Joo Mi Kim - Qualys, Inc. Philippe F. Courtot - Qualys, Inc. Melissa B. Fisher - Qualys, Inc..

Alex Henderson - Needham & Co. LLC Ugam Kamat - JPMorgan India Pvt Ltd. Howard S. Smith - First Analysis Securities Melissa Gorham Franchi - Morgan Stanley & Co. LLC Matthew George Hedberg - RBC Capital Markets LLC Srini Nandury - Summit Insights Group Erik L. Suppiger - JMP Securities LLC Jayson A. Noland - Robert W. Baird & Co., Inc.

Rob Owens - KeyBanc Capital Markets, Inc. Michael Wonchoon Kim - Imperial Capital LLC Gur Yehudah Talpaz - Stifel, Nicolaus & Co., Inc. Siti Panigrahi - Wells Fargo Securities LLC Patrick E. Colville - Arete Research Services LLP.

Good day, everyone, and welcome to Qualys' First Quarter 2018 Earnings Conference Call. This call is being recorded. At this time, all participants are in a listen-only mode. Later, we will conduct a question-and-answer session, and instructions for asking a question will be given at that time.

I would now like to turn the call over to Joo Mi Kim, Vice President, FP&A and Investor Relations. Please go ahead, ma'am..

Thanks, Ryan. Good afternoon and welcome to Qualys' first quarter 2018 earnings call. Joining me today to discuss our results are Philippe Courtot, our Chairman and CEO, and Melissa Fisher, our CFO.

Before we get started, I would like to remind you that our remarks today will include forward-looking statements that generally relate to future events or our future financial or operating performance. Actual results may differ materially from these statements.

Factors that could cause results to differ materially are set forth in today's press release and in our filings with the SEC, including our latest Form 10-Q and 10-K.

Any forward-looking statements that we make on this call are based on assumptions as of today and we undertake no obligation to update these statements as a result of new information or future events. During this call, we will present both GAAP and non-GAAP financial measures.

A reconciliation of GAAP to non-GAAP measures is included in today's earnings press release. As a reminder, the press release, prepared remarks, and an accompanying investor presentation with supplemental information are available on our website. With that, I'd like to turn the call over Philippe..

visibility, accuracy, scale, immediacy, and transparent orchestration. In Q1, our go-to-market capabilities expanded as follows. In partnership with the Cloud Security Alliance, we launched the Inaugural CIO/CISO Interchange to enable security expert to share best practices of securing the digital transformation.

Expanded integration of the Qualys Cloud Platform, including Qualys Vulnerability Management, VM, and Policy Compliance, PC, Cloud Apps, with the DXC Threat and Vulnerability Management MSS portfolio.

We fully integrated the Qualys Cloud Platform with Ernst & Young cybersecurity innovation and operations centers that EY opened in July 2017 to help joint clients stay ahead of emerging threats.

And we released two free groundbreaking services, CloudView and CertView, providing companies of all size the instant ability to track and monitor digital certificates and cloud resources. Most recently, we announced the following product achievements.

The acquisition of 1Mobility which enabled us to uniquely provide enterprises, discovery, inventory, security, compliance and response on both enterprise-owned as well as employees-owned endpoints, expanding our footprint within our customer base.

Our ability to then provide global asset IT inventory as well as Cloud Inventory in two seconds will be unmatched by competitive offerings. Integration with Illumio to deliver the industry's first vulnerability-based micro-segmentation; and integration also with the Cloud Security Command Center, Cloud SCC, for Google Platform, GCP.

Our RSA Conference 2018 was clearly a turning point for our company as our platform, which uniquely provides full visibility across on-premise, endpoints, cloud environments and soon mobile, resonated extremely well with both customers and partner, including the release of new services and demonstration of new technology to come.

We showcased CertView and CloudView, two new free groundbreaking services to help organization gain visibility of their digital certificates via CertView and track and monitor public cloud assets and resources via CloudView.

We released out-of-the-box Jenkins integration, Swagger support, and new Chrome Browser Recorder extension for our Web Application Security app, enabling further automation and streamlining our REST APIs for the DevOps teams.

We demonstrated live our forthcoming passive scanning technology that delivers near real-time network profiling and monitoring for continuous asset discovery of all devices that appears on the network, including mobile and IoT devices.

The passive scanner monitors network traffic in a non-intrusive manner to discover and fingerprint devices to determine topology, services, and network threats. At the RSA Conference, we also saw a greater interest in our platform from our partners as cybersecurity services is becoming a more strategic offering for them.

They recognize that the Qualys Cloud Platform helps customers regain visibility across their hybrid cloud environment, consolidate their security and compliance stack and enable their digital transformation by helping them build security and not bolt it on.

Our Qualys Cloud Platform, used by over 10,300 customers, serves also as a natural distribution channel, making instantly available new solutions and improvements across the globe to customers, thus providing us and our partners with both operational and financial leverage.

With that, I will turn the call over to Melissa to discuss our financial results..

Thanks, Philippe, and good afternoon. Before I start, I'd like to note that, except for revenue, all financial figures are non-GAAP, unless stated otherwise.

As Philippe mentioned, we continue to see strong demand driven by our strategic positioning as the leading cloud platform in our markets, reflected in the following financial and operational highlights. Revenues for the first quarter of 2018 were $64.9 million, which represents 22% growth over the same quarter last year.

The percentage of enterprise customers with three or more Qualys solutions rose to 34% this quarter, up from 27% a year ago. The percentage of enterprise customers with four or more Qualys solutions rose to 16% this quarter, up from 9% a year ago. Average deal size continued to increase in Q1 growing 17% year-over-year.

7.3 million Cloud Agents were purchased over the last 12 months, a 23% increase over the last quarter, and we saw good growth from both Cloud Agent and Threat Protection bookings. New products released since 2015 contributed approximately 15% of total bookings in the quarter, up from 8% in Q1 2017.

Our scalable model continues to drive industry-leading margins and significant cash flow as reflected in adjusted EBITDA for the first quarter of 2018 of $24.6 million, representing a 38% margin as compared to 32% for the same quarter last year.

For comparability purposes, Q1 adjusted EBITDA margin would be 37% adjusted for the impact of 606, specifically the amortization of commissions. And operating cash flow for the first quarter of 2018 increased by 33% year-over-year to $43 million. We continue to invest our cash in Qualys.

Capital expenditures, including principal payments under capital lease obligations, were $6.7 million in the first quarter of 2018. And in Q1, we repurchased 21,288 shares. We have $98.5 million remaining in our share repurchase authorization.

Driven by our great results, our momentum in the marketplace and our scalable operational model, we're raising the low end of our fiscal year 2018 revenue guidance and, therefore, our midpoint. Our current fiscal year 2018 revenue guidance is now a range of $276.8 million to $278.5 million.

We're raising our fiscal year 2018 non-GAAP EPS guidance from a range of $1.39 to $1.44 to a range of $1.43 to $1.48. We expect capital expenditures for the second quarter of 2018 to be in the range of $6 million to $7 million.

And we have a strong current deferred revenue balance of $147.7 million as of March 31, 2018, 23% greater than our balance as of March 31, 2017. We look forward to sharing with you our vision, strategy, product roadmap, and financial outlook at our virtual QSC User and Analyst & Investor events, June 13 to 14.

With that, Philippe and I would be happy to answer any of your questions..

Thank you. We will now begin the question-and-answer session. Our first question will come from the line of Henderson with Needham. Your line is now open..

Great, thank you very much. I was hoping you could talk a little bit about the decline in deferred or the slower growth in bookings. The growth I think has slowed down to – from almost 20% down to 10% in the quarter.

Was there anything in that, anything to do (00:10:17) with the change in the accounting that accounted for that? Is it just seasonal, anything along that give us some sense of that would be helpful. Thank you..

Yeah. So, remember, we had a great quarter and we have a very healthy outlook. As we've discussed before, the 10% you're referring to is a total billings calculation.

And as we said, if you are going to look at the billings metric, the proper metric would be current billings because our non-current deferred revenue is driven by the number and amount of multiyear prepaid deals which is customer-driven. We don't incent our sales force on that, and so that fluctuates.

So that's why we focus on current deferred revenue growth which is 23% year-over-year. Also remember, as we've discussed that billings is not a perfect proxy for bookings on a quarterly basis, over time, it comes close, but on a quarterly basis, it may differ, for example, by the impact of the timing of invoicing.

So we may have a number of deals come in on March 31 that we end up invoicing on April 1. So we really emphasize the trajectory of our annual revenue guidance is the best proxy for business momentum because certainly current bookings inform our guidance..

Great. That's perfect. Thank you very much..

Thank you. And our next question will come from the line of Sterling Auty with JPMorgan. Your line is now open..

Hey, guys. This is actually Ugam Kamat on for Sterling..

Hi, Ugam..

Hello. So, Melissa, you mentioned that new products constituted 15% of total bookings in the quarter.

Just to dig in a level deeper, if we just exclude the Cloud Agents, how does the other products fair in terms of their contribution to the total bookings?.

Yeah. It's still primarily Cloud Agent bookings and – from a proportion perspective, but that's – as a group, both the Cloud Agent and ThreatPROTECT – Threat Protection, which is the other larger category, continued to do very well. In total, they grew over 100% year-over-year..

Okay.

And just as a follow-up to that previous question, how much are you penetrated within your base with the Cloud Agents, just to think in terms of how much upsell opportunity is left?.

Yeah, that's a great question. There's still a lot of opportunity. At this point, only about 12% of our customers have the Cloud Agent so there's still a lot of upside for us..

Yeah, and I would add one point. We're starting now to see more deployment on the endpoints, just like we did with one customers who has deployed 380,000 agents on the endpoints. So we can see our agent moving now from the traditional servers to make vulnerability management and policy compliance more real-time, more effective, more precise, in fact.

Now, we see our agent really moving very well, on one hand, of the endpoints as well as in cloud environments..

Thank you. And our next question will come from the line of Howard Smith, First Analysis. Your line is now open..

Yes, thank you and congratulations on a solid start to the year. One for Philippe, one for Melissa. For Philippe, your CloudView, CertView, the free offering a nice way to acquire some customers, I know it's very early days just coming out a couple weeks ago.

But I was wondering if you could give any color on reception, downloads, commentary from people you've discussed it with that you're hearing..

Yes, I can certainly give you some color. And to be specific, so CloudView was totally GA. And so, we have today about on CloudView right about more than 1,000 free signing. And remember, this is a full service, so this is for people who essentially have the complete view of their inventory across all of their clouds.

So, that's very good news obviously. The CertView, which is the free service component, is for any company in the world, small or large, with the ability to track their digital certificates, Internet-facing digital certificates when – where are they, when we signed them and when they are going to expire – has not – is just now entering a full GA.

So, we have of course – we are expecting to see on this one the significant uptake as well..

Great. Thank you. And, Melissa, your cash flow is very strong this quarter. If I remember correctly, last first quarter, there was some stock-based comp and do the accounting that comes in there.

Did that repeat or was this just working capital items seasonally just coming in strong?.

Actually, if you look at the year-over-year comparison, it's actually the increased profitability that drove it. Last year, we actually had an impact of a lot of multiyear prepaid deals being collected. We actually didn't have that. So, it was really actually more driven by the profitability..

That's great. Thank you..

Yeah..

Thank you. And our next question will come from the line of Melissa Franchi with Morgan Stanley. Your line is now open..

Great. Thanks for taking my question.

So just following up on earlier question about the adoption of multiple solutions, so one of the metrics that continues to inflect higher is the number of customers adopting 4+ solutions, and so you mentioned Cloud Agent and ThreatPROTECT, but I'm just wondering beyond those solutions what are you seeing good traction in?.

Oh, it's really across all of our solutions, but obviously, it's also going to include the older ones which have been out longer.

So, for example, customers who were VM customers that were adopting Web Application Scanning or Policy Compliance would drive that as well or vice versa, customer that might have been Policy Compliance only adopting the Vulnerability Management..

Okay, okay..

Yeah. It's pretty at the – across all of our services. And in fact, what really people appreciate more and more now finally is that we have essentially just one single platform.

And the analogy that I could really give is that, if you look at your phone today, you have multiple apps, but these apps are disjointed in the sense that you go to Uber and you're going to have your credit card there and you're going to pay, there's a different application.

With Qualys, all these apps that you have, they speak between each other which, by the way, they improve, they essentially add value to each other. But then they are absolutely on one single platform. And that's really the customers are starting now to realize the benefits of that and especially with the amount of services that now we provide.

So I think it's very clear that the strategy that all the work that was done to really create that significant back-end which integrates all of these application is really paying off. And now, by the way, we're also working to really create a frontend which even more smoothly integrate all of these applications..

That's great. And just one quick follow-up for Melissa, so just kind of parsing through the comments that you made earlier in terms of the deferred revenue, so is it fair to say that the contract duration was shorter this quarter than a year ago? It sounds like that's kind of the conclusion.

I'm just wondering if you could maybe, like, put some numbers around it in terms of, like, what's the average like this quarter versus a year ago?.

Yeah. It's been around 1.1% the last few quarters. I think it may have got increased to, like, 1.2% a year ago. So, these are kind of small moves..

Yeah. And also, it's because one thing is that, when you look at the length of our contract, we have a lot of very small customers who typically are one year..

That's right..

And so, when we see, if you look at the real trends, which – we see our enterprise customers moving more and more to three-year contract, when the SME/SMB, they still stay at about a year..

Right. And then even separately from that, as I mentioned, our non-current deferred revenue is just going to be impacted by the number of customers within that multiyear bucket that actually decide to prepay, which is obviously not all of them as well..

Okay. Thank you very much..

Yeah..

Thank you. Our next question will come from the line of Matt Hedberg with RBC Capital Markets. Your line is now open..

Hey, guys. Thanks for taking my questions. Philippe, maybe starting with you, I'm wondering if you can give us a little bit more color on geographic performance.

I'm curious if you guys have started to see any real benefit from GDPR yet?.

So, that's two questions. So, geographic performance has been good everywhere, Europe doing very well, and not really because of GDPR. I think we are not seeing yet really the direct GDPR correlation or, obviously, there is one.

But it's because we see our customers in Europe deploying more and also adopting more new solutions And we have very good customer base in Europe which in the past was essentially mono product. And now, they are starting to finally move to adopting more solutions.

And therefore, these are getting a little bit bigger, and therefore, we have very good growth. And the upsells are bigger. So, today – but the three markets, U.S. – the Americas, Europe, and Asia, are doing very well..

And then maybe one other one. On one of your newer product launches that's still in beta, I'm curious for your Container Security solution, it seems like an interesting product.

I'm wondering if there's any – I know it's early and it's still private beta, but any feedback on that product, who's sort of been interested in it and what does the competitive landscape look like for that?.

So, again, this is the same (00:20:28) so it's a very good question. So, container is very hot including for ourselves. I mean, we're now containerizing the entire infrastructure of Qualys. So, we're also using ourself, our solutions there. So there's a huge interest for containers.

What again people like, compared with other solution, that this is again totally integrated with the Qualys Platform. So, all of our existing customers are really, really bullish. That product is coming close to GA.

And I think this is still an early market but it's becoming a very strategic market as companies are really moving into containers and moving into the cloud as well. So, both CloudView and the Container Security, again, all of that out of the same platform which is the analogy I was giving earlier.

Think of having all of your apps in the phone being centrally managed, self-updating with the same pay, everything the same....

Interoperable..

Interoperable, all the costs that you can eliminate. And then on the top of that, the ability for you also to create an app that also brings the data to you the way you like it to our customizable customers. So, that's what we have done, and I think it will resonate at RSA significantly and our partners were absolutely floored.

We showcased the passive scanning which is also, again, totally integrated. So now we can detect mobile and IoT devices, any devices that connect on the network. So we are on track to deliver our passive scanning capabilities fully integrated by late summer..

That's great. Thanks a lot, guys..

Thank you. And our next question will come from the line of Srini Nandury with Summit Insights Group. Your line is now open..

All right. Thank you so much. Melissa, I have a question for you. You mentioned the average deal sizes grew 17% year-over-year. Can you provide some color why – what is driving this growth? And also, can you comment on the rental (00:22:24) sales cycles in general, have you seen any compression with the last year or so? I have a follow-up for Philippe..

Yeah. Hi, Srini. So it's a couple of the factors that have been impacting the increase in deal size, we've really seen it continue quarter after quarter to increase. One is we're seeing larger deployments of existing solutions.

So whether it's a new customer starting out bigger than traditionally we had seen or it's a customer expanding with – let's say their VM capabilities, that's part of it. But then it's also they're adding on new solutions. So it's really multiple drivers that are driving up the deal sizes..

Yeah. And on the....

On the sales cycle? I'm sorry, go ahead..

Yeah. And on the sales cycle, I think – around traditional market, I think the sales cycle are about the same. There are not significant changes.

Where we can see that this is again – this is new, this is early is that on the cloud for people who are looking at the cloud solutions, that we can see that the selling cycle should be shorter because of course this is the new – this is greenfield and people need the visibility.

And that's why an indication of that is clearly the 1,000-plus register – the people who register for the free CloudView service..

Okay. Philippe, on your recent acquisition, 1Mobility, can you provide some color, what does it do, when is the acquisition expected to close and who does it compete against the market? Thank you..

So, 1Mobility is a fantastic acquisition that we made. The acquisition has closed so this is a done deal. The team is already integrated in Pune, India, totally.

And essentially, what they provide is – what they have done is a very nice mobile application which – with a very well-architectured agent that goes into every version of Androids, of Apple iOS, as well as Microsoft Mobile, and if I recall correctly, I think also BlackBerry.

And so that essentially, it's the similar agent technology that the one that we have for the traditional devices. And so we're bringing that into Qualys, which mean it's going to extend all the capabilities that we currently have with the Qualys to the mobile environment. And that's something that every customer demands, essentially.

I've got this -- and I'm sure this is your case as well. I've got this app – I use myself an Apple tablet. So, today, the only thing that you have is essentially mobile management devices.

But in term of the security of that devices of being able to quarantine that device, if there is something which has been detected which is not capable, there's really nothing out there. So I think this has increased significantly the strategic value of Qualys.

And in term of when are we going to have that to market, for the current plan is to have in fact their solution which we are integrating into the platform. As you know, everything we do when we acquire these companies, we don't continue selling what they have already, because we put all of our effort to integrating that into the platform.

The reason is because once this solution are integrated into the platform, not only it makes it much easier and much more cost effective for our customers, but also, we can distribute this application instantly across the globe to all of our customers. And again – and then they are also centrally managed and self-updating.

So, again, so we are very coherent with our architecture. So, we're anticipating to have their solution totally integrated with Qualys in the first quarter of next year..

Thanks, Philippe. Thank you for the color..

Thank you. And our next question will come from the line of Erik Suppiger with JPMorgan (sic) [JMP] (00:26:22) Securities. Your line is now open..

Actually with JMP, but two questions. One, your new products, they have been growing – the percentage of revenues generated by new products have been growing pretty rapidly if you go back a few quarters. They've leveled off in the last three quarters. I think they were 14%, 15% and 15%.

Can you give us a sense of what kind of expectation we might have for that going forward? Is there any reason why that wouldn't reaccelerate or what are your thoughts there? And then secondly, can you give us the metrics for Cloud Agent, how many additional agents you deployed in the quarter?.

Yeah. So, let me take the first question first. So, our new products have actually been doing very well. As I mentioned, bookings actually grew over 100% year-over-year. Remember, the percent of total company bookings is relative to how the rest of the solutions are doing at any point in time.

So, for example, in quarters where other solutions are growing very well like this quarter, Vulnerability Management, Web Application Scanning did very well, the overall mix isn't going to shift much. So, it's a little bit hard to predict. And remember that we focus on total company revenues because we're selling a platform.

And we don't incent our sales force by product because we don't want them to push customers on products that they're not going to renew. So I think that's why we provided the additional color to let you know that these solutions are doing very well and the mix in any one quarter may change..

Yeah. And one thing that I will add to what Melissa said is that, of course, as we deliver more and more services, obviously, you will not really expect that, of course, the volume of new solutions as compared to the existing ones will grow. So....

Right. And then....

So, does that....

Sorry..

Just a quick question on that front.

Does that suggest that, over the longer term, we should expect that 15% to reaccelerate or is it just difficult to know how the VM side is going to perform?.

I would say probably (00:28:42), yes, absolutely. VM is doing very well because, again, because VM now is becoming much more strategic, people realize they need to have the visibility on everything. And so, of course, we have expansions still in our existing customer base. Still, there's a lot of companies which are not really doing fully VM.

So, we have that behind us, so that will continue. But I think, at some point in time, the mass of new services that we're bringing to market which is quite impressive, of course, is going to have a take..

Yeah. And I was going to add to that is because we're going to get the leverage from the additional new solutions coming out. Today, it's primarily still Cloud Agent, Threat Protection. For example, FIM, IOC, they're still very early.

We'll not only have additional revenues from those, but as well as the new solutions that we're talking about GA-ing, the CloudView assessment, the management of digital certificates, as well as Container Security. So we will have....

You have Patch Management (00:29:42)..

Right. Just by numbers more of it, that should drive it, it's just hard to predict sort of the actual specific numbers over which period in time..

Okay.

And the Cloud Agent?.

Yeah. So I had mentioned that Cloud Agents, we had sold $7.3 million over the last 12 months. We reported last quarter $6 million Cloud Agents. So the difference is $1.3 million net..

Okay. That's better. (00:30:07) Thank you..

Thank you. And our next question will come from the line of Jayson Noland with Baird. Your line is now open..

Okay. Great. Thank you. Philippe, I wanted to ask on RSA, you called it a turning point.

How did conversations with customers and potential customers a couple of weeks ago differ from conversations last year and did it result in better or higher quality lead generation?.

Oh, no. I think the customers, what would – because of all the demonstration that we make and our customers seeing that we're really delivering everything that is really coming together in a very well integrated, so it was a kind of aha moment, yeah. This is it, Qualys is there.

And we saw the same reaction from our partners, our partners which typically who are looking at us much more and much more like the VM solution that they have, and they're very happy with. And suddenly, they realize all these additional services that they can leverage. So I think this was a kind of aha moment.

And at the time, which is interesting, when you contrast that with the cacophony of RSA which have so many solutions, so many vendors, everybody's lost including ourselves.

So seeing Qualys bringing all these application today in a very rational way, in a very well-integrated way, again, everything is centrally managed, everything is self-updating out of this one single platform, that was really, really music to the ears of both of our customers and our partner..

And just to follow up there, we had a large integrator at the show tell us – or he was joking saying everyone claims to be cloud now, and that....

Yeah, exactly..

...the market is coming toward – and that's the market coming toward you.

But does that change the competitive landscape or confuse the buyer at all?.

I think the buyers – our customers are becoming of course less and less confused in a way because, obviously, they realize that they made the right investments in the past, so they are pretty happy.

And now, today, with all these new services, and we start to really I think have the ability to essentially start to accelerate our penetration of the market which is already pretty high. So, that's when we came out of that, I would say, very bullish.

We did that one initiative with the Cloud Security Alliances, which is quite significant, which is essentially we're working with the Cloud Security Alliance which, as you may recall, it's about 100 chapters in the world with 80,000 volunteers which are all security professionals.

And really, they've been focusing since – like us since 2009 on the metrics to secure the cloud. And now, today, they are embarking into what do we need to do to really secure, enable the digital transformation.

So we are going to embark into conferences and forums everywhere in the world to essentially bring our customers and of course other users to – with experts to discuss about enabling the digital transformation. So, that's a significant initiative. We had done something very similar many years ago.

I did that with the late Howard Schmidt at the time when Vulnerability Management was looked as a kind of a secondary application.

So, we went with our customers, with our early adopters and with Howard and myself and a few other experts to really evangelize why Vulnerability Management was important because you've got to know your vulnerabilities simply before the hackers can find them, and so – only it took that long.

So I've been evangelizing the cloud as well for so long, but now the time is there. And so, we saw what we call transparent orchestration, the full integration with Azure that we did.

So, a lot of people speak about orchestration, but that orchestration is still the old way which is essentially you have workflows when, at the end of the day, everything could be totally transparently integrated.

And that's what we showcased also at the Cloud Security Alliance Summit, our Chief Product Officer Sumedh showing that full integration that we have with Microsoft Azure which is absolutely remarkable.

And again, in order to do that, you have to have the right architecture which we go back to your question which is there's a lot of people talking about how we've got a cloud platform but how many really do have one. So, there's not that many because that's not something that you do that easily..

Thanks for the color, Philippe..

Thank you. And our next question will come from the line of Rob Owens with KeyBanc Capital. Your line is now open..

Great. Thank you for taking my question. I think in your prepared remarks you mentioned 12% of your customers have the Cloud Agent.

Can you remind me how that's been trending and, I guess, if you can splice it one other way with new customer acquisition in the quarter kind of what's the hit rate of those new customers taking Cloud Agent?.

Yeah. So, that's right, it's 12% this quarter, Rob. It was 11% last quarter. So, it's kind of been moving 1% to 2% over the last two quarters. In terms of what new customers buy, it varies quarter by quarter in general, and I would say it's true of this quarter, they actually tend to disproportionately buy our newer solutions.

So, obviously, our new solutions are brought by a mix of existing and new, but we see a higher uptake with new in general..

And can you put any color on it? Is it a quarter? Is it half or something of that nature?.

Yeah. We haven't disclosed that historically, it's something we can look at providing going forward..

Okay. And then second, as you look kind of that – the traditional VM market and some of the acceleration, can you speak a little bit just relative to scanning in the cloud versus scanning on-prem? And it seems like cloud has had a much higher attach rate.

If you look within your installed based, how much of VM do you think is coming from scanning within AWS or Azure at this point?.

So, let me make one – one first comment is that scanning in the cloud and scanning a network are totally different. Scanning in the cloud, you want to have the Qualys agent, because putting a scanner in the cloud doesn't make really any sense. So the architecture that we have for the cloud is really the right one. That's what we did with Microsoft.

So, any Qualys customer today – any Microsoft Azure customer can, on the click of a mouse, go to the Security Center, and then as you click up a mouse, automatically, a Qualys agent is provisioned, which gave them the view of their security and compares (00:36:54) posture on Azure.

And then they can also automatically go to the remediation in the console of Azure. And of course, we can do the same thing in ours. So you need that architecture. And we see today of course a very good uptake on our agent in the cloud. But again, this is more of a new compared to the huge installed based that we have on the enterprise.

The cloud is really a little bit newer..

Great, thanks..

Thank you. And our next question will come from the line of Michael Kim with Imperial Capital. Your line is now open..

Hi. Good afternoon, guys.

With the expansion in your product suite over the last 12, 18 months, and you have a pretty strong product roadmap for 2018, can you talk about more broadly how you may be changing your selling motion and how you capture more wallet share without potentially impacting deal velocity and any thoughts on your go-to-market strategy? Thanks..

Yes. So, our market strategy have not fundamentally changed, but of course has evolved. So, on one hand, we see, as I was mentioning earlier, we have already built significant partnerships out there with all the engineered sources being Qualys customers, all engineered sources becoming – being Qualys partners.

We have also very large customers and partner like Ernst & Young, PwC, et cetera, so we have the Optiv of this word. (38:19) So what we see today now is that, in the past, again, this channel were more looking at us as the Vulnerability Management solution, and now today, they see the benefits of everything that we have done.

So we're becoming more and more strategic for them. So what we are doing with them is of course training them more on our new solutions. So that's one thing that we're doing, so we have also beefed up our Strategic Alliance Group. And we're now providing more and more training on the new services and so forth.

Also these free services are also available for our customers, but they can also market as well to create lead generation. On the enterprise, what we're doing, we're changing a little bit – again, adjusting our sales force. As you may recall, our sales force is divided into the hunters and the farmers, they both are technical.

But what we are doing here is essentially creating different categories of customers and, as a result of that, of technical account managers. So, we have been classifying our customers between the very extra large, which are large companies like Microsoft, like Oracle, like Google, et cetera, very large deployments. Scale is of course the issue.

So, here we have even a very highly technical sales force that we are now starting to build to support these customers so we can continuously be close to them. Then we have the large customers which now we are essentially making a higher category, if you prefer, of technical account managers. And then we have our regular customers.

And that's the changes that we're making here. And that's it. So, we are continuously very consistent with our model. We're just tuning it to the fact that – and I think, sorry, a few more subject matter experts, again, to make sure that – which are experts in these different modalities. But again, it's so easy to try and buy.

So, if you are an existing Qualys customer, immediately, all these new services are available for you and you can even yourself automatically create a client account. And then we have these technical account managers which are there or eventually a subject matter expert to help you evaluate..

And that's why – I'd just add on, that's why we describe the platform as a natural distribution channel, as Philippe mentioned earlier..

Got it.

And do you see an opportunity to accelerate your hiring of technical account managers this year and forward investing in some of that sales capacity?.

We are doing that. The challenge we have is to really find, it's very hard to find good people. I mean, and again, and our model is that there's plenty today of what I call our managed sales guys as our industry is consolidating, that's all on the market. But, one, they are extremely expensive, and second, they are not technical at all.

So, that's not the people we are looking for. So, we're still continuing having more the AC type people which are more and more technical. And our customers, at the end of the day, they prefer that because they're hounded by too many security vendors which essentially go for their wallets. And that was the theme at RSA.

I don't know if you saw the – on LinkedIn the post of the CSO of Lyft, (00:41:41) which essentially was essentially telling at RSA, why do we go there, because I see the vendors, they are coming to me all day long.

So why should I go to San Francisco to essentially go and meet more vendors and the cacophony of what they say? And so it's a waste of my time..

Yeah, absolutely. Well, thank you very much. Appreciate it..

Thanks, Michael..

Thank you. And our next question will come from the line of Gur Talpaz with Stifel. Your line is now open..

Great. Thanks for taking my question. So, Philippe, with the four new products set to hit beta here in 2H 2018, which ones are you most excited about? And then I guess more importantly, how do you think about the competitive environment across each of those and how do you think about that more broadly speaking as well? Thank you..

Yeah, that's a broad question. So I don't know where to start because I'm excited by all of them. So, let me be specific. So today, by far, the most important new service are the Cloud Agent because, as we discussed, the Cloud Agents in fact are essentially enabling additional services.

We start to be very happy with the fact that these agents are going to the endpoint. What are they doing in the endpoint now? Not only they are doing in the VM which they weren't doing in the past, but they are starting to do the IOC. So, we are starting to displace a company like Tanium there and others.

So that's for the detection of Indication of Compromise. Then of course we have additional services in the cloud. This is totally – this is greenfield, and I think we're extremely well positioned there. So we are very excited about that with CertView, CloudView, all these things.

The technology we really, really love as well is the passive scanning technology because that's another – if the way I look from a strategic standpoint, Qualys has mastered to do the scanning technology.

We can scan every IP on the planet, every website on the planet, we do more than 3 billion scans a year with Six Sigma accuracy, in fact, better than Six Sigma. So, that's a technology we have mastered. The second technology we have now mastered are the agent. And the agent allows us to have real-time information.

So, we bring all that information to our back-end as well.

And now, the passive scanning which is the third technology that we will master, which is essentially being capable of analyzing everything that connects them to the network, whether it's an IoT device, whether it's a phone, whether, in fact, at RSA, we detected visitor coming in, we detected Apple Watch as well.

And then of course, if we got the time, we could even launch a scan on these devices. So, combining all these three different technologies is really going to make us absolutely unique in the marketplace.

Nobody has built that, and with also the back-end with the scale where we can absolutely manage significant amount of information now including log information, et cetera, so bringing all that data into one single place where everything is indexed under Elasticsearch, where we have more than 2.5 billion data points currently indexed on Elasticsearch which allows us to, in two seconds, being able to have the visibility on any devices up there with the most precision where they're located, the users connected to them, how many RAM they are using, what are the application installed them, and essentially being capable, very close with – once we combined these three technology together being able to provide you your global IT Asset Inventory and synchronize that with your CMDBs.

That's the key strategic direction of Qualys and I think we'll be there before the end of the year..

Well, Philippe, is it fair to say you're excited for the future?.

But we all, not me, not me, all of us. I mean we have really – and we are very happy with the company that we have built, the way we communicate, the way everybody is focused on when this is to be done. I mean, this is really we're very happy, and not to mention the profitability which we have been accused of....

Having too much of..

...having too much of it..

Fair enough. Melissa, maybe a question for you here as well. I know you don't provide it.

But directionally, given the growth in the number of customers with 3+ and 4+ solutions, how was the dollar renewal rate been trending, I guess, with the growth in agent, I would assume it's trending up or at least flat, but I was hoping you could provide at least some directional commentary there, that'd be really helpful?.

Yeah, absolutely. Hey, Gur. So, we focus on dollar net expansion rate and we've provided it at our last Investor Day. It was somewhere around 105%. We'll provide an update at our virtual event in June. But I can say obviously, given what we've seen in our performance, it won't surprise you that's obviously been trending in a positive manner..

That's helpful. Thank you..

Thank you. And our next question will come from the line of Siti Panigrahi with Wells Fargo. Your line is now open..

Hi, guys. Thanks for taking my question. I was actually switching between calls. My apology if this question has been asked. But, Philippe, when I see the pipeline, the products that you're planning to launch this year, already you have six products GA-ing first half and four already in the pipeline.

And I see like some of these products probably be easier to update, so what are the products that you are more excited about seeing quicker adoption versus some of the products maybe have later adoption? So just wanted to understand what are the products that you think make some sort of meaningful revenue contribution in near future versus midterm and long term?.

So, I think the adoption – revenue contribution is a little bit different but – and they all help each other anyway.

So, today, we are very bullish about our free services that we've launched and we saw, as I've mentioned earlier, you may be you were not on the call, so on our CloudView free service, we have already more upgraded in few weeks, in two weeks, we have about 1,000-plus people who registered for the free service.

CertView, it's about to go GA, so we're anticipating a very big adoption. The beauty of these services is that, one, they do something very useful that people need to do. So you need to know where these certificates are, who signed them, when are they going to expire.

And then same thing in the cloud, you need to know your inventory or (00:48:23) three buckets, how many of them are exposed, et cetera, to the Internet. So that's absolutely they are must-have application. And then of course we have significant upsell. So it does two things.

One, it creates awareness for Qualys for those who didn't know us before or maybe they were knowing us but they were not using us. And now it creates also significant upsell opportunities because, once we have a customer doing with CloudView the assessment of their inventory, now we can sell to them, upsell to them the Security Assessment.

And same thing with the certificates, if you do your Internet-facing surcharge, we can now upsell you on your endpoints on your Internet service, and then we will also have the management of the additional certificates to upsell you. So these are – they have started very well.

So we're very excited with that, and this is all greenfield approach, (00:49:19) all greenfield. The other thing that we really are really counting on, we see the IOC starting to take off.

And I think with the passive scanning, they are going to be even better because we are going to be able to identify those devices which are suspects, which is something which is very important because then we have the quarantine now defined.

(00:49:45) So, these are essentially the key services and of course we're improving our VM, we're improving our Policy Compliance. And so, all in all, I think we're very happy with what we're doing.

And again, we have now 50% of our engineering ops and product management head count now, which is in India where we're continuing really attracting very good people and, as we said – as we did with 1Mobility, acquiring a few very good companies that we can integrate very well. And so, we're currently – so we're continuing doing that of course..

Great. Thanks for the color, Philippe..

Thank you. And our last question will come from the line of Patrick Colville with Arete Research. Your line is now open..

Hey. Thanks for taking my question. So, you guys peaked in the quarter on revenue.

What was the thinking behind not lifting the full year guidance at the top end?.

Yeah. So we had a great quarter and we have a very healthy outlook, Patrick. But similar to last year, it's early in the year. And so, we chose to raise the bottom end of the full-year revenue guidance in there for the midpoint and keep the top end as it is.

Also, keep in mind, we do have tougher comps in the second half so we factored that into how we wanted to maintain the guidance as well..

Got it. I think – and just on the contract duration, so you said earlier in the call that your sales guys aren't incentivized (00:51:24) longer contracts.

Did I hear that right?.

That's correct..

Okay.

And I mean, could you give us any color around the slight tick down in the gross margin, why there was a reason for that?.

Yeah. So, we continue to invest in the robustness of our platform as we're moving products into GA from beta and new products into beta. This drove higher head count expense, corporate allocations and depreciation.

We don't guide to gross margin, what we've said is, over the year, we don't expect it to be materially different than where it's been the last few years..

Okay.

And just my last question (00:52:10) on the share repurchase, can you tell me (00:52:16) the objectives of that are to neutralize the dilution on the income statements, right, is that right?.

Sorry, Patrick.

Can you repeat that?.

Sorry, the share repurchase, can you just remind me what the objectives of that are? Is it to neutralize dilution from stock-based compensation?.

Yeah. So, absolutely, when you take a step back, we are very cash generative, we're very proud of our highly profitable operational model. And strategically, we've been focusing on M&A as a use of cash in order to drive value for our shareholders.

But we think that it's likely that our acquisitions are going to continue to be tuck-ins, which then use up a lot of our cash, and we continue to generate significant amounts of cash. So we thought it made sense to offset the equity dilution that we have either from grants to employees or sometimes in M&A situations by repurchasing shares..

And we could also add that in term of SBC, we're pretty reasonable as compared to other companies..

That's correct..

Yeah. Okay. Thank you so much..

Sure..

Thanks. Thank you. And our last question will come from the line of Sterling Auty with JPMorgan. Your line is now open..

Hey. It's Ugam Kamat again for Sterling.

Just to follow up, how much is FX having an impact on increase of EPS guidance for 2018, like, your expectations for FX tailwind when you gave the guidance in February versus the expectations right now?.

Yeah. That's a great question. It actually hasn't impacted it. The increase in EPS guidance is driven really by our outperformance..

All right. Perfect. Thank you..

Thank you. This concludes our question-and-answer session for today. Ladies and gentlemen, thank you for your participation in today's conference. This does conclude our program and we may all disconnect. Everybody, have a wonderful day..