Qualys Inc (QLYS) 2018 Q2 法說會逐字稿

Good day, everyone, and welcome to Qualys Second Quarter 2018 Earnings Conference Call. This call is being recorded. (Operator Instructions)

I would now like to turn the call over to Melissa Fisher, Chief Financial Officer. Please go ahead, ma'am.

Good afternoon, and welcome to Qualys' Second Quarter 2018 Earnings Call. Joining me today to discuss our results is Philippe Courtot, our Chairman and CEO.

Before we get started, I would like to remind you that our remarks today will include forward-looking statements that generally relate to future events or our future financial or operating performance. Actual results may differ materially from these statements. Factors that could cause results to differ materially are set forth in today's press release and in our filings with the SEC, including our latest Form 10-Q and 10-K. Any forward-looking statements that we make on this call are based on assumptions as of today, and we undertake no obligation to update these statements as a result of new information or future events.

During this call, we will present both GAAP and non-GAAP financial measures. A reconciliation of GAAP to non-GAAP measures is included in today's earnings press release. As a reminder, the press release, prepared remarks, and an accompanying investor presentation with supplemental information are available on our website.

With that, I'd like to turn the call over to Philippe.

Thank you, Melissa, and welcome, everyone, to our Q2 earnings call. Melissa and I are pleased to report a very good quarter that included both strong revenues and leading profitability. Melissa will go through those details in a moment. These results reflect our position as the leading cloud-based security and compliance platform for securing the digital transformation and helping build -- and helping to build a safer world, one app at a time.

We believe we are now uniquely positioned to enable customers to consolidate their security and compliance stack, drastically reduce their spend. In addition, our true platform approach allows them to have a single-pane-of-glass view across on-premise assets; endpoints; clouds; and early next year, mobile environments. As we continue delivering additional best-of-breed detection and response capabilities through our Qualys Cloud Platform, we believe that the savings our customers enjoy will compound. Furthermore, we are now well on our way to providing CIOs a continuous and updated view of their global IT assets, and I will speak of that a bit later, with 2-way synchronization with our CMDBs. Such capability is, in fact, the cornerstone of security, as there is no security without visibility.

In Q2, we continued to innovate and deliver on our product roadmap:

We released our Container Security app into GA. This new cloud app enables customers to build continuous security into their global container deployments and DevOp processes at any scale, and integrate the results into one unified view of their global hybrid IT security and compliance posture, breaking down silos and lowering ownership cost.

We announced a new groundbreaking app for global IT asset inventory and CMDB synchronization, I just spoke about. The Asset Inventory Cloud App uniquely provides a single source of truth for all IT assets within hybrid environments, including on-premise assets; endpoints; cloud; and early next year, as mentioned earlier, mobile environments. We believe this solution is significant because it solves one of the most vexing issues for IT and is critical for security, as you cannot secure what you do not know. This new service is now in beta, and we expect it will go GA before year-end.

We added new out-of-the-box Security Assessment Questionnaire capabilities to streamline GDPR compliance.

And we bought a minority stake in 42Crunch as our first venture investment and signed a distribution agreement with them. 42Crunch has developed an API security platform, enabling organizations to quickly deliver applications built on secure APIs. Similar to Qualys, this solution enables customers to build security in.

We also held our first Qualys Security Conference customer event as well as an online Analyst and Investor Day event, which were great successes. We showcased how the Qualys Cloud Platform is uniquely able to collect and analyze data from millions of different sensors, enabling the 5 key tenets of security today: visibility, accuracy, scale, immediacy and what we call transparent orchestration. We also provided in-depth technical sessions covering our latest solution, including Container Security, which is now in the GA, digital certificates management and IT asset inventory and CMDB synchronization.

We see strong demand for our solution from the federal market, as we increased our go-to-market capabilities this quarter in the federal vertical as follows:

We announced an expanded partnership with Carahsoft to market, sell and distribute the FedRAMP-authorized Qualys Gov Platform to federal agencies as well as states and local governments; and appointed Anna Wheeler, formerly at Akamai, as VP of Public Sector Solutions.

We are looking forward to a federal CIO/CISO interchange in the fall, as we believe we are uniquely positioned to meet the ever-growing security and compliance requirements of the federal government. With our expanded internal team, we have mutually agreed with Second Front Systems to maintain our business partnership rather than pursue an acquisition at this time.

Additionally, we continue to leverage the Qualys Cloud Platform to broaden market awareness and generate demand, as we have done successfully with the launch of CertView and CloudView. We have seen great response to the release of CloudView and CertView, a successful lead generation effort, which serves to distribute our Qualys platform to more users, from which we can sell many additional solutions. We have had over 6,500 activations, out of which, over 700 are active users already. Additionally, our Qualys Community Edition, a free version of our cloud platform to provide organizations, including SMBs, consultants and MSPs with a unified view of IT, security and compliance, was released for general availability today. We're excited about our roadmap, and we continue to find innovative companies, which we can acquire to accelerate our time-to-market.

In summary, we're enthused about our leadership position as our platform, which uniquely, again, provides full visibility across on-premise assets; endpoints; cloud; and soon mobile environments, enables companies to consolidate their stack, considerably reduce their spend and build security into their digital transformation initiatives.

So before I turn the call over to Melissa to discuss our financial results, I would like to welcome Jason Ream to our Board of Directors. Jason is the CFO of Mitratech Holdings. Prior to that position, he was the CFO of Relativity; and prior to that, the CFO of SolarWinds. As we continue to grow our SME/SMB business, we expect to leverage his experience at SolarWinds, which built a leadership position in the IT management software market by using a cost-efficient, go-to-market model, leveraging powerful, easy-to-use products, similar to those that Qualys provides in the security software market. I would also like to thank both Don Dixon and Amer Deeba who are departing Qualys after 17 years of services. Don joined the board -- the Qualys board as the lead independent director in 2001, because he shared our vision of a cloud-based platform for security. Around the same time, Amer joined Qualys and leveraged our platform strength to build the Qualys brand, most recently serving as Chief Commercial Officer.

Thanks, Philippe, and good afternoon. Before I start, I'd like to note that except for revenue, all financial figures are non-GAAP, unless stated otherwise.

As Philippe mentioned, we continue to see strong demand for our expanding set of applications reflected in the following financial and operational highlights.

Revenues for the second quarter of 2018 were $68.2 million, which represents 23% growth over the same quarter last year.

The percentage of enterprise customers with 3 or more Qualys solutions rose to 37% this quarter, up from 28% a year ago. The percentage of enterprise customers with 4 or more Qualys solutions rose to 19% this quarter, up from 11% a year ago.

Average deal size continued to increase in Q2, growing 16% year-over-year.

8.1 million Cloud Agents were purchased over the last 12 months.

We saw good growth from both cloud agent and threat protection bookings. New products released since 2015 contributed approximately 15% of total bookings in the quarter, up from 9% in Q2 2017.

And we have a strong current deferred revenue balance of $151.4 million as of June 30, 2018, 21% greater than our balance as of June 30, 2017.

Our scalable model continues to drive industry-leading margins and significant cash flow, as reflected in our adjusted EBITDA for the second quarter of 2018 of $26.7 million, representing a 39% margin as compared to 37% for the same quarter last year. For comparability purposes, Q2 adjusted EBITDA margin would still be 39% adjusted for the impact of 606 specifically, the amortization of commissions.

Operating cash flow for the second quarter of 2018 increased by 47% year-over-year to $24.2 million, and we now have over 1,000 employees, with over 500 of them based in India.

This quarter, we accelerated our investments in enhancing shareholder value by spending $7.3 million in capital expenditures, including principal payments under capital lease obligations; $5.9 million in aggregate on 1Mobility and 42Crunch; and $17.9 million on the repurchase of 235,539 shares. We have $80.6 million remaining in our share repurchase authorization.

Driven by our great results, our momentum in the marketplace and our scalable operational model, we are raising fiscal year 2018 revenue guidance to a range of $278 million to $279.2 million. We are also raising fiscal year 2018 non-GAAP EPS guidance to a range of $1.46 to $1.50 and we expect capital expenditures in the second half of 2018 to be front-loaded. For the third quarter, we expect capital expenditures to be in the range of $9.5 million to $10.5 million, and for the full year, we expect to be around the high end of our prior guidance of $28 million.

We were delighted to share with you our vision, strategy, product road map and financial outlook at our online Analyst and Investor event in June. And we are looking forward to hosting you at our User Conference, November 14 and 15.

In conclusion, we believe that with the continuous platform enhancement, its increased adoption and our scalable operational model, we can continue to grow our revenues and boast top-tier margins.

With that, Philippe and I would be happy to answer any of your questions.

(Operator Instructions) And our first question comes from the line of Howard Smith of First Analysis.

Philippe, I want to clarify something in your prepared remarks, where you talk about the 6,500 activations and 700 are active users already. Can you just explain, kind of, activations versus active users and how it, kind of, progresses? And I may have a follow-up.

So as you know, like with all these kind of new service when you bring them to market, you have a lot of people join and then some people forgot. And so of course, we are putting all of the methodology behind to try and remind people that activating is not enough, they need to use it. So it takes some time. But today, through the 6,500, we have effectively connected with 700 of those customers, which are becoming heavy users and also starting to discuss with them about upsells. So they are really qualified, if you prefer, at least at this time. So if you look at the traditional metrics, you saw pretty good success. And I'm sure as we continue connecting with the other ones, which have not activated, that have not really used it for various reason, to try to get additional of these customers, becoming more active. And as a result of that, enjoying the benefits of our very unique cloud platform.

Okay. So it sounds like it's meeting your expectations as, kind of, lead gen. And is that both for new customers that you can then sell the other products as well as, kind of, upselling the existing customers to the full-paid version, et cetera? Is it working both ways kind of...

Exactly. Exactly. It's both. Absolutely. And for our existing customers, it's a godsend because it validates for them, as we can see, the fact that they already have deployed the Qualys platform. There's more goodness coming to them. And then, of course, we can discuss with them about upselling this complementary services that goes with that.

Our next question comes from the line of Alex Henderson of Needham.

This is [Dan Parker] on for Alex. So I know during the Analyst Day, you highlighted you only had about 1% penetration into the federal market. With the successful launch of the Gov Platform and the recently announced expanded partnership with Carahsoft, how big do you think this opportunity could be?

At this point, this opportunity is significant. If you look to the roughly -- we're only at 1%. Your typical security company, typically has about 20% of their business in Federal. Some go to up to 40%, which, I think, is a little bit too much because then you depend on kind of very unique customers. But I think today, we are really shooting to go ahead and get 20% of our revenue. Now the question is time. We have also established -- so of course, now with Carahsoft particular, which has a formidable distribution capabilities in government, while now also bidding big contracts. We've expanded our team. We'll continue expanding our team. We have today, very, very unique and very happy customers who have -- one of these agencies that you could not really name, which is now, a, fully disconnected version of our Cloud Platform. We have another very big integrator, which has another private cloud platform as well. As you know, we are FedRAMP-authorized which is (inaudible). And we are now also getting to do FedRAMP High. And the other thing, which we are doing in federal, which is going to be also very significant is that our Cloud platform now is ready to be fully hosted in Amazon.gov and all these other cloud providers for the government as well. So that, obviously, will give us many opportunity to bid on contracts. As clearly, federal is moving to cloud solution, of course, these are not your traditional cloud solutions. These are, of course, to follow their specific certification but I think we are well on our way to being capable of doing that. So FedRAMP High is going to be quite significant for us as well in the near future.

Our next question comes from the line of Robert Breza of Northland Capital.

Melissa, maybe you've spoken -- or maybe you or Philippe spoke in the prepared remarks about the portion of people that are in India. Can you talk to us about how you see the margins trending, maybe over the medium to longer term, and with that leverage base you have there and how you're capitalizing on it?

So maybe before Melissa gives you some more specific details, let me remind what that team in India is. So we did something very unique many years ago, when we decided to rearchitect our platform, so we could essentially, integrate more and more -- develop ourselves best-of-breed solution. So we made the big investment in India. So under our Chief Product Officer, Sumedh, we have put ops, DevOps customer support, engineering, QA customer support and product management. And we literally cloned our structure in India, where we have today, 500 people and that's essentially, what we do. We have attracted significant talent. There is a huge pool of talent. In fact, we have plans to continue significantly increasing our headcount in India, so we can continue developing and supporting products as well as developing more and more applications. So of course, Melissa could speak about the economics, but the first priority was to find talent. The #1 challenge today that every company has is to attract talent. And today, we have really found the formula. We're very happy with that. We have a fantastic team. And also, the second thing that India does for us, we have acquired successfully 2 companies, which were -- Nevis Network that you see today, which is essentially the technology, which is behind our global IT Asset Inventory, our quarantine. And the integration, as you can see, is almost now done since we went into GA. So we are moving into better, so we are moving into GA now very soon. And then, the other one is 1Mobility, where we expect to grow better in the early part of next year. And we're also now looking at these other companies like the small companies, 20, 25 people who have significant technology that they have built -- are coming to us because they see a very good home where their technology can thrive. And we currently are in discussion with 2 of them. It's premature to make any announcement at this stage, but we are still very active and the economics are quite significant because it's serving hundreds of millions for similar technology that if we will have to do that in the U.S. we are down to a few millions. And so with that, Melissa can give you a bit more colors on the statistics that you were asking for.

Yes. So Rob, thanks. I'm going to answer it first in the near term and then answer the longer-term question. So we had a great first half in terms of both revenues and profitability, and we're proud of our industry-leading margins. We do plan to continue to invest though, given the growth opportunities we have ahead of us. Since our second half revenue comps are tougher, we do expect second half operating margins to be down from the first half, resulting in flat margins for the year. Over the longer term, what we presented at our Analyst and Investor Day was our 2021 outlook for low 20s to mid-20s revenue growth and an expectation of EBITDA margins between 40% and 42% and free cash flow margins between 35% and 40%. And as Philippe mentioned, not only are we getting significant leverage from India from a cost perspective, it's a talent perspective, which allows us to accelerate our ability to go-to-market with new solutions.

Our next question comes from the line of Melissa Franchi of Morgan Stanley.

Philippe, I'm wondering if you can just talk about what you're seeing in terms of pricing on the core VM product. And then, if you could maybe just talk a little about what you see in terms of contract values, when a customer adopts a cloud agent versus maybe, just like a traditional VM customer.

So I don't know if we have made this kind of calculation specifically, but Melissa can give you a little bit more color after specifically. As far as the price on the core VM, we see -- we don't see much really. Pressure is more sometimes the competition in order to try to displace us or try to win a deal. They are willing, of course, to drop the price. But as you know, our competition is not really profitable. And so -- and the fact that we are now, as you have seen in the numbers that Melissa told, that we have more and more of our customers, which are adopting 3 and 4 more solutions, it makes us significantly more sticky. In addition, these free services that we are also delivering, it makes them also very sticky. And of course, I think, we are -- from a price standpoint, we are protected. We saw Rapid7 many -- quite a few years ago being very aggressive against us, and were not successful. So I think we believe we can maintain our price for the monthly. And we are very cost-effective, because we eliminate significant cost. It's easy to deploy Qualys. You don't have all that overhead that other solutions have. And so I think we feel very solid regarding our pricing.

Yes. So I'll add a few data points, Melissa, to help you think about it. So in general, the cloud agent, if you were paying, let's say, $1 for VM, you would pay $1.20 for the cloud agent VM. Remember, as we've discussed, with the way our customers buy, they often are expanding into a new solution, they will start small and expand over time. So as we've talked about anecdotally, our customers have not fully deployed cloud agent where they have deployed vulnerability management. The exception being, and we talked about this last quarter, we're starting to see customers wanting to plan the end point. For that, they need the cloud agent and so they would go straight to a large cloud agent VM deployment in that case.

Yes. And I could add one more thing on that subject. I mentioned on that last earning call that we have one large company who deployed 250,000 endpoints -- agent for their endpoints. Essentially, to do VM and Policy Compliance. That company is now already looking very seriously at the IOCs so that's another -- of course, remember our agent enables a multiple stream of additional services. And I'm really happy to let you know that we have another similar -- in fact, the company now deploying another about 200,000 agents again. So -- and again, looking at VM first and Policy Compliance, and now starting to evaluate IOC solutions. And so that's -- we see again, it's maybe a slow progression but it's pretty solid, sustainable, and we see our agent going to the endpoint. And of course, it goes into the cloud, the fantastic integration we have done with Microsoft and now with Google. And with all of the cloud providers, our agents are the right architecture for the cloud, and there is no question about that as well.

Our next question comes from the line of Erik Suppiger of JMP.

I've got a few here. One, I think you had said the new services were about 15% of revenue. It's been at that level for a little bit. Do you think that contribution from the new services could start to pick up or what are your expectations, as you look out over the next year? Secondly, did you give the number of Cloud Agents that activated in the quarter? And then, I have a follow-up for Melissa, but I'll take those 2 first.

Yes. Thanks, Erik. So in reality, our newer solutions are doing very well. In fact, our bookings for that group grew over 100% year-over-year. And the way to think about it is, as I mentioned previously on the discussion with Melissa, is that our customers tend to start small and expand over time, which is a source of profitable growth for us. And you see that in the penetration metrics. So cloud agent penetration went to 14% of our customer base this quarter from 12% last quarter. And in the multiproduct adoption metrics that I covered, such as 3 enterprise customers with 3 or more solutions, going to 37% this quarter from 34% last quarter. And as Philippe mentioned, this makes us even more sticky with our customers.

It sounds like that will start to move up as we look forward, as those penetration rates continue to improve. Is that...

Yes. Of course, it will. But let me make another point, Erik, is the fact that our base is increasing. So even though you see the 15%, it's a 15% on an increasing base. So already there, you have kind of a very nice pickup. And of course, as the customers deploy more then of course, you will see some acceleration. Again, everything at Qualys you have to realize, we don't push our customers to do deal, which are going to end up into -- like in many other, end up into shelfware. You pay for what you use, and our customers have the tendency to start smaller and then deploy over time. Not all of them, but the immense majority of them. So we are very happy because they like the service and it's all -- and then it becomes very cost effective because as you know, it's much easier to set additional services to existing customers. They're much more cost effective than to try to, of course, get additional customers.

And unlike other companies, we don't [incent ourselves first by] product. So we let it come naturally as Philippe was describing so that our customers -- we have natural high renewal rates as a result as opposed to just shoving shelfware.

Absolutely. This is the core for our profitability, is on one hand the platform, which allows us to deploy -- to develop quite efficiently services that I think I mentioned, that we did essentially what Evident.io asked, with 6 engineers in India. And then, once they are on the platform, the distribution is instant and very cost-effective. And then, of course, on the sell side and the support side is significantly more easier to support and to a solution that -- where everything is centrally managed and set for [updating] and that where customer can try and then buy. So it's a very efficient model that we have built over time very, very consciously and that's why we have this margin that nobody can believe that we have essentially.

And so on the Cloud Agent question, we provided that we have -- we sold 8.1 million over the last 12 months. So that's the base from which we can upsell a number of our other solutions that rely on the Cloud Agent. And from a technology perspective, that's a subscription base to think about.

Okay. And then in your guidance, based on our calculations, it looks like OpEx goes up notably in the fourth quarter. Margin comes down a little bit. Is there anything -- any reason why your December quarter OpEx would bump us and is that something that would remain at those levels or is there anything that would change after that?

Yes. So as I said earlier, we do expect second half operating margins to be down from the first half, as we continue to invest in the business. It's a number of areas. It's more senior level hires than Sales & Marketing we're planning on adding. We're doing implementation of systems in G&A such as we're putting in Workday this year as well as an FP&A tool. We have also have in Q4 our user conference, which is a significant amount of spend. That's also in Sales & Marketing. So there is a bit of seasonality, some of the spend in Sales & Marketing, for example, but it's also continued hires and R&D to get the products into beta and from beta into GA.

And our next question comes from the line of Rob Owens of KeyBanc Capital Markets.

As you talked about your longer-term model and acceleration in revenue, if I look at the first half of this year, your billings, whether we look at kind of the total billings or even the quarterly billings, has grown at a slower rate than revenue. So a couple of questions. Melissa, what's the 606 in there because I'm sure that held down -- that recognized a realized Q1 billings? And then, number two, does that come through acceleration to achieve that higher growth rate or is there something that's more in-period like from MSSP or something that would help you get there?

Yes. So on 606, there's actually no impact to our top line. It's really just the amortization of commissions. I think with regards to the billings questions, look, we were delighted that our current billings exceeded consensus. Our current billings was $71.9 million this quarter. But as we have consistently said that billings growth is not a proxy for annualized bookings growth because it's impacted on a quarterly basis, because it's impacted by factors such as the timing of invoicing, the duration of the current deferred revenue and FX. So we've consistently said that we believe that the trajectory of our annual revenue guidance is the best proxy for business momentum because certainly, current bookings inform that guidance.

Yes. In addition, the total billings are absolutely not representing the total of our business because we do not incentivize. We do 3-year deals, and we've got quite a few of those, but this 3-year deal with annual payment. And of course, we do some 3-year deal with everything paid upfront, but you do not encourage. [I would say first of all] don't commission them to bring these deals. It's more the customers coming to us, so this is very irregular. Why would we go and try to give additional discounts when we have so much cash at the end of the day. So that's not a good business decision and that's why the total current deferred revenues of the billings are not really representative at all of our business. Maybe, Melissa, you want to add something on that?

Yes. Well, 2 things. So as Philippe was saying, total billings distorts your ability to compare companies based on an annualized bookings or annualized recurring revenue metrics since it's based on total deferred revenue, which includes your non-current portion, which is based on prepaid multi-year deals. And since often prepaid deals come with a discount to the cash, we have no need to do that. I think with regards to the other part of your question, Rob, we do expect to see our ability to increase our revenue growth. The outlook we had given for 2021 at the Analyst and Investor Day of mid -- low to mid-20s is based on our ability to continue sell more into our existing customers, which we can more easily do as we have additional solutions come out. But also, to bring our new customers as again, we have many different solutions to attract them to our platform with.

Great. And then you mentioned how you have high renewal rates. What are those renewal rates at this point, I guess, both from a gross and a net basis? And with the addition of all these new products, what are you seeing with that trendline of net renewal rates?

Yes. So we provided at our Analyst and Investors event, our updated dollar net expansion rates, which we -- that's what we focus on. And it's been increasing nicely over the years. It was 109% in the last quarter over the LTM period, about 106% the year before.

Yes. And another point you may want is that we have today a business, which is -- that we have segmented very well in the sense that we have the enterprise, the SME and the SMB. And associated with these markets, we have also, if you prefer, done a product segmentation where we have Qualys Enterprise, Qualys Express and Qualys Express Lite. And of course, the renewal rates in the SMB and especially, on the SMB are certainly not as high, obviously, than in the enterprise. So when you look at that number, this is an aggregate number, and which means, you could see our enterprise business is even healthier than that. But we do not disclose essentially, the mix at this stage. At some point in time, I think we are now gearing up now that we have all these new services and these go-to -- and these free go-to-market services we are really going to focus on the essentially, as well on the SMB to try to accelerate our growth there because we see a unique opportunity.

Our next question comes from the line of Sterling Auty of JPMorgan.

On the Fed initiatives that you have going through partners, et cetera, is there an incremental infrastructure spend that's going to be necessary to support, especially when we think about the DoD side of the government?

Not really. Not per se on the subscription, et cetera. What we typically have is that you need -- essentially, of course, we do FedRAMP High, for example. That will be -- it's a big effort so you have additional cost. But when you look in overall perspective, of course, when we provide, for example, a disconnected platform, we charge more for that platform than we charge for a platform where Qualys automatically remotely manage everything. So all in all, the answer to your question is not significant. And we also will leverage a lot of integrators as well. So as you know, we don't have professional services. We don't do professional services. Everything that we do is subscription-based 100%. So we don't have this additional cost, of course, to carry.

Got it. Got it. And then, Melissa, I missed it, if you said it in the prepared remarks, but what was the FX impact on the top line and on expenses in the quarter?

Yes. So it impacted our revenues by -- it was a positive impact of about 100 basis points to our growth rate. It was less than $0.01 to EPS, a couple of hundred thousand dollars bottom line.

And our next question comes from the line of Anne Meisner of Susquehanna Financial.

Sorry. Can you hear me now?

Yes.

Yes. Yes, we can.

So the question is for Philippe. I was hoping to get an update on the Patch Management solution, which I believe is targeted for the second half. If you prepare to launch that capability, how are you looking at the go-to-market strategy there with respect to the buyer and the organization that you're targeting? Are you going to be targeting the same security team that focuses on vulnerability management? Basically, for the set of patches that are allowed to push out themselves or do you think that would be product that's used by kind of the broader IT organization?

So I think we need to distinguish here the SMB versus the enterprise. So what we believe with the Patch Management, which effectively is going to go-to-market at the end of this year. As you may remember, we delayed it because we put priority on the passive scanning, et cetera, so we realigned a bit our engineering resources. We always have seen the Patch Management as kind of a no-brainer for the SME/SMB because for them, everything becomes integrated. The networks are small. So we see -- we have always seen a great interest in that market. On the enterprise, it's a little bit more complicated. Because they all have their own Patch Management solutions. The problem that the enterprise has today is the immediacy of patching. So we're looking at our solution today not necessarily as a replacement of their existing infrastructure, but being there for immediacy because if you look, for example, at vulnerabilities at WannaCry, you suddenly have to patch across multiple environments, Unix and this and Microsoft. And today, the current patching solution on the enterprise are pretty, pretty tedious. So we think that we are going to enter through that use case in the enterprise through that immediacy, when you've got to patch quickly. And of course, we're willing to wait also with some of the services. But we see the immediate take, essentially, on the SME/SMB because that's a no-brainer for them. It's all integrated. You push a button and you're done. And the cost, of course, is not that significant either and you don't have that many systems to patch as well.

Our next question comes from the line of Gur Talpaz of Stifel.

I'll follow up that question. Philippe, maybe give us an update here on the Passive Network Discovery product you plan to launch this year. And I think maybe taking that one step further, how important do you think Passive Network Discovery ultimately is for a full IT asset inventory?

This is absolutely strategic. I think this is something that we are very proud of. We're so happy that it's coming. I mean, I've been impatient, if you may, to get that done. I'm so happy that it's on beta. In fact, Sumedh gave to one of the large customers a demo, a real live demo, about -- what was that, about a week ago. I was myself, personally floored. I could not believe the integration that we have done. So fundamentally, to answer your question more specifically, is that the passive scanning does a few things. First of all, on the discovery of -- your network discovery, the scanning technology that we have mastered is really not good for the asset inventory. Just give you kind of a discovery, you can see what's going on but you don't have much visibility. Conversely, the agent technology, we have also mastered, give you full visibility of the assets. Whatever, what they have, what is on the asset, what has changed. The problem is that, of course, if you want to do your global IT assets inventory and you have like most companies, no clue about what you have, you get it with an agent. You have to know first. So that's where the passive scanning comes in. The passive scanning listen now to the traffic and we detect any devices that connects. We have done a huge effort at fingerprinting a large area of devices. We're adding also on the top of that, the ITYM capabilities. So now suddenly we can identify those assets that comes in with great precision, thanks to the passive scanning. And now the question becomes, do you want to have that device being managed, yes or no? Should that device have an agent or should we use authenticate scan or whatever other techniques? And then of course, we continuously monitor that, and now synchronize. In order to do that, that's a very important point that I'm making. You need a backend, which is absolutely significant robust today, not only an ElasticSearch which, of course, allows you to centrally categorize, identify all these assets pretty quickly because you cannot choose an Oracle database to do that. It will take you forever. So today, we have indexed on our ElasticSearch clusters 250 billion data points. We could do twice as much. Also, you want to have all that information that we collect also coming from different sources, communicating very well. So on our Kafka backend now, we have scaled that backend to 9 billion events a day. I mean, significant. So we have the muscle, the engineering, everything behind. Now the -- to finish the passive scanning also will have a lot of other interesting use case as with our IOCs, like suddenly we could identify not only just compromised device but suspicious devices. And we eliminate the suspicion by listening to what's coming in and out of that device that we have deemed suspicious, because we have classified all these malware into families. So instead of just looking for precise hash or match, we can now look for where we got a family match. Other very significant usage of the passive scanning is on the IoT because again, on the IoT devices, it's very difficult to put an agent, although Qualys is coming with an SDK so IoT vendors are going to be capable of building their own agent. But then, you also want to listen to the device because it's -- et cetera. So then it's all about fingerprinting of these devices, which we are doing. We have a big team in India now doing nothing but fingerprinting. We are fingerprinting all the devices as we speak of a large manufacturer car company in Europe. So if you prefer that passive scanning is also a foundation for our forthcoming IoT solution. We have the backend, we have the platform so we need of course the detection and the passive scanning is very strategic for that. So this is significant and that the scale at which we do and no competitors of ours has that totally integrated in the platform. So some competitors have the passive scanning since quarter 1 but it's another application. It's not at all integrated with our platform. And that integration is not a walk in the park, I can tell you, because of the scale at which you need to really apply the technology.

That's really helpful color. Melissa, can I ask you one question here?

Yes.

If we look at the -- sort of the billings makeup here, the deferred makeup -- is it -- there's a clear trend towards current versus relative makeup. Have you seen durations kind of shorten here over the past few quarters, trending towards 1 year?

Yes. So I would say a couple of things. First of all, because as we discussed earlier, we don't intend to -- our sales force to go after prepaid multi-year deals. You have seen our noncurrent declining. So as a result, you're seeing -- from a growth perspective, you're seeing it in the current deferred revenue. Again, that's really how we manage our business. So I know we're going to -- I'm going to sound like a broken record, but we really do think if you're going to compare companies, you need to look at annualized metrics. And for us, an annualized metric is going to be based on our current deferred revenue, not total. And I suspect that's true for many companies because they're all going to have their noncurrent portions of their longer-term multi-year deals in their noncurrent.

Yes. And let me give you another color here. For example, when we have a customer who has cash and who wants to do a 3-year prepaid. So they come to us and they say, "We'd like to have a discount for that." So we say, "Really?" So we can say no. And so -- and some people say, "Okay. Or you don't give me enough." More the typical scenario. Then in that case, they go back to the 3-year which is annual payments. It's all still upfront, which is good for the cash, but we don't get of course. And so the other price protection for 3 years, which is good for them and for us, I don't have to discount. So that's the reason why we don't want to incentivize. We see by the way today because of all the solutions that we have, we are starting to see some large companies saying we will have to acquire all of your apps and without counting. So again, we are very careful. We are not going to go on discount to get a bigger deal. And then, of course -- so we have that patience, which I think comes from the model itself. So prepaid, we have now some demands for monthly billings but -- which are also to avoid that because this is more invoices that we've got to manage. That comes more from our MSSP partners. And then, we have the tendency then to do with them some kind of [quarterly] payments more so they could aggregate their -- instead of having us sending a lot of invoice.

Yes. And just to give you -- go a little bit deeper, Gur, there is an impact -- the other thing that will have an impact on your year-over-year growth is the duration of your current deferred revenue. And so over the last, I would say, if, I mean, in the last few quarters, relative to the year before, maybe slight -- slightly shorter. But that's why generally, there's a number of factors that impact the year-over-year growth rates of billings that are not impacting our year-over-year growth rate of bookings. So it's really not on a quarterly basis a great proxy. [We are] giving you something current is better than total.

And just for your sales force, do you incent on ACV? Is that how you're...

Right. That's exactly right.

Yes. Yes. So the sales force is incentivized, different but it's 100% ACV. And essentially, we have, of course the new business team, which is essentially, sold on the new business. And our renewal teams, our farmers are incentivizing both the renewal as well as the upsell.

And I think from your perspective, right, I mean, you want to -- you're not going to value a company that sells 3-year contracts that has $3 in their total deferred that's a 3-year contract versus 1 year for us. Over 3 years, it represents -- it's going to represent the same amount. Perhaps we're just going to get it collected each year, the $1 and they've gotten it up front.

Yes. Another thing also which is interesting is that the managers will tell you how strict we are with our model. We have some companies who absolutely wants CapEx. So of course, they want CapEx because that's the way they -- that's what they need. So what we do is essentially, we create a sort of a CapEx solution. However, we only take the revenues, as we deliver the service. So we don't mix any kind of sort of CapEx perpetual license. Everything that we do is 100% subscription based, and we take the revenue as we deliver the service.

And our last question comes from the line of Alex Henderson of Needham.

I was looking at the, for the first time the 30 years I've been doing this, the value of the rupee versus the dollar and see it's down 7.6% since the beginning of the year. Assuming rates are rising here and flat there, probably see some more improvement in the back half, although obviously don't want to forecast currency. But given almost a 10% benefit from the exchange rate versus the Indian currency, what would -- one, what are you doing in terms of hedging against that? And two, if we stay at that level through year-end, how do you expect to take that benefit? Will it be through additional investment in R&D resources or will it be something that you use to roll through the margins? How would you approach it?

Yes. So today, I mean, we have a very big plan to expand our headcount big time, and we have the machine. So I think all that benefit, it goes right back in -- if you look today, one of the ways is that if you look at the differential between the engineering, in engineering, you have a factor of 10. And so obviously, we can have significantly more people and that give us a very unique muscle up there and we've really mastered that relationship between our Indian subsidiary and Qualys. We now hire people -- some people, which have been with Qualys, they come here. So we have really done a fantastic -- Sumedh, in fact. This is really the credit to be given to both Sumedh, our Chief Product Officer; and Rima, our HR, our Head of Human Resources, Rima. And they both spent quite some time in India and myself, by the way, I go a minimum of one time a year to India because I want to absolutely show to them how much we value them. It's a huge source of talent, which is absolutely incredible and Pune turned out to be the best place, because they have absolutely very strong universities, technical universities. There's a huge pool of talent in Pune, not speaking of the square footage. We are now further expanding our buildings, our campus that we [set out] in India. So the difference is $1.50 a square foot versus $50 here in the Silicon Valley. It's a huge difference, huge differential.

Yes. And just to add on to what Philippe said, obviously, the business plans for expansion there, it's for the business. It's not actually because -- and the benefit -- of what's happening with the exchange rate, finances inside the business, to finance.

It's a good godsend. I mean it's...

Right.

So the question was, so to what extent will you reinvest it or would you prefer to push it through margins?

So far, we are -- we invest, yes, big time. I mean, there is so huge opportunity. We are going to acquire a few companies at some point in time and that's another 20, 25 people that comes in with -- [that totally] integrate with our solutions, we are now looking at other locations in India. India is becoming also a very big market for us. We are starting to do a lot of good job there as well. Remember, all the Indian out sources are Qualys and Qualys partners, so having a strong presence in India is very important. You see also a lot of large companies have their IT in India now. So we're extremely well positioned.

Yes, and the one thing I'll just add on, I'll remember, Alex, because of the cost differential, it's not still a meaningful portion of our expenses. The total dollars we spend there are for completely new projects.

And at this time, and there are no further questions. I'd like to turn the conference back over to Ms. Melissa Fisher for any closing remarks.

Thank you, Amanda, and thank you all for attending our Second Quarter 2018 Earnings Call. We look forward to seeing many of you in a few weeks at the KeyBanc Technology Leadership Forum in Vail and at Citi's 2018 Global Technology Conference in New York in September.

Okay, thank you.

Ladies and gentlemen, thank you for your participation in today's conference. This does conclude the program. You may now disconnect. Everyone, have a great day.