Qualys, Inc. (QLYS) Earnings Call Transcript & Summary

All right. Thanks to everyone for joining me. My name is Sterling Auty, a software technology analyst here at JPMorgan. I'm very happy to have with us the management team from Qualys for our next session. Just before we get started, just a reminder to participants, if you'd like to ask a question, just hit the Q&A button and enter your questions there, and I'll incorporate it through the session.

So with that, Melissa Fisher, CFO, Melissa, can you give us a sense in terms of what's top of mind for everyone is, what's happening here with COVID-19? What was the Qualys experience in terms of the business and pace of business in March and so far here in the June quarter?

Yes. Absolutely. Thank you for having us, Sterling. So first, look, we feel very fortunate relative to other companies given the critical nature of what we sell as well as the cloud delivery model, which makes it very easy for our solutions to be deployed and, frankly, it's more cost-effective as well as the integrated nature of our solutions. But like many companies, at the -- towards the end of the quarter, we did see some impact to new and upsell bookings where people had expected to have budget, and budget was frozen. But overall, we feel that it wasn't a significant impact. We feel like the business is healthy. We did lower our guide to accommodate for the fact that our revenues may be impacted by this impact to new and upsell bookings given the uncertainties in the environment, and we thought it was prudent to be cautious.

No, I think investors appreciate that. Would you say that some of the deals that saw delays are starting to open up as we're getting some talk of the economy opening up? Or do you think that this is going to hang on for some time?

Well, I wish I had a crystal ball to be able to predict when the economy is going to open up. I'd say a couple of things. As I said, we feel like the business is healthy. We've seen consistent renewal rates across the business, across all geographies. And so there's some budget that's opened up, there may be others that ends up being paused. And so it sort of remains to be seen. And that's why -- not to jump into guidance but just to give the framework, when we gave updated guidance, the range is really based on what do we think the potential amount of impact to new and upsell bookings would be as well as the degree to which the business continues to be impacted in Q4 by COVID, which is an unknown. And then at the lower end of the range, while we haven't seen this today, we did factor in some potential impact to retention rates. Again, on the other hand, we have VMDR that came out, which we believe overall should be a bridge to renewal rates because our renewal rates with customers that have multiple solutions, it's obviously stickier and it's higher renewal rates, and VMDR itself is multiple solutions integrated into one.

Now are there any parts of the business that are actually seeing tailwinds because of COVID-19? With the increased work from home, we're hearing from companies that are worried about increased number of attacks and maybe increased vulnerabilities that they've, by accident, opened up by expanding up this architecture.

Yes. That's a great point. There are definitely companies that have looked to expand as they realize, in this much more distributed world, that they are not fully secure, and they need to be able to continuously monitor and expand their coverage. And so that has -- just to offset some of the potential impact, that's a benefit to us. And we were able to help the community by launching our free Endpoint Protection Service, which we immediately went into operations with, frankly, for the Qualys workforce, which all of a sudden became distributed at home, and we offered it to the community to be able to help them as well. As you know, when you're in security, you really have to be community minded because you're all sort of working together to fight the bad guys. And that's been great because it's brought -- we had almost 500 companies sign up, half of which were new customers, so it ends up being a potential lead gen for us.

And overall, the priority appeared to jump to remote access, VPN, at least initially, to enable employees to work from home. But now that, that kind of initial flurry is done, where do you think kind of spending on your solutions falls within the overall priority list?

Yes. Well, I think -- I've always said that versus a few years ago, when there was a period when people thought firewalls are going to save the world, people realized that wasn't really true, right? Companies were still getting breached. And so there's been an increasing recognition of the importance of vulnerability management, and that only got amplified with the WannaCry and NotPetya attacks, which were very broad-based. Not -- it wasn't just about stealing customer information, really crippled operations. So the good thing is, for our business, why we feel like it's still resilient is people do realize vulnerability management is a key part of security. And as well as the reality is we're not that big of a share of security budgets. I mean we think about the millions of dollars that people are spending on firewalls, for example, we're just not that big of a portion of the wallet. So it's not something that people would -- we believe would look to cut.

No, I see that. I think that does make sense. In terms of -- you mentioned kind of the renewal rates holding up and cross-sell and upsell. Do you think about your net dollar retention? What is it typically? And what do you hope to see it, I guess, achieve as you move through this transition -- or not transition, but the macro down?

Yes. So our net dollar retention rate, we publish that annually. We published it in Q3. It was 108 for the enterprise, 105 overall. It will be -- remain to be seen how it's impacted in this uncertain environment. We believe, over time, we would expect it to increase as we see adoption of a lot of our newer solutions, which have deal sizes that are similar to VM as well as as people expand their deployments more broadly across the end points. But again, COVID in the midst of that, there may be kind of a temporary pause on that expansion.

And then I know that you weren't with the company during the 2008 to 2010 time frame, but have you had any conversations with Philippe or others that were there and got a sense of kind of what some of the things that happened and maybe some of the learnings that they could take away to apply to this environment?

Yes. So we did talk about that. I think it's -- in our situation, it's a little bit -- it's hard to make that as a more relevant comparison in the sense that when you think about that time period, cloud security wasn't really considered mainstream at that time. So you've probably heard this story from Philippe where he talked about how he, when Salesforce was taking off, approached Marc Benioff and said, "God, why are you guys doing so well?" and "Cloud securities, we're like fighting it out here." And Marc says, "Look, IT and security people don't really want the cloud. But sales and marketing people can just go around them. They have their own budgets." And so it did take long -- a lot longer for cloud security to be considered mainstream. So I think it's a little bit less relevant in the comparison. Although it's a fair question. Again, I think where we are today is we feel very well positioned because it is mainstream. People realize it's much more cost effective. You don't need people on-site to manage the solution. Everything -- our solutions are centrally managed and self-updating, easy to deploy. And I think maybe we would say the biggest takeaway would be is for a company in our unique position of such high profitability, this is the time to continue investing. Where our competitors maybe can't invest as much, we're going to keep moving ahead so that we emerge stronger than ever from this.

Let's switch gears and talk a little bit about VMDR. What does VMDR really bring to Qualys that you didn't have with your core Vulnerability Management platform already?

Yes. So VMDR, for the audience who are new, it stands for Vulnerability Management, Detection and Response. And it really integrates into one workflow a number of pieces that we developed over the years that were separate. So starting from the ability to inventory your global assets, make sure -- we always say the underpinning of security is visibility. You have to know -- you can't secure what you don't know. Then expands into, okay, I have my asset inventory, I have the visibility on that, what are my vulnerabilities? What are the highest priority ones? And then leaning towards the most important thing, which is how do I remediate. And so it provides patch detection and then the ability to upgrade to a full patch management solution for additional dollars to automate the patch deployment. So having that one integrated workflow, we found, is really powerful. And it only recently went GA. But even in Q1 before it was GA, we had 150 customers nearly sign up for it, which included 7 of our top 10 renewals in the quarter. So we feel like it's very attractive. And again, going back to, I think, the point I raised earlier, we're very proud that we have strong renewal rates. We think this only gives us the opportunity to increase our renewal rates because it's multiple -- it's very sticky by nature of having multiple solutions integrated into one. And then it also for us -- sorry, just to add on -- drives proliferation of the agent. So our strategy has been about how do we get the agent ubiquitous because it's underpinning a lot of our additional paid solutions. And this is a unique opportunity to do that.

No, it makes sense. And how are you actually pricing it for? And what kind of uplift would VMDR give you relative to just a core traditional VM customer?

Yes. So we've said we expected to be revenue neutral because for someone who is just a VM-only customer, there will be some uplift. And it's -- at this point, it's still kind of dependent on the script of the environment, and we're doing a lot of custom still pricing as we're moving into full GA on it. But then there are some customers that, if they had purchased everything separately, will spend a little bit less. So that's why we said, overall, we expect this to be broadly revenue neutral, but it lays the foundation to drive accelerated revenue growth by making it very easy to expand onto end points as well as take on additional paid solutions like File Integrity Monitoring, Indication of Compromise, paid Asset Discovery and Inventory.

Now were some of those pathways into those additional products available if the customer had already adopted the cloud agent?

That's right. That's right. It comes with the agent. But VMDR itself packages VM with cloud agents with some of our other solutions like continuous monitoring and SCA, and it's really impacts detection, right, which we haven't packaged with VM before. So it's a unique offering in terms of an integrated workflow, tracing the whole life cycle of managing vulnerabilities and then, as part of that, sort of gets the agent out there in sort of a Trojan horse mentality a little bit.

And how do you kind of capitalize on -- over the last probably 2 years, you made a bigger push on some of the freemium type of offerings. I thought global inventory was something that, depending on the type of customer, could be utilized for free as well. So maybe kind of bridge the gap, what do you -- what's the type of customer you're bringing in under freemium? And what are you trying to convert? Or as well, if I'm a core Qualys VM customer, can I just add on the global inventory for free? And is there a risk that maybe I don't need to go all the way to VMDR?

Yes. Well, so let me address kind of Asset Discovery and Inventory first. So we did come out with the ability to do the inventory for free. The paid version allows you to synchronize with your CMDB as well as some additional features like managing your end-of-life cycle assets. So we're a big believer in when you give a free service, it's got to be a real service, not something that's sort of half-baked to get you to pay. So there may be some customers that are happy with the free version, but we also believe that there's enough interest. And we talked about this quarter, we had a large customer take on the paid module because they saw additional value in being able to have the ability to manage end-of-life cycle assets as well as the synchronization with our CMDB. So we are expecting that. But so you can do the free, though, with or without VMDR. I think the reason people would take VMDR is because of the integrated workflows of managing vulnerabilities from beginning to end.

Yes, that makes a ton of sense. Let's move over and talk a little bit about Endpoint. What's the motivating factor to move in and, at least on the surface, take on another set of competitors?

Yes. So well, first of all, it's very natural for us because our Indication of Compromise solution was, call it, 75% there. It's already telling you -- again, taking a step back, we're moving from prevention all the way to detection, to remediation. That's really the philosophy of what we're trying to do. So Indication of Compromise says you're okay. Well, okay, somebody -- I may be vulnerable, so my windows are unlocked. Well, your next question is, okay, well, has someone gotten in, right? So that's the detection portion of it. The next thing you want is the remediation. So it's kind of a natural evolution, and so it's something we can easily build. We think we're very well positioned against competitors in that offering because, twofold, one is, again, this is a solution that's being built on the cloud agent. So it's one cloud agent that can do multiple solutions, not just VM and EDR, also Policy Compliance, File Integrity Monitoring, the Asset Discovery and Inventory, and not only do those on the end points but can also do that on-prem in your cloud environments, so you're getting a much more holistic type of view. And so that's why we feel like we'll be well positioned in that market.

Now do you think that this is meant to go squarely head-to-head versus CrowdStrike? Or are you looking to kind of carve out and chip away against other legacy vendors?

We think that's going to be both. I mean we do think that we're very competitive against CrowdStrike. We have some customers that are down to only 2 agents, ourselves and CrowdStrike, and are looking to consolidate more. Again, today, since we don't offer EDR, it's natural that someone wants that solution, they would have someone like CrowdStrike. But obviously, as we add it, we think there'll be customers, as I mentioned, who will look to really consolidate their SOCs even further.

So when you think about an RFP and a bake-off once your GA, which -- remind us, I think GA is for later this summer, if I'm not mistaken. Once you're in a bake-off for a new customer vis-à-vis CrowdStrike, they obviously talk about their 13-or-so modules and same thing, vendor consolidation. What do you think the core value proposition or competitive advantage that you'll have to win in that marketplace will look like?

Yes. So we're going to unveil EDR at Black Hat in August, but it will be GA more towards the end of the year. And I think that, as I mentioned, we believe we'll be very competitive because the number of modules that we offer, we think, is much more broad and fulsome than what CrowdStrike is offering, as I mentioned, things like File Integrity Monitoring, Asset Discovery and Inventory. We have Certificate Management coming up. So we think we have a broader set of solutions you can do on our one agent. We have a very robust back end, which has really been a testament to why we've been able to win in VM against competitors because of the scalability that it brings. And again, it's not based on a third-party data center. It's really -- or in a third-party public cloud, it's our own data centers that we manage. But then also, again, we provide the visibility, not just on the end points but also we can give you the visibility across the hybrid environment. So your on-premise environment as well as our cloud environments and mobile soon as well.

Let's shift and talk a little bit about growth and profitability. I mean Qualys, when you look back over the last 4 quarters, in some of these quarters, you were the most profitable SaaS company in all of software. What's the conversation or the strategy in terms of driving that level of profitability versus the growth where the growth vis-à-vis traditional kind of vulnerability management, vendors like a Tenable or Rapid7, hasn't been as fast. So what's the strategy in terms of the balance there?

Yes. Well, so we've always believed that we can drive growth by being profitable as well, and it goes back to the natural scalability of our model. And I'll touch on that in a minute. But just to remind the audience, we're nearly 100% subscription, not all the competitors are, so the comparison in terms of perpetual versus subscription and the growth rates may be a little bit different than exactly what you're seeing on the recognized revenue line. But going back to our model, we're naturally highly profitable because when we think about it at our operations line, right, we have -- we've been very good at rationalizing hardware, using -- leveraging open source technologies and reinvest in making them scalable. We have a significant portion of our workforce in India as well there. We've been very successful at attracting talent. That's also benefited the R&D line. So we talked about our R&D as a percent of revenue last year was 17% of revenues. If all those people had been in the U.S., the average effective salary of a U.S. engineer at the time would have been 42%. So we're able to really get a lot for -- a lot of bang for our buck that may not be visible just looking at dollar-based [ E to Rs ]. And the reason why we're so successful in Pune is because, unlike many companies that have gone to India to do back-office data entry type work, they're doing new product development. And it's not a secondary office. It really is meaningful. It's an office that we have in Foster City. In fact, we're actually building out our new headquarters in Pune -- or our first headquarters, I should say, as we've outgrown our space. Then the other part of the model that drive profitability is the fact that we've really been pure to the cloud, leveraging the cloud platform as a distribution channel. So we don't have to send people on-site to do implementations or demos. Our customers or prospects can really try and buy from the platform itself. We develop free services as a source of lead gen. And then also, we get a lot of growth from our existing customers, and you don't need to double the number of salespeople on an account to double the account. And because of all the additional solutions we have, often one person can continue to do that. So there are a number of reasons why we're so profitable, and we're proud of it, and that's why we feel very -- again, we're sad in that we're in a pandemic environment, but we feel fortunate that this is an opportunity for us to be able to increase the lead we have over others in terms of investing for the future.

Exactly. So it looks like within your new outlook, that the margin side took probably a bigger hit than even with the revenue growth outlook. Where is the balance of those investments in terms of what you're going to put into R&D versus what's going into sales and marketing?

Yes. So it's really a mix across both. I mean we -- actually, we're investing at the -- at similar levels that we intended to at the beginning of the year. So we haven't actually changed the amount of investment. Look, the margin contraction is really being driven mostly by lower revenues. And then for non-GAAP EPS, specifically, we talked about the fact that given our cash balance, the declining interest rates is about $0.06 of that delta.

Yes. That hits everyone. But when you think about there's the balance in terms of -- especially on the sales and marketing side, spending more to try to prop growth up versus pushing on a string, tying it all back to some of your earlier comments, you were saying that still seeing some healthy pipeline generation. Are you getting the return on those marketing dollars that you expect?

Yes. No, we feel very good. I mean we're doing targeted marketing campaigns. We actually hired a new VP of Digital Marketing who's going to start next week based in India because there were -- a lot of our systems automations for marketing is being driven from. We have -- we feel very good about the lead gens that have come with the free Remote Endpoint Protection, and we're going to be extending that as we add malware detection capabilities. And then, again, there's pockets of investment in sales and marketing across the function that -- we feel good about the returns that we're getting because, again, we're laying the foundation for all these new solutions that are coming out, especially things like EDR and SIM which, again, are bigger price points than maybe some of the other solutions we've come out and bigger markets.

Good. So you've had some longer-term targets that are out there. What happens to those in light of what COVID-19 is bringing? Does it kind of push it to the right?

Yes. Well, given -- I mean what we said, given COVID-19, it's a bit premature to talk about 2021. Right now, we're focused on 2020 and laying and doing all the right things to invest for the future, laying the foundation to accelerate revenue growth.

Yes. I think that's fair from everybody's perspective. So if you look at the focus of the company, you've added Endpoint, added VMDR, where does the company go in terms of its focus? Is it want to become a broader -- I guess what I'm asking is, when you think about cyber securities, you've got core network security vendors, you've got end point security, you have identity management, you've got cloud security. And Qualys seems to be building a broader platform that maybe doesn't fit in those traditional definitions. Where directionally can you go? And what kind of growth opportunity does that provide?

Yes, so when we approach product development, it's really based on the continuous dialogue we have with our customers. And let's say -- we're always in conversations about what's on your road map from a security perspective, what are your pain points, and that helps inform how we develop our road map. And obviously, we also look at things like what are the competitive dynamics in the space. We've always said that e-mail security is very interesting, but it's pretty well served by Proofpoint and Mimecast, right? So we don't see trying to build the solution and compete with them. And we really see where we can add value. So just as an example, SIM, which is a very attractive opportunity. And that came from the fact that we had -- in conversations with customers, our customers were saying, look, the situation of Splunk is untenable, no pun intended, because it's -- both the cost but also the ability to try and correlate all this third-party data, they felt like it was resulting frankly in too much false positives. And as we started to examine the opportunity we have to leverage the data we have, we just thought -- we think we can do a better job and do it in a business model that is more attractive to our customers in terms of really just building the data lake as a back end for them to reduce the amount that they have to spend on Splunk, leaving the front-facing application workflows in place that they like, maybe over time displacing it but really just starting at the data lake.

Let's talk a little bit about the go-to-market side. The MSSP channel has been a significant influence through the years. What's the balance of what you're getting through the channel versus MSSP versus other go-to-market routes?

Yes. So channel is about 40% of our revenues and an important part of our strategy, and we continue to -- we feel very good about the partners that we have. We're always open to adding more. MSSP is an important part of it. And we really -- we believe that, that market will continue to evolve in the sense that there really needs to be kind of this next-gen of MSSPs that's really leveraging cloud tools and being less kind of focused on just bodies. And we also see the cloud platform providers as very good partners, and you probably saw that we announced our -- that we went GA with our integration of our container security app into the Azure container registry. And we'll be going GA within the next month with the integration of our Cloud Agent for Vulnerability Management into the Security Center Standard Edition.

How big are the -- when you look at the cloud opportunities and providing VM across all those elements, whether it be container, generic cloud workloads, how big a part of the business is it today? And directionally, what does that opportunity look like?

Yes. Today, it's not a significant part in terms of how people are using the solution today, but we definitely see it growing. And again, we feel that the -- we're excited about the integration we're doing with Microsoft. We think it really speaks to the technological superiority, frankly, of our product, the ability to do an industry cloud-to-cloud integration. We've said today, we're not expecting that to materially -- be a material impact. But we're very hopeful. We just choose to be conservative in terms of what our assumptions on adoption will be.

Do you think that's a bigger opportunity? Or the other part that VM has expanded into is out of the IT side and into the OT part of the world. And you've had a number of announcements in 2019. It might be a little bit quiet over the last 6 months, but where is the bigger opportunity for Qualys?

Well, they're all really big, Sterling. No, actually -- I can't remember if we've talked about this before, we actually recently hired someone specifically for OT and IoT who came out of Zingbox. So we do see that as a big opportunity for us as well. My instinct says that probably public cloud is a little bit more advanced than what I think IT -- IoT today would be. But again, we see them both as big opportunities.

It seems like the OT side is, say, more vertical specific that there might be issues around manufacturing versus oil and gas versus health care. Does that perhaps require specialization in the products whereas the cloud might be more horizontal and a single solution could be used across more industries?

Yes, that's a great question. I think that's probably true in what our -- what we've actually said is because of that verticalization is -- our intention has been to -- when we go into that market is to really open up our agent, really basically allow companies to write their own agent specific for their manufacturing needs because, again, when you think about the world of IT, right, there's basically kind of 3 operating systems: Windows, Linux, iOS. But all the different IoT OT possibilities, it's much more fragmented. And so we don't think it's going to make sense to actually write agent specifics for the med tech device of G versus the med tech device of Siemens or whoever it is in that market. Rather, we'd rather do an SDK for the agent and really collect royalties, let them use our agent technology and leverage even our back end, but let people write specific for their own specific vertical needs.

When growth starts to reaccelerate coming out of this downturn, what do you think the leading indicators are going to be? And do you think that growth is going to be primarily driven by existing customers? Or will be -- should we be watching for new logo uptake?

Yes. It's obviously an unknown. But my guess is I think -- since 90% of our bookings -- over 90% come from existing customers, it's probably going to be driven by that. I think some people have suggested again that in these type of environments, people are going to stay more with incumbent providers, right? So that would lend itself to that argument as well. We think the metrics that are important for our business are the number of cloud agent subscriptions, which we talked about for multi-product adoption, multi-product penetration of our customers as well as the VMDR adoption that we're going to be seeing in the future. So we think those will all lay the groundwork.

And 2 follow-up questions from the audience, first one on VMDR. They weren't quite clear in terms of what the pricing because there is a different pricing mechanism than traditional VM when we think about the IP address as being one underlying mechanisms. What is the pure pricing model on VMDR?

Yes. Similar to asset-based pricing.

Perfect. And then the other one is when you look at -- Qualys is usually viewed as being the upmarket provider within VM. How much SMB exposure do you have?

Yes. So SME and SMB, which we package together, is about companies under employees of 5,000. It's about 20% of our business -- of our revenues. It's about -- the flip side is about 80% of the customers, they're much smaller dollar customers. It's only about 20% of the revenues. And we -- again, if this is being asked in the context of COVID and potential impacts, I should remind people that less than 5% of our annual bookings came from high COVID-sensitive industries like retail and hospitality and travel.

Well, on the other part, as we talked about around earnings, that 20% is customers with 5,000 or fewer employees. 5,000 is a pretty good-sized company. I think you have another stratification that's smaller. What does that exposure look like?

Yes. So SMB, which is companies with employees under 500, I mean, that's less than 5% of the business.

And would that be the area that you'd be most concerned around what renewal rates would look like?

Yes, that's exactly right. As I said today, we haven't seen any issues in retention rates, but you can imagine if companies are going to go out of business or just struggle to make basic payroll, and it's going to be companies at the low end.

And when you look over the last couple of quarters, what are the pricing trends looking like? I don't remember you guys ever really making any changes to list prices. Correct me if I'm wrong. But if not, what's the discounting in the marketplace look like? Given that you do have some close competitors, is there big variations in discounting? And what are those trends have been doing over the last several quarters?

Yes. So we've actually never increased prices in my understanding the history of Qualys. Again, it goes back to sort of company philosophy of it's a subscription business, and you've got to renew every 12 months. So in this environment, we have had internalized, we've had companies ask us for 2 things: extended payments as well as pricing accommodation. And again, we feel very fortunate relative to other companies that we can make accommodations around payment terms because we have a lot of cash. We're very well capitalized. And again, we think that's a strength. Again, that's really about shifting the quarters. It's not necessarily about what we think is a total impact to cash flow. So we're happy to make that accommodation to companies we believe will eventually pay us. On the pricing, we're actually using this as an opportunity to not discount for our solutions. We believe VMDR is a very well-priced solution for the value that it's giving the customers. We're saying what -- we understand that you're budget-constrained, let us help you consolidate other solutions where we can displace an existing solution at a more attractive price point than what you're paying. And again, you don't need people on-site to manage it. Everything from our back end to centrally managed is self-updating. And so the TCO is better for the customer.

All right. With that, guys, thank you so much for joining us. We really appreciate it.

Thanks for having us.

Thank you.

All right.