QUALYS, INC. Q3 FY2024 earnings call

• Qualys had rapid innovation in Q3, launching the GA of enterprise risk management solution (ETM), the world's first cloud-based ROC, which consolidates data from multiple partners and provides actionable insights. - Announced mROC for managed service providers and a cyber insurance partnership for discounts based on TruRisk scores. - TruLens, TruRisk Eliminate, and TotalAI capabilities went GA. - Notable customer wins included a large federal government agency displacing five existing vendors, and expansion in Australia with IRAP assessment. - TotalCloud CNAPP had a mid-six-figure upsell with a financial services company, and Qualys was recognized by Gartner in cloud native application protection. - Customer spend growth over $500k with Qualys grew 15% year-over-year to 200.

Revenues grew 8% to $153.9 million in Q3 2024. Channel contributed 47% of total revenues, up from 43% a year ago, with channel partner revenues growing 17% while direct grew 1%. Outside the U.S. revenue grew 14% vs 5% domestically. U.S. and international revenue mix was 58% and 42%, respectively. Patch Management and Cybersecurity Asset Management combined made up 15% of LTM bookings and 24% of LTM new bookings in Q3. TotalCloud CNAPP made up 4% of LTM bookings.

• Full year 2024 revenue expected to be $602.9M - $605.9M, a 9% growth, up from prior guidance. - Q4 2024 revenue expected to be $154.5M - $157.5M, 7%-9% growth. - Full year 2024 EBITDA margin mid-40s, free cash flow mid-to-high 30s. - Full year EPS expected $5.81 - $5.91, up from prior range. - Q4 EPS expected $1.28 - $1.38. - Investments in data centers pressured gross margin in Q3 by ~1% and expected similar in Q4. - Prioritize Sales & Marketing investments in Q4 to drive pipeline and expand federal vertical.

Q: Congratulations on the strong results. Sumedh, can you talk a little bit about some of the changes that you've implemented on the product marketing side, and maybe help us understand maybe what that impact could be just moving forward? It seems like your CNAPP products did quite well this quarter.

A: Yes, thank you. Great question. So, I think where we see the opportunity really is aligning overall messaging around the different modules to the messaging around business risk and risk quantification that we have been talking about, which is really helping customers sort of -- there's a lot of people talking about single grade of glass and platformization and different things and just bundling products for the sake of bundling. I think for us, as we launched the ROC, which is a big sort of announcement that we made around QSC, which is really bringing all the things that we're doing in cybersecurity together from a risk operationalization perspective. At the end of the day, how much money you spend on cybersecurity is really directly proportional to how much risk you perceive to the business, and a lot of CISOs struggle to even articulate that. So, if you don't necessarily have a good view of how much risk you have to the business, how do you decide on how much you should spend on the different areas of cybersecurity? And so, with product marketing and product management really, we have really focused in the last couple of months on realigning our messaging to the risk message instead of just individual modules and products. Of course, the journey that we have started on, but really being able to have that quantification conversation with a single risk score across all the different capabilities in the platform and bringing in third-party tools so we are not getting into the conversation of replacing existing tools. We're saying, if you have these tools that you like, you can keep those, but we can bring the data into the Qualys platform and give you that very simplistic view of essentially what is the risk so you can articulate that risk to your management, to your board, and that is resonating extremely well. So, when people are saying, I want to consolidate different tools or bring data together, it is really at the end for the purpose of understanding what does it mean to have so many different risk factors affecting a particular business entity. What does that mean in terms of how much risk do I have to the business? And so, this change in marketing, product marketing, the announcement of the ROC as well as the mROC, a lot of these things are very new in the way that we have announced them at our QSC event.

Q: I want to touch on the channel. You continue to sound pretty confident in the opportunities that are unlocking there, particularly with the new platform offerings with mROC. It's clearly shown up in the revenue numbers, but I wonder if you could just expand on the momentum you're seeing there and maybe to what extent was channel a material contributor to the pretty strong 3Q billings growth here?

A: Yes. I think at a high level, we are happy with sort of the journey we started a year, year and a half ago around really focusing more with our partners, channel partners to bring a business to us, increasing deal rates. So, we're seeing positive momentum there. And I think as we're seeing that momentum, what we are really looking forward to is embracing the strategy, which is our partner for strategy, right, for both a new business and for upsells. We're looking to say, how do we work with our partners and pivot more and more towards helping them not just bring a resale deal to us, but with the launch of the mROC, how can we enable these partners to now provide some meaningful services to the customer? For a long time, MDRs and managed SOCs have been something that they have been focusing on. But a lot of our partners now are excited that after a few years, they actually have the ability to now provide some really fresh new services in cybersecurity that are relevant to the customers, especially around providing a risk advisory service, a risk quantification service, and a technical service around ability to ingest data from multiple different tools, a prioritization, ongoing risk monitoring service around the ROC, a board reporting service so that they can have reporting that actually is meaningful to the board. And then of course, a remediation packaging service where they can actually take packages. And so, for us, we see as we work with our partners and AT&T company level blue signed up as the first mROC partner and expanding from just channel partner, just managed service providers to even cyber insurance companies that we're talking to is that partnership that can essentially help to say if you invest a certain amount in building out a risk operation center, that can give you benefit with lower risk scores and getting out of this like too many alert fatigue to actually focus on saying that this can actually give us a meaningful discount on our cyber insurance premium because we have set up a ROC with a TruRisk score. So, we see that a lot of things that we're doing really is about how do we embrace this partner for strategy across the board and creating products and capabilities and service that actually our partners can offer services on top of what we do and not just picking and reselling the capabilities.