that we are doing. So we've also beefed up our strategic alliance group. And we are now providing more and more training on the new services and so forth. Also, these free services are also available for our customers as they can also market as well to create lead generation. On the enterprise, what we are doing, we're changing a little bit -- again, adjusting our sales force. As you may recall, our sales force is divided into the hunters and the farmers. They both are technical. But what we are doing here has essentially created different categories of customers, and as a result of that, of technical account managers. So we are classifying our customers between the very extra large, which are large companies like Microsoft, like Oracle, like Google, et cetera, very large deployments. Scale is of course the issue. So here we have even a very highly technical sales force that we are now starting to build to support these customers, so they will continuously be close to them. Then we have large customers, which are -- which now are essentially making a higher category through technical account managers. And then we have our regular customers. And that's the changes that we're making here. And so -- and that's it. So we are continuously very consistent with our model. We are just tuning it to the fact that -- and then we're adding, sorry, a few more subject matter experts, again, to make sure that -- which are experts in these different modalities. And -- but again, it's so easy to try and buy. So if you're an existing Qualys customer, immediately all these new services are available for you and you can even yourself automatically create a trial account. And then we have these technical account managers, which are there, and eventually subject matter experts and to evaluate.

And that's why -- and just to add on, that's why we can provide the platform as a natural distribution channel, as Philippe mentioned earlier.

Got it. And do you see an opportunity to accelerate your hiring of technical account managers this year and forward investing in some of that sales capacity?

We are doing that. The challenge we have is to really hard -- it's very hard to find good people. I mean -- and again, in our model -- there's plenty today of what I call our management sales guys as our industry is consolidating that are on the market. But one, they are extremely expensive. And second, they are not technical at all. So that's not the people we are looking for. So we are still continuing more -- the agency-type people, which are more and more technical. And our customers, at the end of the day, they prefer that because they're hounded by too many security vendors, which essentially go for their wallets. And that was the theme at our sale -- I don't know if you saw the -- on LinkedIn the post of the CISO of Lyft, which is actually -- was essentially telling at RSA, why do we go there because I see the managers -- they are coming to me all day long, so why should I go to San Francisco to essentially go and meet more vendors and the cacophony of what they say. And so it's a waste of my time.

And our next question will come from the line of Gur Talpaz with Stifel.

So Philippe, with the 4 new product set to hit beta here in 2H '18, which ones are you most excited about? And then, I guess, more importantly, how do you think about the competitive environment across each of those? And how do you think about that more broadly speaking as well?

That's a broad question. So I don't know where to start because I'm excited by all of them. So let me be specific. So today, by far, the most important new service are the Cloud Agent. Because as we discussed, the Cloud Agents, in fact, are essentially enabling additional services. We start to be very happy with the fact that these agents are going to the endpoint. What are they doing in the endpoint now? Not only they are doing the VM, which they weren't doing in the past, but they are starting to do the IOC. So we are starting to displace companies like Tanium and others. Then -- so that's for the detection of Indication of Compromise. Then of course, we have additional services on the cloud. This is totally -- this is greenfield. And I think we're extremely well positioned there, so we are very excited about that with CertView, CloudView, all these things. The technology we really, really love as well is the passive scanning technology because that's another -- if -- the way I look from a strategic standpoint, Qualys has mastered the scanning technology. We can scan every IP on the planet, every website on the planet. We do more than 3 billion scans a year with Six Sigma accuracy, in fact, better than Six Sigma. So that's a technology we have mastered. The second technology we have now mastered are the agent. And the agent allows us to have real-time information, so we bring all that information to our back end as well. And now the passive scanning, which is the third technology that we will master, which is essentially being capable of analyzing everything that connects us to the network, whether it's an IT device, whether it's a phone, whether it's, in fact, at RSA, we detected visitor coming, we detected Apple Watch as well. So -- and then, of course, if we got the time, we could even launch a scan on these devices. So combining all these 3 different technologies is really going to make us absolutely unique in the marketplace. Nobody has built that. And with also the back end, with the scale where we can absolutely manage significant amount of information now, including log information, et cetera, so bringing all the data to one single place, where everything is indexed under ElasticSearch, where we have more than 2.5 billion data points currently indexed on ElasticSearch, which allows us to, in 2 seconds, being able to have the visibility on any devices out there with, of course, most precision, where they're located, the users connected to them, how many RAM they are using, what are the application it's installing them and essentially being capable very close with -- once we combine these 3 technologies together being able to provide you your global IT asset inventory and synchronize that with your CMDBs. That's the key strategic direction of Qualys. And I think we'll be there before the end of the year.

Okay. Philippe, so fair to say you're excited for the future.

Not me, all of us. I mean, we are very happy with the company that we have built, the way we communicate, the way everybody is focused on what needs to be done. I mean, this is -- really, we're very happy, not to mention the profitability which we have been accused of...

Having too much of.

Of having too much of it.

Fair enough. Melissa, maybe a question for you here as well. I know you don't provide it. But directionally, given the growth in the number of customers of 3-plus and 4-plus solutions, how has the dollar renewal rate been trending? I guess, with the growth in agent, I would assume it's trending up or at least flat. But I was hoping you could provide at least some directional commentary, that'd be really helpful.

Yes, absolutely. Gur, so we focus on dollar net extension rate, and we provided it at our last Investor Day. It was somewhere around 105%. We'll provide an update at our virtual event in June, but I can say obviously given what we've seen in our performance, it won't surprise you that's obviously been trending in a positive manner.

And our next question will come from the line of Siti Panigrahi with Wells Fargo.

I was actually switching between calls. My apologies if this question has been asked. But Philippe, when I see the pipeline -- the products that you are planning to launch this year, already you have 6 products GA in first half and 4 already in the pipeline. And I see like some of these products probably be easier to update. So what are the products that you're more excited about see quick adoption versus some of the products maybe have later adoption? So just wanted to understand what are the products that you're thinking like some sort of meaningful revenue contribution in the near future...

So I think the adoption -- revenue contribution is a little bit different, but -- and they already know -- have each other, anyway. So today, we're very bullish about our free services that we have launched. And we saw, as I mentioned earlier -- maybe you were not on the call. So on our CloudView free service, we have already more [upgrade] in a few weeks -- in 2 weeks. We have about 1,000-plus people who registered for the fee service. CertView, it's about to go GA. So we're anticipating a very big adoption. The beauty of this services is that, one, they do something very useful that they don't need to do. So you need to know what digital certificates are, sign them, when are they going to expire. And then -- and same thing in the cloud, you need to know your inventory or my history buckets, how many of them are exposed, et cetera, to the Internet. So that's absolutely -- they are must-have applications. And then, of course, we have significant up-sell. So from -- it does 2 things. One, it creates awareness for Qualys, all those who didn't know us before or maybe they were knowing us but they were not using us. And now it creates also significant up-sell opportunities because once we have a customer doing with CloudView the assessment of their inventory, now we can sell to them -- up-sell to them the security assessment. And same thing with the certificates, if you do your Internet-facing fair charge, we can now up-sell you on your endpoints, on your Internet service. And then we'll also have the management of the digital certificates to up-sell you. So these are -- they up-sell very well. So we are very excited with that. And this is all greenfield, all greenfield. The other thing that we really are really counting on, we see the IOC is starting to take off, and I think with the passive scanning, are going to be even better because we're going to be able to identify those devices which are suspect -- which is something which is very important because then we have to quarantine So these are essentially the key services. And of course, we're improving our VM. We're improving our policy compliance. And so all in all, I think we are very happy with what we are doing. And again, we have now 50% of our engineering ops and product management headcount now, which is in India, where we're continuing really attracting very good people. And as we say -- as we did with 1Mobility, acquiring a few very good companies that we can integrate very well. And so we're continuing doing that, of course.

And our last question will come from the line of Patrick Colville with Arete Research.

[Till] you guys [peaked] in the quarter on revenue, what was the thinking behind not lifting the full year guidance at the top end?

Yes. So we had a great quarter, and we have a very healthy outlook, Patrick. But similar to last year, it's early in the year. And so we chose to raise the bottom end of the full year revenue guidance and therefore the midpoint, and keep the top end as it is. Also keep in mind, we do have tougher comps in the second half, so we factored that into how we wanted to maintain the guidance as well.

Got it. And just on the contract duration. So you said earlier in the call that your sales guys are not incentivized to [share] on longer contracts. Did I get that right?

That's correct.

Okay. And so I mean, certainly -- I mean, did you give us any color around the slight tick-down in the gross margin, why there's a reason for that?

Yes. So we continue to invest in the robustness of our platform as we're moving products into GA from beta and new products into beta. This drove higher headcount expense, corporate allocations and depreciation. We don't guide to gross margin. What we've said is, over the year, we don't expect it to be materially different than where it's been in the last few years.

Okay. And just as the last person, I can kind of keep going. On the share repurchase, can you just remind me the objective of that are to neutralize the dilution on the income statements, right? Is that right?

Sorry, Patrick can you repeat that?

So the share repurchase, can you just remind me what the objectives of that? Is it to neutralize dilution from stock-based compensation?

Yes, so absolutely. When you take a step back, we are very cash generative. We're very proud of our highly profitable operational model. And strategically, we've been focusing on M&A as a use of cash in order to drive value for our shareholders. But we think that it's likely that our acquisitions are going to continue to be tuck-ins, which don't use up a lot of our cash. And we continue to generate significant amounts of cash. So we thought it made sense to offset the equity dilution that we have either from grants to employees or sometimes in M&A situations by repurchasing shares.

And we could also add that in terms of SBC, we are pretty reasonable as compared to other companies.

That's correct.

And our last question will come from the line of Sterling Auty with JPMorgan.

It's Ugam Kamat again for Sterling. Just a follow-up, how much is FX having an impact on increase of EPS guidance for 2018, like your expectations for FX tailwind when you gave the guidance in February versus the expectations right now?

Yes, that's a great question. It actually hasn't impacted it. The increase in EPS guidance is driven really by our outperformance.

This concludes our question-and-answer session for today. Ladies and gentlemen, thank you for your participation on today's conference. This does conclude our program, and we may all disconnect. Everybody, have a wonderful day.