Qualys, Inc. (QLYS) Earnings Call Transcript & Summary

Hello, everyone. I appreciate you joining us today. I am Patrick Colville, a senior analyst at DB, covering the cybersecurity and the infrastructure software space. The format of this session will be a fireside chat with listener Q&A. There's a chat box where you can ask questions. The questions are anonymous, and so we will not mention your name or your company affiliation. So let's kick it off with introductions. We have Joo Mi, the CFO of Qualys, here with us today. Qualys, as you know, is a SaaS pioneer and a leader in the vulnerability management space. Joo Mi, thank you for joining us.

So given time constraints, I guess let's go straight into questions. So Joo Mi, it's pretty well understood that cybersecurity risks facing the enterprise are only increasing. How has the coronavirus pandemic affected that trend?

Yes. Happy to be joining. And the corona pandemic has affected us both negatively, and we also expect some tailwinds. With the majority of employees now working from home and companies continuing to struggle with the challenges of securing of the remote endpoints, while also ensuring employees are able to work productively from locations. We're expecting continued increase in cybersecurity risk, we definitely see some tailwinds in the long term. We feel very well positioned given the critical nature of what we sell like our solutions have become mission-critical to enterprises and believe this remote work environment will lead to enterprises naturally shifting to cloud-based solutions as the endpoint becomes a new parameter.

Interesting. Thank you so much for that. And I guess, I mean, bear in mind what you said. So how is Qualys' sales motion, I guess, deal sizes, closing rates, churn dynamics, these kind of metrics that investors follow closely, how have they been affected by COVID-19?

Yes. As a subscription business, we have good visibility with over 90% of our annual bookings coming from existing customers. COVID impact has mostly been on the new business and expansion with existing customers. We've been fortunate in that our renewal rates have remained healthy. In Q2, our bookings came in better than our expectations, which resulted in our revenues coming in above the high end of our guidance as well as EPS, and this will led to the increase in our full year annual revenue and EPS guidance as well. So we feel good about the health of our business.

Interesting. And I mean, this leads me on pretty well to I guess our next question because as you say, the business momentum has been pretty healthy. So I guess, can we take a step back and just talk about market dynamics in vulnerability management more broadly and how over the last couple of years, has Qualys differentiated its competitive positioning versus peers?

So in terms of the market, IDC has VM at approximately $3 billion market growing in low teens. We do expect some tailwinds from COVID on the industry, so there might be some acceleration in growth, but not material. Some permanent shift to a network environment and ever-expanding tactics, really has been putting VM at the top of the priority list for security risk management. We believe that we're uniquely positioned with a robust and scalable platform that's made it to the cloud, unlike our direct competitors like Rapid7 and Tenable. Our solutions are centrally managed, self updating and easy to deploy in addition to making it more cost effective, given the cloud delivery and the intuitive nature of our offerings. Earlier this year, back in early Q1, we introduced VMDR, vulnerability management, detection and response, which we believe is a real game changer. The single self-updating app leverages our Qualys cloud platform and cloud agent technology to deliver seamless vulnerability management that incorporate the 4 key elements of discovery, assessment, prioritization and patch management. It first enables customers to identify all known and unknown assets just like we always say, you can't secure what you don't know. Then it analyzes vulnerability, quickly focusing on what's most urgent, using advanced correlation and machine learning. After prioritizing the riskiest vulnerabilities on the most critical assets, it inoculates your assets, detecting available patches so that customers can remediate vulnerabilities and threats across any environment. By delivering all this in a single app workflow and centralized UI, VMDR automates the entire process and significantly accelerate an organization's ability to respond to threats, thus preventing possible exploitation. None of our competitors can provide so much functionality in a single integrated offering. And so it naturally makes us more immune to competition. In addition, we also introduced Multi-Vector EDR, currently in beta, which is also delivered using the same cloud agent technology. Their customers can use the same agent for a number of our solutions, including VMDR, patch management, EDR and later next year, for data against product offering. So this really differentiates us from the competition.

Awesome. Thank you so much, Joo Mi. I'd love to actually double-click on some of the points you make on VDA -- can't say it, VDMR, if possible. Just want to remind our audience that I want to make this as interactive as possible. So if you got any questions that you'd like me to pose on your behalf, anonymously, please use the chat box or e-mail me on patrick.colville, which is C-O-L-V-I-L-L-E at db.com, that's patrick.colvilledb.com, or use the chat box if you guys have any questions. So let's circle back to VDMR, if possible. I mean it's a fast steady product. So I guess, for me, the obvious question here is, is it a product that you think is applicable to the majority of our custom base? And are you expecting broad-based adoption over time? Or is it just a product for the very largest enterprises?

Great question. So VMDR applies across all our customer base, enterprise, SME and SMB. We're pleased with the strong adoption of VMDR with over 600 customers using the app, and 19% of our VM customers having renewed into VMDR in Q2 versus only 4% in Q1. We expect adoption to continue to trend higher over the coming quarters. Overall, the revenue impact from VMDR adoption has been broadly neutral in the first half due to the mix of customers to renewed into VMDR. For example, we expected there to be some uplift from VM-only customers given that they're getting so much more with VMDR. On the other hand, those customers who had purchased multiple apps separately could end up spending a little bit less with VMDR. We spent a considerable time internally discussing how to price VMDR, decided prices this way given the pricing pressure from our direct competitors as well as our industry-leading margins, giving us the flexibility and pricing. In the longer term, we believe that VMDR will lead to accelerated growth because it truly differentiates us from competitors, makes it very easy for customers to expand on to endpoints, as well as take on additional paid solutions like patch management and drive increase in dollar retention rate.

Got it. So just to paraphrase that back. So you're expecting, over time, this is a product that is applicable to basically all customers. And in terms of spending, if a customer is a VM customer without many of the other products, then the spending uplift could be pretty significant. If the customer already has most products, then it could lead to a small downtick. I mean I don't want to put you on the spot, but is there a way that you could quantify that? Or is it too early to tell?

It's a little too early to tell, and it's difficult to quantify, given the pricing curve. But one point that I'd like to point out is we've disclosed previously that our enterprise customers with a single solution may be spending on average $40,000 to $50,000 per year with us. Now if they end up like subscribing to multiple of our solutions, that spend multiplied by 4 to 5x. So that gives you kind of a sense of what the up-sell potential is in addition to some cross-sell potential that we're seeing in the market?

Okay. That's very helpful. I mean I'd love to switch gear to probably the elephant in the room really right now is public cloud, the cloud adoption. And we've all seen that cloud has been -- proved to be an excellent delivery model for remote working. And so I wouldn't be surprised if -- or we expect really cloud adoption to kind of accelerate from here. You've got integrations with AWS, Azure and GCP. And in particular, if I'm not mistaken, a very close relationship with Microsoft Azure. So can you talk about like partnership and how it's ramping?

Yes. We see the cloud service providers as an important distribution channel. We're very excited about the partnership with Microsoft, whereby our solutions will be embedded into Azure, which is really a testament to our technology leadership. Microsoft is embedding Qualys VM into Azure security center and container security into Azure container registry. These applications are available to Azure security center standard edition or a virtual machine into customers using Azure security centers, advanced threat protection for Azure Kubernetes Service for no additional fee. We're very excited to see the opportunity to partner with Microsoft to sell our other solutions and have developed similar relationships with other CSPs.

Sorry, I was just talking to myself on mute. So I guess, I mean, can we just take a step back quickly and just talk over how Qualys' position in public cloud is different from on-premises environment. So if you're selling to a company that is -- was founded 5, 10 years ago and it's 100% cloud, how Qualys' position is different in that company versus a company that's been around for a lot longer and has this kind of mixed state?

Yes. So what we do is we're actually positioned very well on both fronts because if you talk about, we actually sell to customers directly. We're actually using the cloud plat providers such as Azure and Microsoft in addition to kind of work having a direct relationship or partnership with the CSP. So in that case, we might -- if the customer comes directly to us to subscribe to Qualys and sign up as our direct customers, we can definitely service them using our Qualys product offerings. In addition to, if they were to go to straight to Azure, you'll see that they'll be benefiting from Qualys having directly embedded into their Azure security centers.

Okay. That's helpful. I mean I'd love to switch gear, just to, I guess, the go to market. For me, someone who's been following Qualys for a long time. I think the biggest change has been the breadth of products that Qualys now offer versus 5 years ago, say? And so my question is, how is the go-to-market model changing as a result of the broadening product portfolio? And probably within that question, I like to have multiple questions in one, how is -- what would -- what's in the business is now kind of non-VM?