Qualys Inc (QLYS) 2023 Q1 法說會逐字稿

Thank you for standing by. Welcome to the Qualys First Quarter 2023 Investor Conference Call. (Operator Instructions) Please be advised that today's conference is being recorded.

I would now like to hand the conference over to your speaker today, Blair King. Please go ahead, sir.

Thank you, Norma, and good afternoon, and welcome to Qualys' First Quarter 2023 Earnings Call. Joining me today to discuss our results are Sumedh Thakar, our President and CEO; and Joo Mi Kim, our CFO.

Before we get started, I'd like to remind you that our remarks today will include forward-looking statements that generally relate to future events or future financial or operating performance. Actual results may differ materially from these statements. Factors that could cause results to differ materially are set forth in today's press release and our filings with the SEC, including our latest Form 10-Q and 10-K. Any forward-looking statements that we make on this call are based on assumptions as of today, and we undertake no obligation to update these statements as a result of new information or future events.

During this call, we will present both GAAP and non-GAAP financial measures. A reconciliation of GAAP to non-GAAP measures is included in today's earnings press release. And as a reminder, the press release, prepared remarks and investor presentation are all available on the Investor Relations section of our website.

So with that, I'd like now to turn the call over to Sumedh.

Thanks, Blair, and welcome to our first quarter earnings call. We are pleased to announce that we delivered another quarter of healthy revenue growth and industry-leading profitability.

A number of CISOs I have met with over the past several months continue to emphasize 4 key priorities: identifying all assets in the environment, prioritizing and quantifying cyber risk, finding fast and cost-effective solutions to address risk and ensuring adequate protection against adversaries.

The importance of these priorities were further reinforced by the findings in our 2023 TruRisk Report released by Qualys' Threat Research unit after having analyzed 2.3 billion anonymized vulnerability detections on our platform. According to our research findings in the report, the average number of days to recognize vulnerabilities in 2022 was '19, which is far less than the amount of time taken by IT teams to patch these vulnerabilities.

Organizations are looking for platforms that can help them patch prioritized vulnerabilities before they get weaponized and exploited. The message is clear. Legacy technologies available in the market today that purely focus on generating more and more detections and alerts are not enough to help secure organizations. Against a backdrop of accelerated digital transformation and a cybersecurity skills gap, organizations require further assistance in prioritizing the most severe security findings present in their critical assets and resolving them prior to exploitation.

As CISOs look to navigate the current macro and manage increased budget scrutiny, they are recognizing the need for a holistic, risk-based approach to quantify and align cyber risk to their business objectives and thereby, be in a position to communicate effectively with their Board and C-level executives.

In terms of platform innovation. For years, our mission at Qualys has been to drive continuous innovation to advance these initiatives. In doing so, we believe we' have built a new security industry paradigm, where today -- which today leverages our powerful real-time data processing capabilities across more than 13 trillion data points on a natively integrated platform. Unlike traditional detection only technologies, the Qualys Cloud Platform is proactively enhancing security programs worldwide by not only detecting vulnerabilities and misconfigurations, but also prioritizing, remediating and preventing risk with over 45 million patches deployed by our cloud agents in 2022 alone.

And by leveraging the MITRE ATT&CK framework, we're now further flexing the power of our platform to combine a continuous, real-time view of an organization's security posture through the lens of an adversary, which negatively -- with natively integrated, preemptive risk mitigation and prevention solutions. These capabilities, along with our Cloud Threat Database featuring a unified threat intelligence platform of over 25 threat feeds, uniquely provide organizations with a comprehensive risk management solution to deliver quantifiable cybersecurity outcomes essential to protecting the digital infrastructure of companies.

Consequently, our strategic vision to consolidate the security stack has caused industry analysts to take notice. IDC recently pointed to a future of vulnerability management, which evolves into an integrated cybersecurity risk management platform. Our CyberSecurity Asset Management with External Attack Surface Management along with VMDR TruRisk and Patch Management on a single platform are key to addressing this market demand. Of additional importance, the seismic shift in software application development and digital transformation using open-source software is resulting in a surge of software supply chain attacks.

In response, we're taking our innovation to the next level by extending the power of VMDR to manage the risk of Software Composition Analysis in on-prem and cloud environments. With this extension of the Qualys Cloud Platform, security teams can automatically identify open-source software across the production environment of virtual images by leveraging the same Qualys agent for deep-scan detection and remediation spanning the entire application life cycle with high efficacy and speed. This development enhances -- advances our existing Software Composition Analysis and open-source software assessment capability for DevOps teams to secure container environments in continuous integration and deployment and at run time.

In addition to this enhancement, we're also advancing our Custom Assessment and Remediation capabilities into our agent-based VMDR and Policy Compliance solutions. As Organizations develop more and more custom software, the need to expand vulnerability management from third party software to first party software is increasing. With this initiative we are enabling customers to create their own detections for managing vulnerabilities in their own custom software across their entire environment.

And finally, we've continued to expand our coverage for public cloud providers by bringing real-time cloud asset discovery and prioritization remediation solutions on a single agent to Alibaba's' cloud.

Turning now to our go-to-market motion. Q1 remained a tough period. Despite improved upsell performance, new business was challenging as organizations continued to apply additional layers of scrutiny to spending and delay project start dates, which impacted bookings. While we expect these conditions to linger for at least the remainder of the year, consolidation remains a key theme with our customers. Given our thought leadership and continuous innovations, we are fortunate to be engaged in many such conversations. Those conversations are laying a firm foundation for future growth, and our customers are on a long-term transformation journey with us.

Existing customers continuing to invest in consolidation with Qualys' platform was evidenced in Q1 by the steady adoption of VMDR, which is now deployed by 50% of our customers worldwide. A few key 7-figure annualized bookings wins with VMDR in the quarter included two Global 200 financial institutions who chose Qualys for its ability to replace traditional siloed security tools and enhance security posture on a unified platform, and one of the world's largest health care providers that is leveraging VMDR with TruRisk to manage a comprehensive risk management platform in both on-prem environments and cloud workloads.

Beyond these wins, let's take a look at additional examples that demonstrate how the power of the Qualys Cloud Platform translated into strategic customer wins and provided immediate value to the customer. First, with Zero Trust transformations underway, we are helping customers standardize their operations across a broad spectrum of security subscriptions. In a high 6-figure annualized bookings win, a large government agency aspiring to move beyond its detection only solution further expanded its use of VMDR and Policy Compliance by adding Custom Assessment and Remediation, CyberSecurity Asset Management, Patch Management, and customer XDR -- Context XDR.

This customer selected Qualys because we offer the only security and compliance stack available in the market today that utilizes both a FedRAMP authorized platform and a single lightweight agent to enable full asset visibility and context-aware mapping to prioritize vulnerabilities, proactively reduce technical debt, automate patching and future proof their security architecture with high-fidelity incident response capabilities across all environments. This is also a good example of how we are benefiting from the investments we're making in the channel to drive new business opportunities.

Another marquee 6-figure annualized bookings enterprise customer win in Q1 was with a leading business services company in the Fortune 500. This customer expanded their VMDR deployment with TruRisk while adopting CyberSecurity Asset Management and Patch Management as part of initiative to transform its IT security architecture while replacing point solutions from two vendors with a single platform. The ability of this customer to significantly enhance its security program with comprehensive internal and external asset criticality, holistic risk scoring, ticketing and automated patching across multiple environments on a natively integrated platform were all key differentiators compared to alternative legacy technologies.

With customers beginning to perceive Qualys as a leading risk management platform that consolidates multiple point solutions, we are growing increasingly confident in our ability to drive long-term growth with -- and gain market share. This confidence was again bolstered in Q1 as customers spending $500,000 or more with us grew 27% from a year ago to 162.

Growing our partner ecosystem continues to be a key pillar in our go-to-market agenda. In this quarter, we expanded our partnership with a leading MSSP in North America. With its platform already anchored in our VMDR solution, this partner is now launching a managed patching service, further validating our vision that organizations need help with timely remediation and not just more and more detections This MSSP is standardizing on Qualys' automated patching solution across Windows, Linux and Mac operating environments, mobile devices and third-party applications without the need for a VPN.

In addition, illustrating the fast progress we are making with our External Attack Surface Management, EASM solution, we extended our relationship with a leading cyber insurance company, which is now ingesting our EASM intelligence feed to continuously assess risk for adaptive cyber insurance for their customers.

Furthering our efforts to remove friction in the sales cycle by helping customers accelerate their cloud transformations and consolidate their security stack, we' have introduced a new adaptive subscription model for organizations to extend the existing VMDR deployments into cloud and container environments for CSPM and CWPP through our TotalCloud solution. The early feedback we have received from customers for this model is quite encouraging and we' are looking forward to early adopter customers in the current quarter.

In summary, it's our view that during times like this, the best companies continue to innovate focus on customer success and emerge stronger than before. Looking beyond the short-term, we believe the powerful combination of our cloud-native platform and frictionless go-to-market motion position us well as for the fundamental, holistic risk management platform of the future. Throughout the balance of this year, we will continue to focus on executing our strategic vision, driving customer success and expanding our lead over the competition with a proven approach to balancing growth and profitability.

With that, I' will turn the call over to Joo Mi to further discuss our first quarter results and outlook for the second quarter and full year 2023.

Thanks, Sumedh, and good afternoon. Before I start, I''d like to note that, except for revenues, all financial figures are non-GAAP and growth rates are based on comparisons to the prior year period, unless stated otherwise.

Turning to first quarter results, revenues grew 15% to $130.7 million with channel continuing to increase its contribution, making up 43% of total revenues compared to 41% a year ago. Revenues from channel partners grew 18%, outpacing direct, which grew 13%. By geo, growth in the US of 16% was approximately in-line with our international business, which grew 15%.

Looking ahead to the balance of 2023, we expect our U.S. and international revenue mix to remain at roughly 60% and 40%, respectively.

In Q1, we saw continued strength in customer dollar retention and upsell, in line with expectations with our net dollar expansion rate on a constant currency basis at 109%, flat from last quarter, but down slightly from 110% last year. While there remains room for improvement from smaller customers spending less than $25,000 with us, we are pleased with the strong revenue growth of 18% from larger customers.

In terms of new product contribution to bookings, Patch Management and CyberSecurity Asset Management combined made up 10% of LTM bookings and 15% of LTM new bookings in Q1. We attribute this success to an increasingly complex threat environment that highlights the relevance of the Qualys Cloud Platform to holistically assess, manage and remediate risk.

Reflecting our scalable and sustainable business model, adjusted EBITDA for the first quarter of 2023 was $58.7 million, representing a 45% margin compared to a 48% margin a year ago. Operating expenses in Q1 increased by 20% to $54.1 million, primarily driven by the growth in Sales & Marketing investments, including higher headcount and related costs.

During the remainder of 2023, we believe it's prudent to take an opportunistic approach in executing against our investment plan while not losing sight of importance of optimizing our prior investments to drive long-term profitable growth.

EPS for the first quarter of 2023 was $1.09, and our free cash flow for the first quarter of 2023 was $62.8 million, representing a 48% margin. In Q1, we continued to invest the cash we generated from operations back into Qualys, including $4 million on capital expenditures and $66.6 million to repurchase 584,000 of our outstanding shares. As of the end of the quarter, we had $187.9 million remaining in our share repurchase program.

Now let us turn to our guidance, starting with revenues. For the full year 2023, we are reaffirming our revenue guidance range of $553 million to $557 million, which represents a growth rate of 13% to 14%. For the second quarter 2023, we expect revenues to be in the range of $135.2 million to $136.2 million, representing a growth rate of 13% to 14%. This guidance assumes no material change in our net dollar expansion rate in 2023, but continued challenges in new customer growth.

We believe our value proposition remains strong with strong demand from our existing customers, but anticipate the current macro environment will moderate returns in 2023 despite having increased our Sales & Marketing headcount by over 20% in 2022.

With that said, given the long-term growth opportunities ahead of us and our industry-leading margins implying further room for investment, we will continue to responsibly invest in operations, people, and systems while recognizing the importance of optimization. As a result, we continue to expect full year 2023 EBITDA margin to be in the low 40%s with full year EPS in The range of $4.13 to $4.28, up from the prior range of $4.10 to $4.18.

For the second quarter of 2023, we expect EPS in the range of $0.98 to $1.03. Our planned capital expenditures in 2023 are expected to be in the range of $15 million to $20 million and for the second quarter of 2023, in the range of $3 to $5 million.

Consistent with prior guidance, for the remainder of 2023, we intend to align our product and marketing investments to focus on specific initiatives to drive more pipeline and support sales in response to the current macro conditions. In doing so, we plan to prioritize investments in Sales & Marketing as well as related support functions and systems over our investments in engineering.

As we endeavor to sharpen our execution by focusing on Sales & Marketing enablement and productivity, we believe we will be able to drive wallet share and long-term returns while balancing growth and profitability.

In conclusion, in Q1, we delivered healthy top line growth and industry-leading profitability. With our comprehensive risk management solution garnering industry attention and delivering immediate time to value for our customers, we are confident in our ability to deliver on our growth opportunity long-term while investing responsibly to maximize shareholder value.

With that, Sumedh and I would be happy to answer any of your questions.

(Operator Instructions) And our first question comes from Shrenik Kothari with Baird.

Question comes from Matthew Saltzman with Morgan Stanley.

So I know that you guys typically guide to revenue growth and not billings, but I do see that billings slowed to single digits in Q1. So when you think about the longer-term growth algorithm, how do you guys anticipate getting back to mid- to high-teens growth, 20% top line growth over the longer term? Are there any areas of the product portfolio that you're looking to press on? Would you potentially look at acquiring other capabilities? Just curious on kind of the growth algo from here.

Thanks for the question. Great question. So I mean, as we mentioned earlier, we will continue to be excited about what we're seeing with CyberSecurity Asset Management, Patch Management now adding EASM. Total cloud coming up. So we feel like there's really interesting areas where our customers are looking to consolidate.

And look, Q1 was a tough quarter as you had -- as we had talked about last quarter earnings call that we had made a decision with the CRO change and that the decision was really what we focused on implementing through this quarter. And of course, there was a little bit of disruption, but the good thing is that now that transition has been completed as I'm directly involved now with our sales teams and focusing on working directly.

Looking at it -- so today, we are looking at a growing and maturing pipeline for 2023. We are getting better at improving in our sales execution. Compared to last year, we have about 20% more growth in our Sales & Marketing headcount. And early signs right now for Q2, we are optimistic with what we are seeing. I mean, of course, we're cautious about the macro. But looking at our net retention rate, et cetera, I think, overall, we feel healthy about the business, even though we are cautious about the macro. And we're looking at these things plus our new product initiatives coming together so that we can start to get back to that growth rate that we had last year.

Right. And just to add a little bit more color to that. If you take a look at the year-over-year compare, Q1 was a tough quarter. Q2 starts becoming easier. So we do anticipate the bookings growth to kick off for the rest of the year. And like Sumedh mentioned, we have made significant investments in Sales & Marketing headcount. And without the current macro conditions, we would have expected higher returns. But with that said, we do anticipate that to kind of generate the type of returns and growth in the longer term.

Got it. And just as a quick follow-up. I know that this quarter, you still lapped some of the benefits of Log4j last year. Are you able to quantify at all what those benefits were from a percent standpoint as it pertains to growth in the first quarter of last year, just so we can kind of look at it on a like-for-like basis?

Yes. Last quarter, we didn't highlight that. It wasn't an immediate benefit on Log4j. And we did have a strong Q1 last quarter, but not specific to a Log4j particularly.

And our next question comes from the line of Brian Essex with JPMorgan.

I was wondering, Sumedh, could you give us a little bit of sense of what you saw from a macro perspective in the quarter, maybe relative to 4Q? Particularly, as we see some of your peers have exposure to financial services, it might have been a little more challenging. Maybe mid-market was a little bit more challenging. Would love to get your view on competitively and from a macro perspective, what you're seeing.

Sure. I think I don't feel like we saw a really significant change materially in Q1 from what we saw in Q4. And I think overall, a lot of cautiousness, project starts states we're getting pushed out. I think we do see weakness in the new business like everybody else, and I think especially on the lower end of the market. But as we look at essentially, people are -- so there's just more layers of scrutiny, et cetera.

However, as people are taking a step back from a new business perspective, thinking about when they or if they want to switch, they are also focusing on existing trusted vendors that they really feel they can do more with. And so that's kind of what we are excited about, and the conversation that we are having is -- while new business is kind of where it is right now that everybody is feeling.

We do see a lot more conversations happening on, "Hey, instead of going out and buying one scanning solution and another inventory solution and another Patch Management solution with Qualys, can I do more? I already have you guys. Can I consolidate and get the benefit out of that?" And so those are the conversations for us that are quite encouraging. But other than that, we don't see a material difference in the macro from Q4 to Q1. And we are -- in our guidance as well, we really look at it as the macro stays the same and no improvement happening in the macro. And then we didn't really have any material difference in exposure from the financial banking issues that we've had. So Joo, you can maybe talk more about that.

Yes. About 20% of our business comes from the financial institutions. And from our side, we haven't seen anything in our discussions or observed anything specifically in our bookings. We don't think it's going to be material to our business. But as things involved and if conditions change in Q2, we will update.

Got it. That's super helpful. Maybe if I can sneak in a follow-up, Sumedh. You commented on the CRO changes, and that you've kind of taken the reins. Maybe just any progress report in terms of where you're shaking out from a hiring perspective. Are you more -- I guess, are you aggressively looking for new CRO? And then how does that line up with what your plans are for incremental hiring in Sales & Marketing throughout the year?

Yes. Look, I think being here for 20 years, I have a pretty good sense of the business, the company and everything. I think we do continue to look for a sales leader. However, I'm back like I did in '21. I'm back hands on working with our second level team, which has been -- they've been great and they've been with us for a long time. So we feel pretty good about that.

I think, overall, from a sales hiring perspective, pretty happy with what we have seen from last year to this year with the 20% increase. But I think we continue to focus on being prudent as we move forward with our investment in Sales & Marketing and may not be the same rate as growth in Sales & Marketing as last year. However, we still continue to anticipate to grow and -- throughout the year and get to double-digit growth. Again, that's the thought process. We're pretty excited about the opportunities we see. And so we're going to continue to invest in that area.

And our next question comes from the line of Alex Henderson with Needham & Company.

So I wanted to ask a couple of questions on the North America revenue decline for the first time quarter-to-quarter, and the direct revenue clearly decelerated pretty sharply from -- to 12% growth from 19% growth last quarter. So I guess I'm wondering, is there a mix shift in the emphasis of the company that is causing those to occur? And is it a function of the strong 20% growth in the channel that's cannibalizing some of the direct revenues? How are you balancing between those and measuring it?

Yes. Right now, we are investing across globally. And what we're looking at is, given the investments that we're making, we do anticipate the revenue mix between U.S. and international to stay approximately the same current at 60% U.S. and 40% international. In terms of the direct versus indirect, we have been focusing on developing our relationship with and building our relationship with our channel partners. So we do anticipate the mix to be shifting more towards the channel partners. And we have been seeing the ramp up there, even though -- compared to the growth rate in Q4, it has declined, right, going from 22%. Right now, 18% is still strong from the channel partners, but it is lower.

So just to be clear, as you look at the very large expansion in your sales capacity in '22 and continuing in '23, is that heavily skewed towards supporting the channel? Or is it equally split between channel investment and direct channel or direct sales investments?

It was more on the direct. On the channel, it's more of the incentives and working closely with our channel partners versus hiring more channel managers per se. So the dollar investment that we made in the business is more skewed towards the direct sales force.

Our next question comes from the line of Rudy Kessinger with D.A. Davidson.

Joo Mi, I want to clarify what you said earlier. I think you said, for the remainder of the year, you said it compares really a little easier and you do expect your billings -- excuse me, I think you had said bookings growth to accelerate. But to be clear, in your current calculated billing, again, came down to 9% this quarter. Do you expect your billings towards your current calculated billings growth on a year-over-year basis to accelerate throughout the rest of the year? Or do you expect it to stay in the high single digits?

We do expect it to accelerate. So when I said the easier compares, take a look at the current billings growth rate last year. In the first half, it grew by 20% and 18% versus 13% and 12%. So it is an easier compare in the second half of this year. So we do anticipate the growth rate in this year to a seller throughout the rest of the year.

Okay. Got it. That is helpful. And then on the -- I don't know, on the EBITDA margin front, you guys continue to be pretty impressively there, respective to revenue outperformance in the quarter, whether it's small or big. You continue to point us to low 40s EBITDA margins. It seems like -- it seems conservative, I don't know. Any color to add as to how you guys keep showing such good upside on the EBITDA margins? And potentially long term, is mid-40s more of the right go-forward rate? Or are you guys very convinced that low 40s is the right rate going forward?

Yes, yes. We felt that it'd be low 40s because if you take a look at the year-over-year change, it's been a couple of hundred basis points of contraction. So as an example, in Q1, it's 45% EBITDA margin. A year ago, it was 48%. And I know that we ended the year in 2022 with 45% EBITDA margin. We expect that to kind of trend down because of that.

Question comes from the line of Josh Tilton with Wolfe Research.

I just want to follow up on the last one. I'm just going to ask it very straightforward. To us, with imperfect information, current billings is kind of the best indication of what your future revenue growth is going to be, and you just grew billings 9% or current billings 9%. I understand the investments to kind of improve the future growth algorithm. But is there anything you can give us to help us understand the confidence you have in reiterating the revenue growth for this year in light of the current billings coming in at 9% growth in 1Q?

The assumption is that current billings will accelerate. So we are seeing current billings that will be higher than 9% in Q2 and Q3 and Q4. And one of the reasons is because it isn't easier compared to last year, especially because we had a tougher period in the second half of last year, with the current billings of the second half of last year coming in at 13% and 12%.

And then plus, the biggest assumption that we have made is, despite the macro, we did increase the Sales & Marketing investment significantly last year. In 2022, we grew our headcount by over 20% compared to only by 3% in 2021. Now most of those hiring was back half weighted in 2022. So even if their sales productivity is lower in 2023, they do add -- they do increase the foot on -- in terms of the distribution. And out there, they'd be able to sell more. And then plus, as Sumedh had mentioned, that we have a growing pipeline that's maturing. So even with the lengthening sales cycle, we do expect that to help grow the bookings as well as, I mean, consequently, the billing.

Okay. And then just a follow-up on that. Maybe my math is a little incorrect here, but it looks like your partner sales, they did grow nicely year-over-year in 1Q. But on a dollar basis, they actually ticked down slightly from 4Q. What kind of visibility do you have into that part of the business? How does that compare to the visibility you have into the direct sales? And how should we think about that partner sales growth trending for the rest of the year?

Yes, we made -- last year and around the same time frame, we decided to kind of roll out this partner program, which is fairly new to us in a way that we have been working with our partners, working from an incentive perspective, aligning channel managers that we didn't have before with these partners. And so of course, most -- a lot of these deals, our channel managers, our technical account managers do work hand-in-hand with the partner. And so as we are going through this motion and getting better at working with the partners, we do get a certain amount of visibility because we are actively working with those partners on a bunch of these deals, especially at the enterprise and to some extent in the mid-market as well.

And so I think we anticipate that we are going to continue that investment on the partner side. And yes, we do think that the mix will pivot more towards partners. Just not -- we're not targeting any specific number at this point. So...

And our next question comes from Mike Walkley with Canaccord Genuity.

It's Daniel on for Mike. So I guess with the release of VMDR packages for the SMB, just curious if you can provide us with some color on how this is being received by some of your smaller customers. Obviously, there's some pressure in this segment of your business, but any details would be helpful.

Yes. I think we launched them a couple of months ago. So it's still early from tracking specific numbers, but the conversations with our sales team have been very positive. They feel like they have been able to really streamline the conversations, move these packages quicker than what they would have to do, the fact that the sales execution is improving in terms of not having to quote multiple line items, especially around Patch Management, selling it as a single package and being able to position it. We've got pretty positive feedback. And so we're optimistic of how that's actually going to impact us over the next few quarters. But we're tracking that, and we are looking to see if we need to do any additional packages as well, given the response that we have had with different numbers as well.

So I think, overall, I would say I'm pretty positive about what we are seeing and then we'll continue to track how much of an impact and how that's actually having an impact in that segment as we move forward. But early indications, definitely quicker. Deals are closing quicker because the value prop is much clearer, and it's a single line.

And our next question comes from Shrenik Kothari with Baird.

At this point, I'm showing no further questions. Ladies and gentlemen, thank you for participating in today's conference. You may now disconnect. Everyone, have a wonderful day.