Qualys, Inc. (QLYS) 2026 Q3 法說會逐字稿

Ladies and gentlemen, thank you for standing by. Welcome to Qualys' third quarter 2026 investor call. (Operator Instructions). Please be advised that today's conference is being recorded.

各位女士、先生，感謝您耐心等候。歡迎參加 Qualys 2026 會計年度第三季投資人電話會議。（接線員指示）。敬請注意，今日會議將被錄音。

I would like now to turn the conference over to Blair King, Investor Relations. Please go ahead.

現在我想把會議交給投資人關係部的 Blair King。請開始。

Thanks, Michelle, and good afternoon, and welcome to Qualys' third quarter 2026 earnings call. Joining me today to discuss our results are Sumedh Thakar, the President and CEO; and Joo Mi Kim, our CFO. Before we get started, I would like to remind you that our remarks today will include forward-looking statements that generally relate to product capabilities, future events or our future financial or operating performance.

謝謝你，Michelle。各位下午好，歡迎參加 Qualys 2026 會計年度第三季財報電話會議。今天與我一同討論業績的有總裁暨執行長 Sumedh Thakar，以及財務長 Joo Mi Kim。在開始之前，我想提醒各位，我們今天的發言將包含前瞻性陳述，通常涉及產品能力、未來事件或我們未來的財務或營運表現。

Actual results may differ materially from these statements. Factors that could cause results to differ materially are set forth in today's press release and our filings with the SEC, including our latest Form 10-Q and 10-K.

實際結果可能與這些陳述有重大差異。可能導致結果出現重大差異的因素已載於今日新聞稿以及我們向美國證券交易委員會（SEC）提交的文件中，包括我們最新的 Form 10-Q 與 10-K。

Any forward-looking statements that we make on this call are based on assumptions as of today, and we undertake no obligation to update these results of new information or future events. During this call, we will present both GAAP and non-GAAP financial measures.

我們在本次電話會議中所做的任何前瞻性陳述，皆基於截至今日的假設；對於因新資訊或未來事件而更新這些結果，我們不承擔任何義務。在本次會議中，我們將同時提供 GAAP 與非 GAAP 財務衡量指標。

A reconciliation of GAAP to non-GAAP measures is included in today's earnings press release, -- and as a reminder, the press release, prepared remarks and investor presentation are all available on the Investor Relations section of our website.

GAAP 與非 GAAP 指標之間的調節表已包含在今日的財報新聞稿中，-- 並提醒各位，新聞稿、事先準備的講稿以及投資人簡報皆可於我們網站的投資人關係專區取得。

So with that, I'd like to now turn the call over to Sumedh.

那麼，接下來我想把電話交給 Sumedh。

Thank you, Blair, and welcome to our third quarter earnings call. AI has fundamentally transformed the advisory's playbook, graduating from accelerating existing attack techniques to autonomously operating inside life production environments.

謝謝你，Blair，也歡迎各位參加我們第三季財報電話會議。AI 已從根本上改變了攻擊者的作戰手冊，從加速既有攻擊技術，進一步演進到能在實際生產環境中自主運作。

To put the scale of this shift in perspective, Microsoft's recent Patch Tuesday, disclosed 1,414 new vulnerabilities in a single release compared to 93 before the advent of Frontier AI. That's a 15-fold increase in exposure volume within the last seven months alone that every enterprise must now absorb in real time.

為了讓各位理解這項轉變的規模，微軟近期一次 Patch Tuesday 在單次發布中揭露了 1,414 個新漏洞；而在 Frontier AI 出現之前，僅有 93 個。這代表在過去短短七個月內，曝險量增加了 15 倍，而每一家企業如今都必須即時消化。

Within 10 minutes of Microsoft publishing this advisory agent in star powered by Instaposted scanless detections in a customer's environment, giving them immediate view of their exposure, no scan cycle, no agent disruption, no days long wait, the detection at AI speed.

在微軟發布該公告後 10 分鐘內，由 InstarScan 驅動的 Agent in Star 就能在客戶環境中以無掃描偵測方式完成偵測，讓客戶立即掌握其曝險狀況；不需要掃描週期、不會干擾代理程式、也不必等待數天，而是以 AI 速度完成偵測。

But detection alone changes nothing if what follows still takes weeks. Still relies on manual handoffs and still can't prove the exposure is closed. Events like the PHP to Shell disclosure and others are just a warning of what lies ahead and the need for speed from disclosure to remediation is clear.

但若後續仍需數週，單靠偵測並不會改變任何事。若仍仰賴人工交接，且仍無法證明曝險已被關閉，也一樣無濟於事。像 PHP to Shell 漏洞揭露等事件，以及其他案例，只是在警示未來將面臨的情勢；從揭露到修補的速度需求已非常明確。

Durable pre-breach risk management requires a vendor-neutral agentic-ARSk fabric that can autonomously transform detections into proven remediation of actual exploitable risk at the speed of modern attacks.

要建立可持續的事前（pre-breach）風險管理，需要一個供應商中立、具代理式（agentic）的 ARSk 結構（fabric），能以現代攻擊的速度，自主地把偵測轉化為可被證明的修補，針對實際可被利用的風險完成處置。

Against this backdrop, we delivered another strong quarter of revenue growth and profitability alongside one of our most meaningful quarters of platform innovation to date. The execution reflects a clear shift in how customers evaluate and select their security platforms.

在這樣的背景下，我們再度交出一季強勁的營收成長與獲利表現，同時也帶來迄今最具意義的其中一季平台創新。這樣的執行成果反映出客戶在評估與選擇資安平台時，已出現明確的轉變。

The traditional CTEM model wasn't built for this moment and it shows more findings, more theoretical risk scores, more dashboards and more handoffs each one a gift of time to an advice adversary that now operates at machine speed.

傳統的 CTEM 模型並非為了此刻而設計，而現況也證明了這點：更多發現項目、更多理論性的風險分數、更多儀表板、更多交接流程——每一項都等於送給如今以機器速度運作的對手更多時間。

When customers can't patch fast enough to outrun autonomous expectation, the last thing they need is another tool that tells them what's wrong and passes the problem to someone else to fix. CSOs are looking to update their boards with their plan of action against autonomous exploitation with the road map of autonomous remediation instead of more manual tools and processes.

當客戶無法以足夠快的速度修補以超越自主化的攻擊預期時，他們最不需要的就是另一個只告訴他們哪裡有問題、然後把問題丟給別人去修的工具。資安長（CSO）希望向董事會更新的是：面對自主化利用（autonomous exploitation）的行動計畫，以及自主化修補（autonomous remediation）的路線圖，而不是更多人工工具與流程。

That architecture was already losing before the frontier AI era. Today, against an AI-powered adversary, it's indefensible.

在 Frontier AI 時代之前，那種架構就已經逐漸失勢。而今天，面對 AI 驅動的對手，它更是毫無防禦性可言。

We developed the vision and build the AI native ROC powered by our ETM solution over 3 years ago to end that cycle entirely.

我們在三年前就提出願景並打造 AI 原生的 ROC，由我們的 ETM 解決方案驅動，目標是徹底終結那個循環。

Today, agent in star powered by InstarScan is detecting newly exposed vulnerabilities at customer systems in less than 60 minutes of disclosure on an average?

今天，由 InstarScan 驅動的 Agent in Star，平均能在漏洞揭露後不到 60 分鐘內，就在客戶系統中偵測到新暴露的漏洞？

Agent valve powered by TruConfirm has already performed approximately 9 million exploit validation across customer environments and still 11% of those confirmed exploitable, eliminating 89% of that noise would have been otherwise consuming security and IT resources.

由 TruConfirm 驅動的 Agent valve，已在客戶環境中完成約 900 萬次可利用性驗證（exploit validation），其中仍有 11% 被確認為可被利用；這等於消除了 89% 的雜訊，否則原本會持續消耗資安與 IT 資源。

And risk eliminate with Agent Sara has helped customers deploy over 180 million patches in the last 12 months alone, with 60% of those running autonomously doubling from 30% a year ago at a rollback rate of fuel than 1 in 8,000. Together, they operate natively in a continuous closed loop that proves autonomous closure within hours, not weeks.

而透過 Agent Sara 的風險消除（risk eliminate），在過去 12 個月內協助客戶部署超過 1.8 億個修補程式，其中 60% 以自主方式執行，較一年前的 30% 翻倍；回滾率低於每 8,000 次僅 1 次。三者結合後，能以原生方式在持續的閉環中運作，在數小時內（而非數週）證明自主關閉（closure）。

The AI native rock isn't a road map. It's not a vision slide. It's operational, measurable and provable and that's nearly all enterprise and federal customer conversations are center. Carrying this momentum forward, we are further evolving our ETM and Truist eliminate capabilities through an expanded ecosystem of remediation solutions.

AI 原生的 ROC 不是一張路線圖。也不是一張願景投影片。它是可運作、可衡量、可驗證的——而這幾乎已成為所有企業與聯邦客戶對話的核心。延續這股動能，我們正透過擴大的修補解決方案生態系，進一步演進我們的 ETM 與 Truist eliminate 能力。

Over the last two quarters, we introduced our AI-powered patch liability score agents are of wave-based remediation, peer-to-peer patching and AI-guided rollbacks.

在過去兩個季度，我們推出了 AI 驅動的修補責任分數（patch liability score）、以代理程式為核心的 wave-based remediation、點對點修補（peer-to-peer patching）以及 AI 引導的回滾（AI-guided rollbacks）。

The cumulative effect of our TruRisk eliminate agenda gives organizations confidence to deploy in production environment with rollback rates below 11% across well over 0.5 billion patches delivered to date, including more than 200 million executive autonomously.

我們 TruRisk eliminate 議程的累積效應，讓組織能更有信心在生產環境中部署；截至目前已交付超過 5 億個修補程式，回滾率低於 11%，其中包含超過 2 億個以自主方式執行。

That customer confidence is translating into accelerating adoption with patch deployments up 47% from the advent of Frontier models in early April of this year and autonomous deployments growing even faster. The biggest blocker to faster patching is lack of confidence in operational outcome.

這份客戶信心正轉化為更快的採用速度：自今年 4 月初 Frontier 模型問世以來，修補部署量成長 47%，而自主部署成長更快。阻礙更快修補的最大因素，是對營運結果缺乏信心。

At our recent Rokan conference in Austin, we built on this foundation by announcing what we call autonomous remap brought to life through risk eliminate 2.0 with true confidence.

在我們近期於奧斯汀舉辦的 Rokan 大會上，我們在此基礎上宣布了我們所稱的 autonomous remap，並透過具備 true confidence 的 risk eliminate 2.0 將其具體落地。

TruePoint Finance is a remediation and orchestration intelligence engine delivered on a straightforward operating principle, fixed the minimum, credit existing controls choose the right remediation path, control the rollout and prove that it held.

TruePoint Finance 是一個修補與編排（orchestration）智慧引擎，其遵循一個簡明的作業原則：修最少的部分、認列既有控制措施、選擇正確的修補路徑、控管推送節奏，並證明修補確實有效且持續成立。

The new capabilities represent meaningful new ground for balance. First, before a corrective action is raised true confidence assesses the protection already provided by third-party security controls. So customers don't duplicate their efforts.

這些新能力代表了對平衡（balance）而言的重要新領域。首先，在提出矯正行動之前，true confidence 會評估第三方資安控制措施已提供的防護。因此客戶不會重複投入。

Second, it extends coverage beyond endpoints to cloud applications, perimeter and edge assets, including routers, switches, firewalls and airgap infrastructure that historically sat outside response workload because they cannot run an agent.

第二，它將覆蓋範圍從端點延伸到雲端應用、周界與邊緣資產，包括路由器、交換器、防火牆以及氣隙（airgap）基礎設施；這些資產過去往往不在回應工作負載範圍內，因為它們無法執行代理程式。

And third, build on the rollback capabilities, we introduced last year, post deployment, operational resiliency monitoring through partners like Dynatrace now track system health to confirm the environment remains stable post patch.

第三，在我們去年推出的回滾能力基礎上，我們在部署後引入營運韌性監控；透過如 Dynatrace 等合作夥伴追蹤系統健康狀態，以確認修補後環境仍維持穩定。

When a past doesn't hold AI power patch failure analysis explains root cause in Clean English and recommends corrective action. The result is an AI-native rock, which serves at both the system of record and the system of action for cyber risk reduction.

當某個修補未能維持效果時，AI 驅動的修補失敗分析會以清楚易懂的英文說明根本原因，並建議矯正行動。其結果是一個 AI 原生的 ROC，同時作為降低網路風險的「記錄系統」（system of record）與「行動系統」（system of action）。

Other vendors entering the mitigation conversation are orchestrating a handoff of agent-based endpoints and passing a patching recommendation to a third-party to without giving the operational confidence and no verification that the fix was successful we applied or that the environment remains stable afterwards.

其他進入緩解（mitigation）對話的供應商，往往是在編排一個以代理程式端點為主的交接流程，並把修補建議交給第三方；但既無法提供營運層面的信心，也無法驗證修補是否成功套用，或事後環境是否仍然穩定。

The Qualys platform was purpose-built to eliminate that hand off entirely and delivers natively integrated autonomous ramp ups with true confidence at scale, rapidly proving closure across every domain and asset type. With Qualys no asset, whether it runs an agent or not and no exposure, whether a patch exist or not will be left without an immediate path to closure.

Qualys 平台的設計初衷就是要徹底消除這種交接，並以原生整合的方式，在大規模情境下交付具備 true confidence 的自主化 ramp ups，快速在各個領域與各類資產上證明關閉（closure）。使用 Qualys，任何資產——不論是否能執行代理程式——以及任何曝險——不論是否存在修補程式——都不會在沒有立即關閉路徑的情況下被遺漏。

Our continuous innovation and industry-leading capabilities are now garnering significant recognition from customers, partners and independent analysts in the 2026 forest survey for proactive security platforms, Qualys received the highest rating among all evaluated vendors on the key criteria including network visibility exposure, business-driven prioritization and remediation.

我們持續的創新與業界領先的能力，如今正獲得客戶、合作夥伴與獨立分析師的高度肯定。在 2026 年 Forest Survey 針對主動式安全平台的評比中，Qualys 在關鍵評估標準（包括網路可視性曝險、以業務驅動的優先排序與修復）上，獲得所有受評供應商中的最高評等。

Additionally, Koping Qualys all is the highest rated leader in the 2026 leadership compass for our back surface management earning the top position in both product and market leadership, both underscore our customer-driven engineering and growing competitive differentiation across the platform. Moving to our business update.

此外，在 2026 年 Leadership Compass 針對我們的攻擊面管理（attack surface management）的評比中，Qualys 亦被評為最高評等的領導者，在產品領導力與市場領導力兩項皆名列第一；這些都凸顯我們以客戶為導向的工程能力，以及平台層面日益擴大的競爭差異化。接下來進入我們的業務更新。

The number of customers spending $50,000 or more with us grew 15% from a year ago to 243. Let me now share a couple of recent wins, which illustrate why organizations are turning to Qualys to help unify their security stacks, operationalizing the rock and put autonomous remediation to work.

年度支出達 50,000 美元以上的客戶數量，較去年同期成長 15% 至 243 家。接著我分享幾個近期的贏單案例，說明為何各組織正轉向 Qualys，以協助整合其安全技術堆疊，並將 Rock 與自動化修復落地運作。

First, we closed a new low seven-figure annual booking deal with a large government agency. This agency had been running on an on-prem vulnerability management program for years, scanning with one vendor manually triaging across disconnected dashboards and handling patch cycles after yet another vendor.

首先，我們與一家大型政府機構簽下新的年度訂單，金額為低七位數美元。該機構多年來一直使用地端（on-prem）弱點管理方案：用某一家供應商進行掃描、在彼此分離的儀表板之間手動分流與分級處理，並在另一家供應商之後再處理修補週期。

As the detection volumes surged, the model was breaking down. Response backlogs were growing and the agency kept falling further behind. Seeking to streamline operations, the agency run a highly competitive process and selected Qualys to help activate its rock on a single Fed ramp high authorized platform.

隨著偵測量暴增，原有模式開始失效。回應待辦量持續累積，該機構也愈來愈落後。為了簡化營運，該機構進行了高度競爭的評選流程，最終選擇 Qualys，協助在單一 FedRAMP High 授權的平台上啟用其 Rock。

In doing so, it landed with seven Qualys modules right out of the gate, including ETM, ETM identity, VMDR, truesaluminate, policy audit, total cloud and total upside. The net result is that this agency has now consolidated a fragmented multi-vendor workflow into a unified AI-powered risk fabric.

因此，他們一開始就導入了 7 個 Qualys 模組，包括 ETM、ETM Identity、VMDR、TruRisk Illuminate、Policy Audit、TotalCloud 與 TotalAppSec。最終成果是：該機構已將分散、碎片化的多供應商工作流程，整併為一個統一的 AI 驅動風險架構（risk fabric）。

A fabric that detects exposure within minutes of disclosure validates actual exploitability, so teams can act on real risk rather than theoretical scores and automate response by natively applying patches and other compensating controls when patches are too risky to deploy or unavailable.

這個風險架構能在漏洞披露後數分鐘內偵測曝險、驗證實際可被利用性（exploitability），讓團隊能針對真實風險而非理論分數採取行動，並可透過原生方式自動化回應：在可行時直接套用修補程式，或在修補程式部署風險過高或不可用時，改採其他補償性控制措施。

What used to take weeks from detection to confirm fixed now takes hours and a patch backlog that has been compound executed that for years is now under control.

過去從偵測到確認修復完成需要數週，現在只要數小時；而多年累積、持續擴大的修補待辦也已受到控制。

Given the success of this deployment, the customer is now actively evaluating total AI and planning to deploy Asian TKI workflows across its operations.

鑑於此次部署的成功，該客戶目前正積極評估 TotalAI，並規劃在其營運中部署 Asian TKI 工作流程。

The second was an existing large federal agency, which has struggled to manage its cloud and infrastructure security using siloed tools while manually consolidating findings with no unified view of risk, prioritization relied on CVS' security scores rather than valid exploitability and their security IT teams are making critical decisions on incomplete data.

第二個案例是一家既有的大型聯邦機構。該機構一直以孤島式工具管理其雲端與基礎設施安全，並以人工方式彙整發現事項，缺乏統一的風險視圖；其優先排序依賴 CVS 的安全分數而非已驗證的可被利用性，安全與 IT 團隊因此在不完整資料下做出關鍵決策。

Threat Response had historically followed a pattern here to often security operations identified a vulnerability open a ticket handed to an IT team running a third-party person to a cycle that average weeks from identifying threats to assume fixed.

在此情境下，威脅回應過去通常遵循一種模式：資安營運識別出弱點後開立工單，交由 IT 團隊透過第三方人員執行修補週期；從識別威脅到假定修復完成，平均需要數週。

With the advent of the Seaport 264, which requires agencies to operationalize based remediation and address AI accelerated threats that compressed expert time lines to ours, that cycle was no longer sustainable.

隨著 Seaport 264 的推出，該要求機構必須將以風險為基礎的修復落地運作，並因應 AI 加速的威脅使得攻擊時程從數週壓縮到數小時，這樣的週期已不再可持續。

Our own threat research units five year analysis of more than 1.5 billion critical vulnerability instances shows that Qualys customers have already remediated approximately $173 million exposure before they were entered in SSAs catalog, which is exactly the kind of proactive posture this directive now demands.

我們自有威脅研究團隊對超過 15 億筆重大弱點實例進行的五年分析顯示：Qualys 客戶在這些弱點被納入 SSA 目錄之前，就已先行修復約 1.73 億美元的曝險；這正是該指令如今所要求的主動式姿態。

In response, this customer evaluates several solutions and chose Qualys to operationalize its Rock automation, where computing solutions aggregated data and continue to generate theoretical risk insights, Qualys was the only platform in their valuation that could detect AI speed across hybrid environments, hyper prioritized millions of findings to the exposure that genuinely required immediate action and autonomously fix them.

因此，該客戶評估了多種解決方案，最終選擇 Qualys 來將其 Rock 自動化落地。其他方案雖能彙整資料並持續產出理論性的風險洞察，但在其評估中，Qualys 是唯一能在混合環境中以 AI 速度偵測、將數百萬筆發現事項超優先排序至真正需要立即處置的曝險，並能自主修復的平台。

That translated into bringing third-party sources into the platform with -- while consolidating several silo tools in a seven-figure annual bookings upsell, adding ETM and TruRisk aluminate while expanding the existing Qualys footprint.

這也促成將第三方來源納入平台，同時在一筆年度訂單金額達七位數美元的加購（upsell）中整併多個孤島式工具，新增 ETM 與 TruRisk Illuminate，並擴大既有的 Qualys 部署版圖。

This customer is now aligning with the agency's risk tolerance across nine separate bureaus unifying detection with agent in stock exploitability based prioritization with agent value and recognizing the operational efficiencies and speed of automation wave-based zero-day remediation with agents.

該客戶目前正於 9 個不同局處之間，依機構的風險承受度進行對齊：以代理程式（agent）統一偵測，並以已驗證可被利用性為基礎進行優先排序，同時認知到以代理程式進行自動化、以波次推進的零時差（zero-day）修復所帶來的營運效率與速度。

These wins, alongside several other six and seven figure federal and state wins in Q3 underscore the growing demand we see in our federal state and local government business, driven in part by agencies moving to meet these new operational requirements.

這些贏單，加上第三季在聯邦與州層級的多筆六位數與七位數美元案子，凸顯我們在聯邦、州與地方政府業務中所見的需求持續成長，其中一部分動能來自各機構為符合新的營運要求而採取行動。

They also reflect a consistent pattern we see across the business as more and more customers move from evaluating the AI native rock to operationalizing.

同時，這也反映出我們在整體業務中看到的一個一致趨勢：愈來愈多客戶從評估 AI 原生 Rock，轉向實際落地運作（operationalizing）。

Complementing this momentum, Q-Flex is emerging as an effective lever for platform adoption and ATM expansion. In the first full quarter following GA Q-Flex customers increasing their average annual bookings by over 20% compared to the prior year annual bookings, while many added new modules to their subscription.

配合這股動能，Q-Flex 正逐漸成為推動平台採用與 ATM 擴張的有效槓桿。在 Q-Flex 正式上市（GA）後的第一個完整季度，Q-Flex 客戶的平均年度訂單金額較前一年度提升超過 20%，且許多客戶在訂閱中新增了模組。

Both wins I had just described with direct examples of Cflex and action. The new federal agency customer consolidated into a Q-Flex commitment spanning also on modules from day one, while the existing agency added ETM at TruRisk aluminate while expanding deployments at a footprint that already included seven Qualys modules.

我剛才描述的兩個贏單，都是 Q-Flex 實際運作的直接例子。新的聯邦機構客戶從第一天起就以 Q-Flex 承諾整併並涵蓋多個模組；而既有機構則在其已包含 7 個 Qualys 模組的既有部署基礎上，新增 ETM 與 TruRisk Illuminate，並擴大部署。

In both cases, Q-Flex gave them the flexibility to commit more extensively across the platform while preserving the ability to shift investment as their risk priorities evolve. That's the commercial pattern flex was designed to create.

在兩個案例中，Q-Flex 都讓他們能更廣泛地在整個平台上做出承諾，同時保留隨著風險優先順序演變而調整投資配置的彈性。這正是 Flex 商業模式所設計要促成的使用型態。

Customers come in at a larger -- at a higher level because the model removes the friction of predicting exactly what modules they might need four months from now, which in turns drives higher utilization across the platform and positions us for larger upsells over them.

客戶會以更大規模、在更高層級進入，因為此模式消除了必須精準預測「四個月後究竟需要哪些模組」的摩擦；這反過來推動平台更高的使用率，並讓我們更有利於後續進行更大幅度的加購。

Turning to strategic alliances, I'm pleased to announce that we recently delivered several new technology integration spanning mobile and entity, IoT and OT systems as more organizations adopt the AI native rock as their autonomous risk fabric for pre-breach risk management, the value of that fabric grows with every new source of risk intelligence, it can ingest normalize, prioritize and act on.

談到策略聯盟，我很高興宣布，我們近期交付了多項新的技術整合，涵蓋行動與端點、IoT 與 OT 系統。隨著更多組織採用 AI 原生 Rock 作為其用於事前（pre-breach）風險管理的自主風險架構，每新增一個可被其擷取、正規化、優先排序並採取行動的風險情報來源，該風險架構的價值就會提升。

These partnerships strengthen our multi-vendor architecture, extend the rock coverage and serve as a key differentiator for Qualys. In summary, over three years ago, we set out to transform Qualys from a company seat in vulnerability management, detection and response to a holistic vendor-neutral pre-breach risk management platform defined by a measurable proactive and automated risk reduction at scale.

這些合作夥伴關係強化了我們的多供應商架構、擴展了 Rock 的覆蓋範圍，並成為 Qualys 的關鍵差異化因素。總結來說，三年多前，我們著手將 Qualys 從一家專注於弱點管理、偵測與回應的公司，轉型為一個整體性、供應商中立的事前風險管理平台，其特徵是在規模化下可衡量的主動式與自動化風險降低。

This quarter, with the AI native operational and gaining customer momentum, Trurisk eliminate with true confidence extending our reach to every type of asset, a growing federal customer business, strong product road map and early Flex adoption broadening now customers coming to the platform.

本季度，隨著 AI 原生 Rock 進入營運並獲得客戶動能，TruRisk Illuminate 與 TruConfidence 將我們的觸角延伸至各類資產；聯邦客戶業務持續成長；產品路線圖強勁；以及早期 Flex 採用擴大了導入平台的客戶範圍。

We are seeing the clearest evidence that organizations are choosing Qualys because we don't stop at just telling them what is wrong, we prove it's fixed. That's now driving larger commitments, deeper adoption and stronger competitive differentiation while reinforcing our confidence in durable long-term growth.

我們看到最明確的證據：組織選擇 Qualys，是因為我們不僅告訴他們哪裡有問題，我們還能證明它已被修好。這正推動更大的承諾、更深的採用，以及更強的競爭差異化，同時也強化我們對長期可持續成長的信心。

With that, I'll turn the call over to Joo Mi to further discuss our third quarter results and outlook for fourth quarter and full year 2026.

接下來，我把電話交給 Joo Mi，請她進一步說明我們第三季的業績，以及對 2026 年第四季與全年展望。

Thanks, Sumedh, and good afternoon. Before I start, I'd like to note that acceptable revenue, all financial figures are non-GAAP and growth rates are based on comparisons to the prior year period unless stated otherwise.

謝謝你，Sumedh，大家午安。在開始之前，我想先說明：除經常性收入（acceptable revenue）外，所有財務數字皆為非 GAAP，且除非另有說明，成長率皆以與去年同期比較為基礎。

Turning to third quarter results.

接著看第三季業績。

Revenues grew 11% to $188 million. As a result of our strategic emphasis on leveraging our partner ecosystem to drive growth, the channel continued to increase its contribution, making up 55% of total revenues compared to 50% a year ago.

營收成長 11% 至 1.88 億美元。由於我們策略性地強調運用合作夥伴生態系來推動成長，通路的貢獻持續提升，占總營收的 55%，高於一年前的 50%。

Revenues from channel partners grew 24%, offsetting a 2% decline in direct. BGO, 50% growth outside the US was ahead of our domestic business, which grew 7%.

通路合作夥伴帶來的營收成長 24%，抵銷了直銷營收 2% 的下滑。BGO（美國以外地區）成長 50%，領先我們的美國本土業務（成長 7%）。

US and international revenue mix was 54% and 46%, respectively. In Q3, our overall net dollar expansion rate remained unchanged from last quarter's 105%. And the net dollar expansion rate of customers with prior year purchase of ETM or CSM subscriptions improved to 108%, up from 107% last quarter.

美國與國際營收組合分別為54%與46%。在第三季，我們整體淨美元擴張率維持不變，仍為上季的105%。而前一年曾購買ETM或CSM訂閱的客戶，其淨美元擴張率提升至108%，高於上季的107%。

Moving on to product mix. TCM combined made up 12% of total bookings and 14% of new bookings on an LTM basis in Q3, up from last year's 10% and 11%, respectively.

接著談產品組合。以LTM口徑計算，第三季TCM合計占總訂單金額的12%，占新增訂單金額的14%，分別高於去年同期的10%與11%。

Next, Patch Management made up 9% of total bookings and 18% on new bookings on an LTM basis in Q3. This compares to 8% and 16%, respectively, in Q3 of last year. Lastly, total cloud made up 5% of total LTM bookings in Q3, unchanged from a year -- LTM and CCM, combined with touch management are driving a meaningful shift in our bookings composition towards higher-value solutions.

接下來，以LTM口徑計算，第三季修補程式管理（Patch Management）占總訂單金額的9%，占新增訂單金額的18%。這與去年第三季的8%與16%相比有所提升。最後，第三季雲端總計占總LTM訂單金額的5%，與一年前持平——LTM與CCM結合Touch Management，正推動我們的訂單組成朝向更高價值解決方案發生顯著轉移。

We expect that trajectory to continue as customers deepen their engagement with the platform. Total cloud remains an important group level for the business, and we are focused on improving adoption within our customer base.

隨著客戶加深對平台的使用，我們預期這一趨勢將持續。雲端總計仍是業務的重要群組層級，我們正專注於提升客戶群內的採用率。

Reflecting our scalable and sustainable business model. Adjusted EBITDA for the third quarter of 2026 was $89.9 million, representing a 48% margin compared to 49% last year.

這反映了我們具可擴展性且可持續的商業模式。2026年第三季調整後EBITDA為8,990萬美元，利潤率為48%，相較去年為49%。

Operating expenses in Q3 increased by 11% to $72.2 million, driven by investments in sales and marketing, which grew 17%. With this strong performance, EPS for the third quarter of 2026 was $2.12 per diluted share and free cash flow was $100 million, representing a 53.2% margin compared to 52.7% in the third quarter of last year.

第三季營業費用增加11%至7,220萬美元，主要由銷售與行銷投資帶動，該項費用成長17%。在此強勁表現下，2026年第三季每股盈餘（EPS）為每股稀釋後2.12美元，自由現金流為1億美元，自由現金流利潤率為53.2%，高於去年第三季的52.7%。

In Q3, we continued to invest the cash we generated from operations back into Qualys, including $1.8 million in capital expenditures and $53.6 million to repurchase $330,000 of our outstanding shares. As of the end of the quarter, we had $176.1 million remaining in our share repurchase program.

第三季，我們持續將營運所產生的現金再投資於Qualys，包括180萬美元的資本支出，以及5,360萬美元用於回購33萬股已發行在外股份。截至季末，我們的股票回購計畫尚餘1.761億美元額度。

With that, let's turn to guidance, starting with revenue. For the full year 2026, we now expect revenues to be in the range of $736.9 million to $738.9 million, which represents a growth rate of 10%. This compares to prior guidance of $732 million to $738 million.

接下來我們談財測，先從營收開始。對於2026年全年，我們目前預期營收將落在7.369億至7.389億美元區間，代表10%的成長率。相較之下，先前的財測為7.32億至7.38億美元。

For the fourth quarter of 2020, we expect revenues to be in the range of $191 million to $193 million, representing a growth rate of 9% to 10%. Shifting to profitability guidance.

對於2020年第四季，我們預期營收將落在1.91億至1.93億美元區間，代表9%至10%的成長率。接著轉向獲利能力財測。

For the full year 2026, we expect 46% EBITDA margin, the low double-digit increase in operating expenses and free cash flow margin in the low 40s. We expect full year EPS to be in the range of $8.07 to $8.14, up from the prior range of $7.74 to $7.88. For the fourth quarter of 2026, we expect EPS to be in the range of $2.05 to $2.12.

對於2026年全年，我們預期EBITDA利潤率為46%，營業費用為低雙位數增幅，自由現金流利潤率為40%出頭。我們預期全年EPS將落在8.07至8.14美元區間，高於先前的7.74至7.88美元區間。對於2026年第四季，我們預期EPS將落在2.05至2.12美元區間。

Our planned capital expenditures in 2026 are expected to be in the range of $9.5 million to $11.5 million. For the fourth quarter of 2026 in the range of $2.3 million to $4.3 million.

我們規劃的2026年資本支出預計落在950萬至1,150萬美元區間。2026年第四季則預計落在230萬至430萬美元區間。

With that, Sumedh, I would be happy to answer any of your questions.

以上，Sumedh，我很樂意回答你的任何問題。

(Operator Instructions) Jonathan Ho, William Blair.

（接線員指示）Jonathan Ho，William Blair。

Hi, good afternoon and congratulations on another set of strong results. Sumedh, wanted to start with sort of your comments around getting customers past some of their concerns around automated patch management and shifting that mindset away from the human in the loop towards full remediation. Can you talk a little bit about how that pathway works and ultimately, what that can mean from a revenue or net retention standpoint?

嗨，午安，恭喜你們再度交出一組強勁的成績。Sumedh，我想先從你提到的內容談起：協助客戶消除對自動化修補程式管理的疑慮，並將思維從「人為介入」轉向全面修復。你能否談談這條推進路徑如何運作？以及最終從營收或淨留存的角度，可能意味著什麼？

Yes, that's a great question. And I think nothing reflects better the mood in terms of what people are looking for, then the sub20 that essentially requires within 72-hour remediation of critical vulnerabilities.

是的，這是個很好的問題。我認為最能反映大家在尋找什麼的，就是sub20——它基本上要求在72小時內修復關鍵漏洞。

And so if you look at vulnerability management, the three core components really are how quickly if you can detect it, then you have to prioritize the ones that need to be fixed and then you have to actually get it fixed.

因此，如果你看漏洞管理，三個核心組成其實是：你能多快偵測到；接著你必須將需要修復的項目做優先排序；然後你必須真正把它修好。

And so if you're talking about three days to do that and your existing approach on scanning is taking anywhere from two to five days to just get the information for us. Then you are applying manual prioritization on top of that.

如果你談的是三天內要完成，而你現有的掃描方式光是取得資訊就要兩到五天。然後你還要在此之上再做人工的優先排序。

And then if the remediation is taking weeks to get that within IT tickets or it's always an emergency, people are struggling with that. And so what we are hearing in terms of conversation to our customers is really, at the end of the day to achieve that 72-hour or 24-hour remediation cycle that people are looking for.

接著如果修復還需要數週，透過IT工單流程才能完成，或總是處於緊急狀態，人們就會為此苦惱。因此，我們在與客戶的對話中聽到的重點是：歸根結底，要達成大家所追求的72小時或24小時修復週期。

Everybody has to sort of look at some sort of a road map that takes you into fast detection, which we're doing with Instascan less than 16 minutes.

每個人都必須某種程度上檢視一份路線圖，把你帶向快速偵測——我們透過Instascan做到少於16分鐘。

Quick prioritization with agent valve where we are able to reduce significantly the number of things that need to be fixed because we are testing existing controls and saying we don't need to fix it. And then the last piece, which is, as I mentioned in the earnings call, that the only reason people don't patch everything is because they don't have enough confidence that it will not cause an outage.

再來是透過Agent Valve進行快速優先排序：我們能大幅降低需要修復的項目數量，因為我們會測試既有控制措施，並指出哪些其實不需要修。最後一塊，如我在財報電話會議中提到的，人們之所以不修補所有項目，唯一原因是他們缺乏信心，擔心會造成停機。

So with the advent or with the release of our eliminate 2.0 with true confidence, what we have done is focused on remediation and collisions to be able to provide customers with AI-powered reliability scores, additional comfort in knowing that certain things when they are deployed, we can actually tell them as the patches going to be safe or not and monitoring with somebody like Dynatrace that if there are any issues.

因此，隨著我們推出Eliminate 2.0並搭配True Confidence，我們所做的是聚焦在修復與衝突（collisions），以便為客戶提供AI驅動的可靠性評分，讓他們更安心：當某些項目部署時，我們實際上可以告訴他們這個修補程式是否安全，並且可透過像Dynatrace這樣的工具進行監控，以便在有任何問題時即時掌握。

So the more we are providing in terms of having them see the value off that they can actually do this in an automated way with the confidence with something like true confidence and the intelligence built in. That's really the only meaningful direction can go now.

因此，我們越能讓他們看到：他們確實可以用自動化方式來做，而且能透過True Confidence與內建智慧建立信心。這基本上就是現在唯一有意義的方向。

People are looking to say, how do I go back to my board and give them that road map on how we are going to go from 0% automation and remediation when you are fighting AI-based autonomous exports, how do we put ourselves on a road map that over the next couple of years, we can actually get to the point where more and more automation can happen in a much quicker period of time.

人們想要的是：我該如何回到董事會，提供一份路線圖，說明當你在對抗AI驅動的自主攻擊時，我們要如何從0%的自動化與修復出發，在接下來幾年內，真正走到能在更短時間內實現越來越多自動化的狀態。

And so if you look at the way we have aligned EGM and eliminate that sort of how it is where ETM is helping you either pull data from the MDR or from other third-party scanning solutions and very quickly figure out which of those exposures are exploitable.

因此，如果你看我們如何把EGM與Eliminate對齊——大致上是這樣：ETM協助你從MDR或其他第三方掃描解決方案拉取資料，並非常快速地判斷哪些曝險是可被利用（exploitable）的。

And then additionally, if you want to look at getting it remediated as well then ATM or other TruRisk eliminate 2.0 with true confidence is the additional thing that they can purchase to get to that point.

此外，如果你也希望把它修復掉，那麼ATM或其他的TruRisk Eliminate 2.0（搭配True Confidence）就是他們可以額外購買的項目，以達到那個目標。

And so that's really how we're seeing customer conversations as they're looking to say, how do we -- how do I go back to provide confidence back to my organization that we can actually meet these requirements are coming up more and more where you have to remediate within three days or 24 hours given how much -- how many vulnerabilities and expect path you're seeing coming out of these AI models that are being used by attackers.

因此，這就是我們在客戶對話中看到的情況：他們想說的是，我要如何——我要如何回去讓組織重新建立信心，確保我們真的能符合這些越來越常見的要求：在三天或24小時內完成修復，因為你看到由攻擊者使用的這些AI模型所產生的漏洞與攻擊路徑（exploit path）數量實在太多。

That's very helpful. Just in terms of the pipeline, Joo Mi, can you maybe help us understand sort of the sustainability of Qualys' booking strength? I mean, I think the CCB number was a little bit down from last quarter, but still very healthy here in the mid-teens. How should we be thinking about sort of that -- the shape of the pipeline and maybe the sustainability of that over time? Thank you.

這非常有幫助。就管線而言，Joo Mi，你能否幫我們理解一下 Qualys 訂單強勁表現的可持續性？我的意思是，我認為 CCB 數字較上季略有下降，但仍然非常健康，維持在十幾%的中段。我們應該如何看待——管線的形狀，以及隨時間推移其可持續性？謝謝。

Yeah. If you take a look at our bookings trajectory, what we see in the business today is really a healthy 8% is approximately what we're expecting for Q4 calculated current billings. And that stems from the fact that if you take a look at our beat in Q3, it was a really strong quarter.

是的。如果你看一下我們的訂單走勢，我們今天在業務上看到的確實是健康的水準；我們對第四季的 calculated current billings（計算後當期帳單）預期約為 8%。這源於如果你回頭看我們第三季的超預期表現，那是一個非常強勁的季度。

Another double-digit current billings quarter at 14%, albeit like you mentioned, slightly down from 60% last quarter. Part of it was due to -- we had a really strong federal quarter. I think that the examples that we gave in the script kind of demonstrate our strength.

當期帳單再次達到兩位數成長，為 14%；不過如你提到的，較上季的 60% 略低。其中一部分原因是——我們有一個非常強勁的聯邦業務季度。我認為我們在講稿中給出的例子某種程度上展示了我們的實力。

We executed well, and this is something that we hope to continue with that said, it can be lumpy. We do have some of the pipeline for Q4. But right now from non-federal business perspective, we kind of expect the 8% as a base case for calculated current billings, ending the full year calculated current billings growth of 11%. Thank you.

我們執行得很好，而這也是我們希望能持續做到的；但話說回來，它可能會有波動。我們確實有一些第四季的管線。但就非聯邦業務的角度來看，我們目前仍以 8% 作為 calculated current billings 的基準情境，全年 calculated current billings 成長率則以 11% 收官。謝謝。

Roger Boyd, UBS.

Roger Boyd，瑞銀（UBS）。

Great. Thanks for the questions, and congrats on the results. I wanted to double click on Jonathan's question, Sumedh. We all hear from CSOs that operational confidence is the biggest barrier to automated patching. I guess how is that product suite resonating with non-security buyers within enterprises. And is that at all changing your selling motion around the product? Are you bringing those nonsecurity buyers into the sales process? And is that at all giving you access to additional budget? Thanks.

很好。謝謝回答問題，也恭喜你們的業績表現。Sumedh，我想更深入追問一下 Jonathan 的問題。我們都聽到資安長（CSO）說，營運信心是自動化修補（automated patching）最大的障礙。我想問這套產品組合在企業內部的非資安採購者之間反應如何？這是否在某種程度上改變了你們圍繞該產品的銷售方式？你們是否會把那些非資安買家納入銷售流程？這是否讓你們能接觸到額外的預算？謝謝。

Yes, very good question. I think what we are seeing right now is when we started with patch management a few years ago, sort of the first ones in the industry. We learned a lot from that, and there's always has been a bit of that pushback from those IT teams because they might be using in scanning solution, et cetera.

是的，這是個非常好的問題。我認為我們目前看到的是，幾年前我們開始做修補管理（patch management）時，算是業界最早的一批。我們從中學到很多，而來自 IT 團隊的那種反彈一直都存在，因為他們可能在使用某些掃描解決方案等等。

But we did pretty well over the years convincing those buyers, the value of Qualys and our ability from a cybersecurity patch management perspective. And what we're seeing now post the Frontier AI model era, we are seeing that IT teams and securities are actually coming together.

但這些年來，我們在說服那些買家方面做得相當不錯，讓他們理解 Qualys 的價值，以及我們在資安修補管理角度的能力。而我們現在看到的是，在 Frontier AI 模型時代之後，IT 團隊與資安團隊其實正在走到一起。

We have been on calls where we have more conversations with the CIO teams as well now because they are all looking for some way for solutions that are focused on cybersecurity, risk management and with now with true confidence, we do get into conversations with their IT teams to say, well, how are we giving higher confidence that we can separate patches that can be low impact, but high value, how do we help them understand which ones will not cause an outage.

我們也參與過一些通話，現在與 CIO 團隊的對話也更多了，因為他們都在尋找以資安、風險管理為核心的解決方案；而且在「真正的信心（true confidence）」之下，我們確實會與他們的 IT 團隊對話：我們如何提供更高的信心，去區分那些影響較低但價值很高的修補；我們如何幫助他們理解哪些修補不會造成停機。

How do we help you mitigate in sort of patching, so that level of intelligence and information is definitely giving higher confidence to the IT team.

我們如何幫助你在修補上降低風險；因此，這種層級的智慧與資訊，確實正在為 IT 團隊帶來更高的信心。

So what we do see is CIO, CSOs are in certain conversations coming to the table in some cases, right off the bat, they are going into autonomous remediation for 20%, 30% of the estate.

所以我們確實看到 CIO、CSO 在某些對話中會加入討論；在一些案例裡，一開始他們就直接針對 20%、30% 的資產範圍導入自主修復（autonomous remediation）。

In some cases, they're saying, let's start consuming your intelligence first so that our IT teams can still fix things faster by leveraging the intelligence you're providing.

在另一些案例裡，他們會說，先開始使用你們的智慧情報，讓我們的 IT 團隊先利用你們提供的情報更快修復問題。

And over time, we will move into a model where maybe we start by taking 15%, 20%, 30% of the stuff we can automate as we build the confidence. But like I said, the whole point of releasing that true confidence was -- it was very clear that the biggest blocker to patching is the lack of confidence they will not cause on our base.

隨著時間推移，我們會走向一種模式：也許先從 15%、20%、30% 這些我們能自動化的部分開始，並在建立信心的同時逐步擴大。但如我所說，推出「真正的信心」的核心目的——非常明確——修補最大的阻礙就是缺乏信心，擔心它們會在我們的環境中造成影響。

And if we can provide AI powered intelligence to make that decision much smarter and quicker than we are going to see more and more adoption of this going forward.

如果我們能提供 AI 驅動的智慧情報，讓這個決策更聰明、更快速，那麼未來我們會看到越來越多的採用。

And so conversations are very much driven by our ability to remediate and that's the starting point for many conversations is how can you help me remediate so I can go back to the board and give them a story about how we are going to do autonomous remediation against AI-based autonomous exploitation.

因此，對話很大程度上是由我們的修復能力所驅動；而許多對話的起點就是：你如何幫我修復，讓我能回到董事會，向他們說明我們將如何以自主修復來對抗基於 AI 的自主利用（autonomous exploitation）。

And then that leads into conversations around ETM, how ETM can further reduce what your remediating and by using ETM and eliminate together, you're reducing your operational risk while at the time increasing the speed at which you're able to actually get the things that are important fixed quickly.

接著就會延伸到關於 ETM 的對話：ETM 如何進一步降低你需要修復的範圍；透過同時使用 ETM 與 eliminate（消除）結合，你在降低營運風險的同時，也能提升把重要事項快速修好的速度。

So we're pretty excited about the conversations that we're having right now. And like I said, things like the suborder in trying to ask people to remediate things in three days is definitely a driving force to say what's an architecture that does not have siloed solutions that can really focus on getting that 1% fixed really quickly, so I can meet these guidelines.

所以我們對目前正在進行的對話感到相當振奮。而且如我所說，像是 suborder（子命令）要求大家在三天內完成修復，確實是一個驅動因素，促使大家思考：什麼樣的架構不會是各自為政的孤島式解決方案，而是能真正聚焦於把那 1% 的問題非常快速地修好，讓我能符合這些指引。

Got you. And then Joo Mi, the strength in federal wins. We've been hearing you talk about the opportunity there for a couple of quarters, made to see that manifest -- can you just talk about the relative strength relative to what you typically see in that vertical? And it sounded like that was an area of outperformance. Any commentary on how the rest of the commercial business kind of trended relative to your expectations? Thanks.

了解。另外，Joo Mi，聯邦業務贏單的強勁表現。我們聽你談那邊的機會已經好幾季了，很高興看到開始顯現——你能否談談相對於你們通常在該垂直領域看到的情況，這次的強度如何？聽起來那是一個超預期表現的領域。也請評論一下，其餘商業業務相對於你們預期的走勢如何？謝謝。

Yes. I think that primarily the beat was driven by the federal business. We haven't seen this type of outperformance when it comes to this vertical. We have been focused on making sure that we're building the pipe all throughout the year, and we are very pleased to see that the deals that we were working on actually ended up closing in Q3 and so that's really reflected in the current billings.

是的。我認為這次主要的超預期是由聯邦業務所帶動。在這個垂直領域，我們還沒見過這種程度的超預期表現。我們一直專注於確保全年都在建立管線，而我們也非常高興看到我們一直在推進的那些交易最終在第三季完成簽約，因此這也反映在當期帳單上。

So if you take a look at our net dollar expansion rate, in the course of 105%, that has been picked up. And I think it kind of indicates that rest of the growth really came from the new local acquisition, which was primarily federal.

所以如果你看我們的淨美元擴張率（net dollar expansion rate），在 105% 的區間，已經有所回升。我認為這也某種程度上顯示，其餘的成長主要來自新的本地收購（new local acquisition），而那部分主要是聯邦業務。

Got it.

了解。

Thank you.

謝謝。

Rudy Kessinger, DA Davidson.

Rudy Kessinger，DA Davidson。

Okay, that's great. Thanks for taking my questions and congratulations on the strong quarter, I think the question on a lot of investors' minds is really strong current calculated billings for the last two quarters, 16%, 14%. Your guidance going 8% for Q4.

好的，這很棒。謝謝讓我提問，也恭喜你們這一季表現強勁。我想很多投資人心中的問題是：過去兩季的當期 calculated billings（計算後當期帳單）非常強，分別是 16%、14%。但你們對第四季的指引是 8%。

I guess should we take the mid-teens growth for the last two quarters to be an indication that we might see an acceleration in revenue growth at some point near term? Or should we look more towards that trailing 12-month figure that has improved a little bit, but been relatively more stable I think that's just what everybody is asking here is should we expect acceleration in revenue growth near term out.

我想問，我們是否應該把過去兩季十幾%的成長視為一個訊號，表示短期內某個時間點營收成長可能會加速？還是我們應該更看重過去 12 個月的滾動數字——它確實改善了一點，但相對更穩定。我想大家真正想問的是：我們是否應該預期短期內營收成長會加速？

I think it's more of the latter. Based on what we were able to deliver that up to do with Postmedia a lot of the discussions that we were having with a small cohort of customers that we have in place.

我認為比較偏向後者。基於我們能夠交付的內容，這與 Postmedia 以及我們現有的一小群客戶所進行的許多討論有關。

And then in Q3, the primarily -- the beat was from the federal, albeit would love that to continue, we'll continue to work on that, but it could be lumpy.

然後在第三季，主要——超預期主要來自聯邦業務，雖然我們也希望這種趨勢能延續，我們會持續努力推進，但它可能會有波動。

And so from our perspective, the base case remains, of course, where don't see a significant change in the net dollar expansion at our key KPIs. So that 105% is healthy. It stayed the same from Q2.

因此從我們的角度來看，基本情境仍然是，當然，我們在關鍵 KPI 上看不到淨美元擴張出現顯著變化。所以 105% 是健康的。它與第二季持平。

Right now, we don't see that materially changing. We are hoping that we continue to outperform the new logo acquisition, but this is based on the pipeline that we see for Q4 and kind of seeing the course in terms of no material change in the sales cycle, the close rate. What we see right now is end of the year strong with current billings closing the year at 11% for the full year and then the revenue closing the year at 10%.

目前我們看不到它會出現實質性的變動。我們希望在新客（new logo）獲取方面能持續優於預期，但這是基於我們看到的第四季管線，以及我們對整體走勢的觀察——銷售週期、成交率沒有出現實質變化。我們目前看到的是年底表現強勁：以目前的帳單（billings）來看，全年收官為 11%；而營收全年收官為 10%。

Okay. Super helpful. And then secondly, just could you talk about the competitive environment, at and just who you're seeing there and how things have maybe changed versus a couple of quarters ago or maybe even a year ago? Are you seeing more of the larger platforms in there that post method really amped up how much they're talking about patching and vulnerability scanning, things of that nature.

好的。非常有幫助。第二個問題，你能談談競爭環境嗎？你們目前主要看到哪些競爭對手？相較於幾個季度前，甚至一年前，有沒有什麼變化？你們是否看到更多大型平台加入？他們在方法論上似乎大幅加強了對修補（patching）與弱點掃描等議題的宣傳。

We have been talking about vulnerability management evolving for a few years now before this whole thing came about, and that's why we started really focusing on patch management and remediation capabilities.

在這整件事發生之前，我們就已經談了好幾年弱點管理正在演進，這也是為什麼我們開始真正聚焦在修補管理與修復（remediation）能力上。

And today, we present a very compelling case for somebody who wants to actually do remediation in their production environment with the 0.5 billion batches deployed so far with extremely low rollback rates.

而今天，對於想要在其正式（production）環境中真正進行修復的人來說，我們提供了非常有說服力的案例：迄今已部署 5 億次修補批次（batches），且回滾率極低。

We have established ourselves. It's not just a vendor that is detecting tons and tons of new vulnerabilities, which as you saw with the Pat Tuesday, you're going to get more and more findings.

我們已經建立起自身定位。我們不只是那種偵測出大量新弱點的供應商——正如你在「Patch Tuesday」看到的，你會得到越來越多的發現結果。

So -- what we are seeing is the vulnerability management is evolving where it's about not just about finding and detecting because it's just unmanageable at this point, the number of CVs been detected.

因此——我們看到弱點管理正在演進：重點不再只是尋找與偵測，因為在目前這個階段已經難以管理，偵測到的 CV（應為 CVE）數量太多了。

It's really about being able to do validation of those exploits like a hacker and then actually running into remediation and doing remediation with high confidence at a much faster speed. And so that's where, for us, we even if a customer has some other detection capability for CVs with ATM.

真正的重點在於：能否像駭客一樣去驗證那些漏洞利用（exploit），然後以更高的信心、更快的速度推進到修復並完成修復。因此對我們而言，即使客戶已經有其他 CV 偵測能力，並搭配 ATM。

What we are seeing with those customers when they come and build a rock and they work with Qualys, they are pulling either using Qualys for fast detection or they're pulling data from maybe some other solutions they might have and leveraging the Qualys ATM license to then figure out if that thing is exploitable and then they eliminate license to then go and run remediation so that they can actually get rid of that particular exposure in the three minutes -- in the three days as sub order said.

我們在這些客戶身上看到的是：當他們來到並建立一個基礎、與 Qualys 合作時，他們要嘛使用 Qualys 來做快速偵測，要嘛從他們可能已有的其他解決方案拉取資料，並利用 Qualys 的 ATM 授權來判斷那個項目是否可被利用（exploitable），接著再利用授權去執行修復，讓他們能在三分鐘——在三天內，如 Sub order 所說——消除那個特定曝險。

So I think for us, we see that continuing more less conversations about how many CVs are you detecting more about, are you able to detect them faster than competing solutions, which are taking two to three days for scanning.

所以我認為對我們來說，我們看到這會持續：更少的對話是在談你能偵測多少 CV（應為 CVE），更多是在談你是否能比競品更快偵測到——因為有些競品掃描需要兩到三天。

And then the last piece is, well, ultimately, how can I build an automated workflow -- the issue is that if you have a separate scanning solution, a separate prioritization capability and a separate regulation capability that makes it a lot harder to really get to that three-day remediation or 24-hour remediation that people are looking for.

最後一塊是：最終我如何建立自動化工作流程——問題在於，如果你有一個獨立的掃描解決方案、一個獨立的優先排序能力，以及一個獨立的修復能力，這會讓你更難真正達到大家想要的三天修復或 24 小時修復。

So the conversations are less about can somebody detect more CVs really or conversations we're seeing are more about how do you help me build a story that I can take back to the Board that shows a road map for autonomous remediation as a response to autonomous exploration.

因此對話的重點較少是「誰能偵測更多 CV」，我們看到更多是在談：「你如何幫我建立一套敘事，我可以帶回董事會，展示一個邁向自主修復（autonomous remediation）的路線圖，以回應自主探索（autonomous exploration）。」

Brian Essex, JPMorgan.

Brian Essex，摩根大通（JPMorgan）。

Hi, good afternoon. Thank you for taking the question. I go my congrats on a second quarter of pretty healthy billings growth.

嗨，下午好。謝謝讓我提問。我也想恭喜你們連續第二季帳單（billings）成長相當健康。

I guess, Sumedh, a couple of things stand out more from a trend perspective that I wanted to ask you about one is the really nice growth in international business sustainably in the mid-teens, particularly when you compare it to domestic, which kind of had the tailwind of Fed, as you noted this quarter, and then also the partner contributions also seem to be ramping nicely. Is there a correlation between those two?

我想，Sumedh，從趨勢角度有幾點特別突出，我想請教：其一是國際業務在中十位數（mid-teens）的穩健成長非常亮眼，尤其是相較於本土市場——如你所說，本季受惠於聯邦業務的順風；另外，合作夥伴的貢獻看起來也在不錯地加速提升。這兩者之間是否有關聯？

And how do we think about each of those in terms of your ability to win new logos outside of the Fed business, which I know that you had a strong new logo traction with this quarter.

以及我們該如何看待這兩者，特別是就你們在聯邦業務之外贏得新客（new logos）的能力而言？我知道你們本季在新客方面的動能很強。

Yeah, that's a great question. And we have been doubling down on working with our partners over the last few years, and so we're pretty happy with the way that contribution from partners has increased over time while maintaining our margins as well.

是的，這是個很好的問題。過去幾年我們一直加倍投入與合作夥伴的合作，因此我們對合作夥伴貢獻隨時間提升、同時也能維持我們的利潤率，感到相當滿意。

So we do continue to see that as a way that we are going to see long-term impact. I think what we are also -- our non-US business always tends to be more partner-driven, of course.

所以我們確實持續把這視為能帶來長期影響的一種方式。我想我們也看到——當然，我們的非美國業務一向更偏向由合作夥伴驅動。

But in general, I think what we are seeing is that right now -- and typically, we don't see that knee-jerk reaction from our customers who are larger customers, enterprise customers, everybody is sort of going through a cycle right now of -- this is a fundamental shift in the way vulnerability management has been done in the past and to be able to do the exploit validation that's now specifically required and this is subareas an example or to do autonomous remediation structurally, they have to figure out within their organizations, how they can bring IT teams along what kind of changes they need to make in terms of the team, the structure, the processes, et cetera.

但整體而言，我認為我們目前看到的是——而且通常我們不會看到大型客戶、企業客戶出現那種即刻反應。大家現在都在經歷一個週期——這是弱點管理過去做法的一個根本性轉變；要能做到現在特別需要的漏洞利用驗證（exploit validation）（Subareas 是一個例子），或要在結構上做到自主修復，他們必須在組織內部釐清：如何讓 IT 團隊一起推進、在團隊、組織架構、流程等方面需要做哪些改變，等等。

So a lot of the conversations that people are engaged in right now with us are about how do we continue over the next few quarters and next few years on changing out how vulnerability management is done.

因此，現在人們與我們進行的許多對話，都是在談：未來幾個季度、未來幾年，我們要如何持續改變弱點管理的執行方式。

And our partners are a key part of that. So they are turning to the trusted partners to say, help me go back with a plan for autonomous remediation, and we are continuing to work with those partners.

而我們的合作夥伴是其中的關鍵部分。因此他們會轉向可信賴的合作夥伴說：幫我帶著一個自主修復的計畫回去；我們也持續與這些合作夥伴合作。

And so for us, we do see that the more and more we work with our partners, and you see the Mlog Partners program as well. Our partners will be working with these customers to help them plan out their autonomous remediation capabilities and Qualys obviously, is going to be a key part of that.

因此對我們而言，我們確實看到：我們與合作夥伴合作得越來越多——你也看到 Mlog Partners 計畫——我們的合作夥伴將與這些客戶合作，協助他們規劃自主修復能力，而 Qualys 顯然會是其中的關鍵一環。

So we do see this more as a continued long-term area of investment in we're excited about building out these capabilities with our partners.

所以我們把這視為一個持續的長期投資領域，我們也很期待與合作夥伴一起把這些能力建構起來。

Got it. And is there anything to infer about the profile of the international customers and what might make them a little bit more, I guess, right for better growth than domestically? Or how do we think about the -- what you're seeing in 1 geo versus United States?

了解。那麼，對於國際客戶的輪廓，有沒有什麼可以推論的？是什麼讓他們相較於本土市場更適合、或更有利於更好的成長？或者我們該如何看待——你們在某個地理區域（geo）相較於美國所看到的情況？

Nothing really to call out that's different from what we have seen in the past.

沒有什麼特別需要點出的，與我們過去看到的並無不同。

Got it. Got it. Thank you very much. I appreciate it.

了解。了解。非常感謝。感激不盡。

Joseph Gallo, Jefferies.

Joseph Gallo，Jefferies。

Hi. This is Grant Darling on for Joe Gallo. I wanted to start, the billings beat was really strong. Revenue would be a little bit narrower than usual, just to start anything to call out with large deals or linearity and maybe how we should think about that going forward?

嗨，我是代 Joe Gallo 提問的 Grant Darling。我想先從帳單（billings）超預期談起，這次非常強勁。營收看起來比平常略窄一些；想先問一下是否有什麼需要特別說明的，例如大型交易或線性（linearity），以及我們接下來該如何看待？

Currently seems to be not exactly a great proxy when you're looking at how to recognize revenue ratably. But to call out the Q3 revenue, the linearity was worse than what we typically see in the quarter. So that did impact that came in slightly lower at 10.7% versus growth rate.

目前看起來，當你在看如何按期（ratably）認列營收時，它似乎並不是一個非常好的代理指標。但就第三季營收而言，線性（linearity）比我們通常在季度中看到的更差。因此確實造成影響，最終成長率略低，為 10.7%，低於原本的成長率。

Got it. And then maybe just to unpack the expectations around that 8% billings in 4Q. Just as we're hearing about PHP pipeline opportunity patching, is there something from a renewal base size or anything in 4Q that's maybe making you more optimistic on the 2027 trajectory versus 4Q?

了解。接著也許想再拆解一下對第4季帳單（billings）成長8%的預期。就我們聽到PHP管線機會的補強（patching）而言，第4季是否有來自續約基礎規模或其他因素，讓你們對2027年的走勢相較於第4季更樂觀？

I mean I would say, like I said in the -- what I mentioned earlier, we do see customers engage when these kind of things happen, but even in the past, when lock forge and stuff came, we don't see that knee-jerk reaction immediately that's like immediate in the quarter.

我的意思是，我會說，就像我在——我先前提到的，我們確實看到當這類事情發生時，客戶會更投入，但即使在過去，像是lock forge之類的事件出現時，我們也沒有看到那種立刻在當季就出現的本能式反應。

Of course, those cohort of customers that are up for renewal that already are having conversations about EPM and eliminate in that quarter. those conversations can be more fruitful at times. But overall, when you look at the customer base and the opportunity that we have -- we see this as a continued conversation with these customers who are very engaged with us to figure out what's the right way for them to make the changes internally within their teams, their processes to be able to roll out and give their management the confidence in a new way of doing vulnerability management that is truly AI-driven and is able to do autonomous remediation with the confidence of not having operational outages. And so those conversations are going to continue. We're seeing good pipeline of conversations happening there.

當然，那些剛好在該季要續約、而且已經在討論EPM與eliminate的客戶族群，那些對話有時會更有成果。但整體而言，當你看我們的客戶基礎與我們擁有的機會——我們把這視為與這些高度投入的客戶持續對話，去釐清對他們而言正確的方式：如何在其團隊與流程內部做出改變，讓他們能夠推行並讓管理層對一種新的弱點管理方式建立信心；這種方式是真正由AI驅動，並且能在不造成營運中斷的信心下做到自主修復（autonomous remediation）。因此，這些對話會持續進行。我們看到那邊有不錯的對話管線。

And we're excited to see how and when these conversations will end up closing once these guys are able to go back and make the changes and put the proposals in front of their management. That's going to take some time. So I think right now, we're focusing on those conversations rather than some sort of a new jerk reaction immediately happening this quarter.

我們也很期待看看這些對話會如何、以及何時能夠成交，等這些客戶能回去完成變更，並把提案提交給他們的管理層。這需要一些時間。所以我認為目前我們更專注在這些對話上，而不是期待本季立刻出現某種新的本能式反應。

Mike Cikos, Needham.

Mike Cikos，Needham。

Hey, great. Thanks for taking the questions here, guys. I just wanted to come back to the Q Flex customers that we're adopting. The average annual bookings increase of over 20% versus prior year was an impressive stat. I know it's early here, but was that 20% plus similar to what you guys had seen in the prior quarter? Or is the prior quarter just too small to even start comparing and contrasting. I'd just love to get a sense of how that 20% plus track versus president as well as how we're looking here into Q4.

嗨，很好。謝謝各位回答問題。我想回到我們正在採用的Q Flex客戶。平均年度訂單（bookings）較去年增加超過20%這個數據很亮眼。我知道現在還早，但這個20%以上是否與你們上一季看到的情況相近？還是說上一季樣本太小，還不足以開始做比較與對照。我想了解這個20%以上相對於過去的走勢如何，以及我們對第4季的看法。

Yeah, it was really too small. So we just went on G with Flex last quarter. So what we wanted to do is just give you an indication and anecdotal example of us, even though it was a small court of customers that started with Q1 last year, give you a sense of what we're kind of expecting going forward.

對，樣本真的太小。我們是上一季才正式推出Flex。所以我們想做的是給你一個指標與軼事性的例子：即便那是一小群從去年第1季開始的客戶，也讓你感受一下我們對未來的預期。

This is in line with our expectation as in if you purchase Q flags, what will enable our customers to do is try out other products, which make them much easier when it comes to the annual renewal when they come, they'll be able to convince themselves or better justify the increase in spend with quality. -- then was a great kind of a testament or a validation of the whole point of flag, why it could be a win-win for both parties.

這符合我們的預期：也就是如果你購買Q flags，它能讓客戶去試用其他產品，這會讓他們在年度續約到來時更容易——他們能說服自己，或更好地合理化在Qualys上的支出增加。——這也很好地證明或驗證了flag的核心目的：為什麼它能對雙方都是雙贏。

Terrific. I'll keep it to one. Thank you so much.

太好了。我就問一題。非常感謝。

Meta Marshall, Morgan Stanley.

Meta Marshall，Morgan Stanley。

Great, thanks. As you've expanded the budget, the audience of budgets and interested buyers and that brings us more of a region to has. Has that changed kind of what partner channel do you think will be the most successful or the ones that you're making investments in?

很好，謝謝。隨著你們擴大預算、預算的受眾與有興趣的買家也擴大，這也讓我們更偏向某些區域。這是否改變了你們認為最成功的合作夥伴通路類型，或你們正在加大投資的通路？

I'm not sure I understood the question. So it was hard to hear you.

我不確定我是否理解這個問題。因為聽得不太清楚。

Sorry, As you will kind of focus on more giving more CIOs and kind of resiliency budgets involved. Is that changing kind of the overall -- what channel partner to be more successful, the one that you're making more time?

抱歉。當你們更聚焦於讓更多CIO、以及韌性（resiliency）預算參與進來時，這是否改變了整體上——哪一類通路夥伴會更成功、以及你們會投入更多時間的那一類？

Yes. That's a good question. I mean I think we're seeing more conversations that are with our managed service partners, our MRO partners because the CISOs are looking at less about like how can more efficiently buy this particular tool and more about guidance on how they can have a risk-based conversation with their boards and management.

是的，這是個好問題。我想我們看到更多對話是與我們的託管服務合作夥伴（managed service partners）、我們的MRO合作夥伴進行，因為CISO關注的已經比較不是「如何更有效率地買這個特定工具」，而更是需要指引：他們如何能與董事會與管理層進行以風險為基礎的對話。

And so when those kind of conversations come up, we tend to see our large partners or MRO partners that are authorized or partners are the ones that work with us closely because they're able to go in and have conversations more around businesses rather than just because the number of CVs in patches, they went up 15x, does it mean that your budget is going to go 15x,right?

因此當出現這類對話時，我們往往會看到大型合作夥伴或MRO合作夥伴——也就是獲授權的合作夥伴——會與我們更緊密合作，因為他們能進去進行更偏向商業面的對話，而不只是因為CVE與修補（patches）的數量增加了15倍，就代表你的預算也要增加15倍，對吧？

So how you going to work with that particular customer to be able to work with them and put a plan in place that allows them to find the right investment, optimize across the platform and have a risk-based congestion with the Board. So I don't know that it's really changing the partner conversation, but it does end up becoming more strategic when it's the conversations with the MSSP partners and the MRO partners.

所以你要如何與該客戶合作，協助他們制定一個計畫，讓他們找到正確的投資、在平台上做最佳化，並與董事會進行以風險為基礎的對話。所以我不確定這是否真的改變了合作夥伴的對話，但當與MSSP合作夥伴與MRO合作夥伴對話時，確實會變得更具策略性。

Great. Thanks. So helpful.

很好。謝謝。非常有幫助。

Joshua Tilton, Wolfe Research.

Joshua Tilton，Wolfe Research。

Hey, guys. Thanks for taking my questions. Can you hear me?

嗨，各位。謝謝回答我的問題。聽得到我嗎？

Yeah.

聽得到。

Awesome. I just have two kind of clarification questions. My first one is, I think a lot of us on the call are seeing two really solid quarters of current billings growth -- and there are a million different things, I would call it, and like in the cyber narrative that we can all want to and try to and hope to point that those quarters 1 billion they're coming from, whether it's Mythos or AI or whatever other auto narrative that you want to point to today.

太好了。我有兩個釐清性的問題。第一個是，我想電話會議上很多人都看到連續兩季非常穩健的當期帳單（current billings）成長——而且有一百萬種不同的因素，我會說，在資安敘事裡，我們都可能想要、嘗試、也希望去指稱這些成長是從哪裡來的，不管是Mythos、AI，或任何你今天想指的其他敘事。

But it sounds like on the call, you're trying to tell us that these two quarters kind of seem to be pretty unrelated. Last quarter, the outperformance was driven by just some outsized Mito spending in this quarter, it seems to be driven by a good fed vertical quarter.

但聽起來在這通電話裡，你們想告訴我們這兩季似乎彼此關聯不大。上一季的超預期表現是由某些超出預期的Mito支出所帶動，而這一季看起來是由聯邦（fed）垂直領域的一個好季度所帶動。

I'm trying to just understand like is that how we're supposed to interpret it -- and if that's the case, like I guess, how do you -- I guess, how do you view your 8% base case for Q4? Or versus the last two quarters, and you kind of also pointed that to us to that same base case and they've now outperformed, -- are there just less opportunities for outperformance in Q4 versus the last two quarters because -- we don't have the Fed quarter closing and that missetting is behind us. Does that make sense?

我想理解的是：我們是否應該這樣解讀——如果是的話，我想問，你們如何看待第4季8%的基準情境（base case）？相較於前兩季，你們也曾把我們引導到同樣的基準情境，而結果都超預期——第4季相較於前兩季是否較少有超預期的機會，因為——我們沒有聯邦季度的結案（closing），而且那個Mito的設定（missetting）也已經過去了。這樣說有道理嗎？

Yeah. So -- the reason why we called out the primary drivers of the outperformance or the bet that we hadn't necessarily expected would so that you understand how our business is performing.

有。

So I would say right now, the base case is -- not to say that these outperformance will not continue going forward. It could be due to different reasons, but like for example, Q4, what we see in the pipeline is 8% based on the historical cost rate historical sales cycles, but it could very well be the case, and we have another strong federal quarter. right, which could explain the bed.

所以我會說，目前的基準情境是——並不是說這些超預期表現未來不會持續。它可能會因不同原因而發生；但例如第4季，我們在管線中看到的是8%，這是基於歷史成交率與歷史銷售週期；但也很有可能——我們再度出現一個強勁的聯邦季度，對吧？這就可能解釋超預期表現。

So there is a scenario where the base case of 8%, there's room for outperformance. But -- with that said, we're not assuming that as a base case today.

因此，在以 8% 作為基本情境的情況下，確實存在超預期表現的空間。但——話雖如此，我們今天並沒有把這個當作基本情境來假設。

So what we talked about promises is at that point in time, we had a small cohort of customers that we were talking to already about upgrading to ETM and purchasing touch management, eliminate at that point in time, and then they ended up executing.

所以我們先前談到的承諾是，在當時那個時間點，我們已經在和一小群客戶討論升級到 ETM 並購買 Touch Management、以及導入 Eliminate，而他們最後也確實完成了執行。

And since then, of course, we have other customers that we have continued to have discussions around and those that our customers could easily close in Q4 as well, so the reason why we called it out is that you understand kind of what we expect did and then the potential upside is -- was greater in 2026. And I think it will be greater in Q4 based on the conversations that we have and the size of deals that we're seeing today.

而自那之後，當然，我們也持續與其他客戶進行相關討論，其中一些客戶在第四季也很容易就能完成簽約；所以我們之所以特別提出，是希望你能理解我們預期已經發生的部分，然後潛在的上行空間——在 2026 年會更大。而且根據我們目前的對話以及今天看到的交易規模，我認為第四季也會更大。

Okay. Super helpful. And then maybe just 1 other point of clarification is -- you did say that, that linearity was a little worse this quarter, which is what drove the lighter revenue beat.

好的。非常有幫助。那再補充一個釐清點——你確實提到本季的線性度（linearity）稍微更差，這也是營收超預期幅度較小的原因。

I think those mechanics totally make sense. Can you just help us understand like at least from your perspective, why was linearity worse? Like what -- do you have -- is there a reason as to why linearity came in below expectations?

我覺得這些運作機制完全說得通。你能否至少從你們的角度，幫我們理解一下為什麼線性度會更差？也就是——你們是否有原因可以解釋，為什麼線性度低於預期？

Yes, it really has to do with the closing of the deal. So for example, Q3 was a strong new local acquisition quarter. And like it ended at the near the end of the quarter, so it impacted the revenue recognition. So it really depends on the percentage of the deals coming from new as well as upsell versus the renewal and the timing of that close and how much we're able to recognize in the quarter that could have like a couple of hundred thousand impact on the revenue.

是的，這真的和交易結案時間點有關。例如，第三季是很強的新客戶（new logo）獲取季度。而且很多是在接近季末才結案，所以影響了營收認列。因此，這其實取決於交易中來自新客戶以及加購（upsell）相對於續約的占比、結案時間點，以及我們在當季能認列多少；這些因素可能對營收造成幾十萬美元等級的影響。

Okay. Super helpful. Thanks, guys.

了解。非常有幫助。謝謝各位。

Shrenik Kothari, Baird.

Shrenik Kothari，Baird。

Hey, guys. This is Zach Schneider on for [Shrenik]. So maybe to follow up to that last one, actually. Previously, you've talked about how the change you're seeing with customers -- we're starting with a larger deployment and not materially shorter sales cycles. Curious to hear it in Q3, if that remains the pattern or if you're now seeing evaluations convert faster or purchases happen outside normal renewal windows.

嗨，各位。我是代替 [Shrenik] 的 Zach Schneider。那我想其實是延續上一題追問。先前你們談到你們看到的客戶變化——是從更大規模的部署開始，但銷售週期並沒有實質縮短。想請教在第三季這個趨勢是否仍然成立？或者你們現在是否看到評估更快轉換、或是在非正常續約窗口之外發生採購？

Yeah, from a business that kind of closed sales cycle for thing, we don't really see a material change or an improvement. That's part of the reason why our base case in terms of what we're expecting for the growth rate remains the same.

是的，從業務端的成交銷售週期來看，我們並沒有看到實質性的變化或改善。這也是我們在成長率預期的基本情境仍維持不變的部分原因。

From a sales productivity perspective, win rate from all those traditional metrics perspective, it remains a course and then we don't see significant changes one way or the other.

從銷售生產力的角度、贏單率以及所有那些傳統指標的角度來看，整體維持在既有軌道上，我們也沒有看到明顯的正向或負向變化。

What we are seeing is some of the larger deals that we don't necessarily are able to predict exactly when the deals will close our cooling at different time period of time. So for example, in Q3, it was a really strong quarter.

我們確實看到的是一些較大型的交易，我們不一定能精準預測它們會在何時結案，這些交易會在不同時間點落袋。例如在第三季，這是一個非常強勁的季度。

We had anticipated all these deals in the federal space to close in Q3. Some of them could have been a slipped into Q4, especially because it's their new logo acquisitions, but they ended up closing in Q3, which was great for us.

我們原本預期聯邦領域的這些交易會在第三季結案。其中有些可能會延到第四季，特別是因為它們是新客戶獲取（new logo acquisitions），但最後它們在第三季就結案了，這對我們來說非常好。

Got it. That's great. And then maybe among customers that renewed the core subscription while continuing to evaluate ETM mature risk eliminate, are the incremental purchases or some of those at least now closing? And are they landing at the scope that you guys originally expected?

了解。很好。那再問一下：在那些續約核心訂閱、同時仍在評估 ETM、成熟風險（mature risk）以及 Eliminate 的客戶之中，增量採購是否已有部分開始結案？而且它們落地的範疇是否符合你們原先的預期？

I think the conversations continue to be strong. I think we're excited about what we are hearing from them around elimination and deploying that.

我認為對話仍然很強勁。我們對於他們在 Eliminate 以及部署方面給我們的回饋感到很振奮。

Like we talked a few times earlier, right? It just really depends on a little bit how internally their organizations are able to move to make it happen quicker or maybe taking a little bit more time because they have to sometimes bring along their deem, sometimes they are to bring along their IT team.

就像我們前面提過幾次的，對吧？這真的取決於他們內部組織推動落地的速度——有時能更快發生，有時會花更久，因為他們有時需要把他們的資安團隊一起帶上，有時也需要把 IT 團隊一起帶上。

So that -- when it comes to the eliminate capabilities, et cetera, that becomes a little bit of a thing where it might take a little bit longer at times, it might move a little bit quicker.

所以——當談到 Eliminate 的能力等等時，這就會變成一件事：有時可能會花久一點，有時也可能推進得更快。

So some of that, it really impacts on, yes, do they have the runway now to make it part of the renewal itself, where they want to add a little bit, but then they want to add more once they get the broader teams onboarded.

因此其中一部分確實會影響到：是的，他們現在是否有足夠的跑道把它納入續約本身——也就是先加一點，然後在更廣泛的團隊完成上線後再加更多。

That timing sometimes can be really figured out by their IT team. I mean the one of the federal examples we gave was a new logo for us, but they didn't have Qualys, and they deploy Qualys within less than six weeks. They already had tens of thousands of agents deployed with no issues and the CISO went into the platform and said, hey, what's this button do? and he said he could see a patch all button.

而這個時間點有時候其實是由他們的 IT 團隊來決定的。我的意思是，我們提到的其中一個聯邦案例對我們來說是新客戶，但他們之前沒有用 Qualys，而他們在不到六週內就部署了 Qualys。他們已經部署了數以萬計的代理程式（agents）且沒有任何問題，而 CISO 進到平台裡說：「嘿，這個按鈕是做什麼的？」然後他看到可以「一鍵全部修補（patch all）」的按鈕。

So he worked with his IT team they press the button, and they have 300,000 patches deployed within going from no Qualys at all to signal in six weeks, having deployed 300,000 patches with zero outages, right?

所以他和 IT 團隊合作按下那個按鈕，結果在六週內從完全沒有 Qualys 到上線運作，部署了 30 萬個修補（patches），而且零停機（zero outages），對吧？

So in their case, they were able to bring along the IT team and move fast. In some cases, it takes a little bit longer.

所以在他們的案例中，他們能把 IT 團隊一起帶上並快速推進。但在某些情況下，就會花比較久。

So it just depends a little bit on how they're internally able to make. It's not just adding the license of the same capability. So that's where we are also working with these customers where some of those deals might close a little bit sooner. Some of them might take a little bit longer as they go through work with their internal teams to get this to happen.

所以這多少取決於他們內部能如何推動。這不只是增加同一種能力的授權而已。因此我們也在和這些客戶一起合作：有些交易可能會更早結案，有些則可能需要更久，因為他們要和內部團隊一起完成相關工作，才能讓這件事發生。

It's great to hear. Thank you.

很高興聽到。謝謝。

Luke Morison, Canaccord.

Luke Morison，Canaccord。

Hey, guys. Thanks for taking the question here. We've had several high-profile AI discovered vulnerability events this year, most recently, obviously, PHP to Shell in October. Maybe just stepping back from any one of those incidents like what does an event like that due to your buying cycles in pipeline? And does it have a tendency to maybe pull decisions forward.

嗨，各位。謝謝讓我提問。今年我們看到幾起高知名度的 AI 發現漏洞事件，最近一次顯然是 10 月的 PHP to Shell。也許先跳脫單一事件來看，像這樣的事件會如何影響你們管線中的採購週期？它是否傾向於把決策時點往前拉？

Yes. So we've been consistent about this even all the way back to when solar wins and lot for happen is what we see with our customer base is not a typical new jerk reaction where they're just somehow suddenly buying in the same quarter just to show that they're doing something a lot of our conversation with customers tend to be -- when you take a step back, what is -- what are these celebrity was pots we like to follow them indicating.

是的。所以我們一直以來的說法都很一致，甚至可以追溯到 SolarWinds 以及 Log4（事件）發生的時候：我們在客戶群看到的並不是典型的「膝反射式」反應——也就是他們不會突然就在同一季立刻採購，只是為了表現出他們正在做些什麼。相反地，我們和客戶的許多對話往往是——當你退一步看，這些我們想追蹤的「名人級」漏洞（celebrity vulns）到底在傳達什麼訊號。

And by the way, on the same day PwC was a note vulnerability that was also pretty critical. But now when you have overlapping vulnerabilities like that, people don't even know how to track so many of these coming out.

而且順帶一提，就在同一天，PwC 也出現了一個同樣相當關鍵的漏洞。但當你遇到這種重疊的漏洞時，人們甚至不知道要如何追蹤這麼多不斷冒出的漏洞。

So like I said, the conversations with our customers are less sort of New York, what can I do immediately, but more about the fact that overall approach towards vulnerability management cannot continue the way it has been, where it takes a week to scan another week to import the data into a C10 solution, which then uses your dashboard.

所以就像我說的，我們和客戶的對話比較不是「天啊，我現在立刻能做什麼」，而是更著重在：整體的弱點管理方法不能再像過去那樣持續下去——例如掃描要花一週、再花一週把資料匯入某個 C10 解決方案，然後才用你的儀表板來看。

And then that dashboard has been reviewed by the IT team and the tickets are created and things are fixed in like three weeks or four weeks. -- that has to fundamentally change across processes across , across different teams.

然後那個儀表板會由 IT 團隊審查，建立工單，事情大概在三週或四週內修好。——這必須在流程、不同團隊之間，從根本上改變。

And so what we've seen is a pretty good increase in the number of conversations on how to do with -- when it comes to that. but that doesn't necessarily mean immediately that this quarter is something that we're going to see them but just a bunch of things.

所以我們看到，圍繞著該怎麼做——在這方面——的對話數量有相當不錯的增加。但這不一定代表我們會立刻在本季就看到成果，只是有一堆事情在發生。

I think it again goes back and depends on their ability a little bit to go and make that happen politically also within their own environment and those we are able to bring their IT teams to the table quicker we see them move faster and others are still working through to say that they will need to work on making sure they get the right alignment because this is not just the security and by one tool and it's going to be done, right?

我認為這又回到一點：這取決於他們在自身環境內部、也包括政治層面，推動落地的能力；那些能更快把 IT 團隊拉到桌面上來的，我們看到他們推進得更快；其他人仍在努力，並表示他們需要確保取得正確的對齊，因為這不只是安全部門買一個工具就能搞定，對吧？

There's going to be a change in process. how do we go from one week detection to 60-minute detection, how do we go from a theoretical validation to actually running the exploits ourselves and not having those expiries go crazy on us and then how do we actually do some form of autonomous remediation.

流程一定會改變。我們如何從一週偵測縮短到 60 分鐘偵測？如何從理論上的驗證，變成我們自己實際去跑 exploit，而不是讓那些到期（expiry）問題把我們搞得一團亂？以及我們如何真正做到某種形式的自主修復（autonomous remediation）。

So A lot of these are less about just buying more of the tool and more about fundamental change. But the encouraging thing for us is those conversations about changes in how they're going to do vulnerability management, exposure management moving forward are happening. And so that excites us that over the next few quarters and years, we are excited to see how that's going to build up into our business.

所以其中很多並不是單純再多買一些工具，而是更偏向根本性的改變。但對我們來說令人鼓舞的是，關於他們未來要如何做弱點管理、曝險管理的這些變革對話正在發生。因此這讓我們很興奮，期待在接下來幾個季度與幾年，看看這會如何逐步累積並帶動我們的業務。

Yeah, makes sense. And maybe just for my follow-up. If I look back over the last call it, decade plus. I would think most incremental security budget has gone to detection and response with response, obviously, being after an incident occurs. If I think about this new paradigm, as AI shortens the time from disclosure to exploit, do you see budgets actually moving from that reactive side of the market to the proactive side where you guys are living?

是的，合理。那也許就我的追問。如果我回顧過去十多年。我會認為大多數新增的資安預算都投入在偵測與回應上，而回應顯然是在事件發生之後。如果我想像這個新典範，當 AI 縮短了從揭露到被利用（exploit）的時間，你是否看到預算真的從市場中較被動的那一端，轉向你們所在的較主動的一端？

There's no doubt that we are seeing those conversations in terms of how do we take a newer approach to pre-breach risk management because the number of things coming at us are so significant and the speed at which they are being exploited are so high that everybody needs to look at a new paradigm and you cannot wait for a breach to happen to then take a response after that.

毫無疑問，我們確實看到這類對話：也就是我們如何用更新的方法來做「事前（pre-breach）風險管理」，因為迎面而來的事情數量非常龐大，而且被利用的速度非常快，所以每個人都需要用新的典範來看待，你不能等到真的發生入侵後才去做事後回應。

I think I always talk about this is like when you're buying a car, you kind of have your airbags that if you hit something that Air back's going to protect you, but don't mean you're not going to buy a car with brakes. And that's the same thing that if you have a good break, I mean, you're not going to get airbags.

我常用一個比喻：買車的時候，你會有安全氣囊，撞到東西時安全氣囊會保護你，但這不代表你就不會買有煞車的車。同樣地，如果你有好的煞車，我是說，你也不會因此就不要安全氣囊。

So I think the way we look at it is ability to take proactive actions to prevent any issues from happening is becoming more and more part of the conversation now. But like I said, it does take them a bit of effort to change organizationally and tool-wise internally.

所以我認為我們的看法是：採取主動行動來防止問題發生的能力，現在正越來越成為對話的一部分。但如我所說，這確實需要他們在組織面與內部工具面做一些改變的努力。

So I have no doubt that over a period of time, we're going to see the shift where more and more proactive risk management is a focus. It is just now a question of when that timing is and how we're going to get there. But we are seeing definitely a more focused approach on pre-breach risk management to complement. And that's why we have the concept of a rock, which complements the SOC. So the stock is after the fact the rock is more proactive risk management.

所以我毫不懷疑，隨著時間推移，我們會看到轉變，讓越來越多的主動式風險管理成為焦點。現在只是時間點何時、以及我們如何走到那裡的問題。但我們確實看到更聚焦於事前（pre-breach）風險管理的方法，作為互補。這也是為什麼我們提出 ROC 的概念，用來補足 SOC。也就是說，SOC 是事後，ROC 則是更主動的風險管理。

Helpful, thank you.

很有幫助，謝謝。

Thank you.

謝謝。

Rob Owens, Piper.

Rob Owens，Piper。

Great. Thank you guys for squeezing me in. I was hoping to touch a little bit on large transactions. It looked like one of your better quarters in terms of over $500,000 deals to date. Just -- what's driving that execution at this point? And are you actually seeing lands that large? Or is that mainly within the installed base?

太好了。謝謝你們把我塞進來。我希望稍微談一下大型交易。看起來就迄今而言，你們在 50 萬美元以上交易的表現是較好的一季之一。想請教——目前是什麼在驅動這樣的執行力？你們真的看到那麼大的 land（首次導入）嗎？還是主要發生在既有客戶基礎（installed base）內？

Like I said, I think the desire to kind of have the end-to-end workflows, which is more complex in larger customers. And so the quality and the way our platform is always tend to solve the more complex problems or they're more complex customers.

如我所說，我認為想要具備端到端工作流程的需求——在大型客戶那裡更複雜——是關鍵。因此，我們平台的品質與方式一向更能解決更複雜的問題，或者說更複雜的客戶需求。

And so the adoption of those capabilities is sort of what is driving that increase in that $500,000 plus. And so again, it depends quarter-to-quarter, but I think we're happy with that direction.

所以，這些能力的採用，某種程度上就是推動 50 萬美元以上金額增加的原因。同樣地，這會隨季度而變動，但我想我們對這個方向感到滿意。

And we're we're looking forward to continuing that momentum by working with those customers and finding a way when new customers also come, right, they're not looking just to replace a scanning solution with novoscanning solutions. So they are looking to add a remediation, they're looking to add ATM.

而且我們也期待透過與這些客戶合作來延續這股動能；同時當新客戶進來時也是如此，對吧，他們不只是想用新的掃描方案取代既有掃描方案。所以他們會想加上修復（remediation），也會想加上 ATM。

And so you see that in the numbers as well where new bookings, LTM bookings percentage of some of these capabilities is also higher.

因此你也會在數字上看到：新訂單（new bookings）、過去十二個月（LTM）訂單中，某些這類能力的占比也更高。

So we do -- we are seeing that on both sides in terms of the interest in evolving their overall risk management program. and not just adding another scanner or replacing a scanner with another scanner.

所以我們確實——在兩邊都看到了：他們對於演進整體風險管理計畫的興趣，而不只是再加一個掃描器，或用另一個掃描器替換掃描器。

And Joo mi, with retention rates remaining at 105, have we flattened out here? Or could you still see some volatility moving forward in terms of that number potentially going down a bit?

另外，Joo mi，在留存率維持在 105 的情況下，我們是否已經在這裡趨於平坦？或者你仍可能看到未來有些波動，例如這個數字可能再往下掉一點？

We're not expecting that right now based on the momentum of the business, I think that it's more likely that it moves up rather than down or like most likely scenario, of course, is right now kind of recording 105% last quarter, [1%] of 5% this quarter. With that said, ATM CSM customer cohort did go up from 107 8%. So -- based on that, I would say that for now, we're not expecting a tick down in Q4.

以目前業務動能來看，我們現在不預期會那樣；我認為更可能是往上而不是往下；當然最可能的情境是：上季記錄在 105%，這季是 [1%] 的 5%。話雖如此，ATM CSM 客戶同群（customer cohort）確實從 107.8% 上升。所以——基於此，我會說就目前而言，我們不預期 Q4 會出現下滑（tick down）。

All right. Thank you very much.

好的。非常感謝。

Thank you. This does conclude today's conference call. Thank you for participating, and you may now disconnect.

謝謝。今天的電話會議到此結束。感謝各位參與，現在可以斷線。