Qualys Inc
NASDAQ:QLYS
If you don’t study any companies, you have the same success buying stocks as you do in a poker game if you bet without looking at your cards.
Utilize notes to systematically review your investment decisions. By reflecting on past outcomes, you can discern effective strategies and identify those that underperformed. This continuous feedback loop enables you to adapt and refine your approach, optimizing for future success.
Each note serves as a learning point, offering insights into your decision-making processes. Over time, you'll accumulate a personalized database of knowledge, enhancing your ability to make informed decisions quickly and effectively.
With a comprehensive record of your investment history at your fingertips, you can compare current opportunities against past experiences. This not only bolsters your confidence but also ensures that each decision is grounded in a well-documented rationale.
Do you really want to delete this note?
This action cannot be undone.
| 52 Week Range |
119.24
205.89
|
| Price Target |
|
We'll email you a reminder when the closing price reaches USD.
Choose the stock you wish to monitor with a price alert.
This alert will be permanently deleted.
Qualys Inc
You don't have any saved screeners yet
Good day, everyone, and welcome to Qualys Second Quarter 2018 Earnings Conference Call. This call is being recorded. At this time, all participants are in a listen-only mode. Later, we will conduct a question-and-answer session and instructions for asking a question will be given at that time.
I would now like to turn the call over to Melissa Fisher, Chief Financial Officer. Please go ahead, ma'am.
Good afternoon and welcome to Qualys's second quarter 2018 earnings call. Joining me today to discuss our results is Philippe Courtot, our Chairman and CEO.
Before we get started, I would like to remind you that our remarks today will include forward-looking statements that generally relate to future events or our future financial or operating performance. Actual results may differ materially from these statements. Factors that could cause results to differ materially are set forth in today's press release and in our filings with the SEC, including our latest Form 10-Q and 10-K. Any forward-looking statements that we make on this call are based on assumptions as of today and we undertake no obligation to update these statements as a result of new information or future events.
During this call, we will present both GAAP and non-GAAP financial measures. A reconciliation of GAAP to non-GAAP measures is included in today's earnings press release. As a reminder, the press release, prepared remarks and accompanying investor presentation with supplemental information are available on our website.
With that, I'd like to turn the call over Philippe.
Thank you, Melissa, and welcome, everyone, to our Q2 earnings call. Melissa and I are pleased to report a very good quarter that included both strong revenues and leading profitability. Melissa will go through those details in a moment. These results reflect our position as the leading cloud-based security and compliance platform for securing the digital transformation and helping to build a safer world, one app at a time.
We believe we are now uniquely positioned to enable customers to consolidate their security and compliance stack, drastically reduce their spend. In addition, our true platform approach allows them to have a single pane of glass view across on-premise assets, endpoints, clouds, and early next year, mobile environments.
As we continue delivering additional best of breed detection and response capabilities through our Qualys Cloud Platform, we believe that the savings our customers enjoy will compound. Furthermore, we are now well on our way to providing CIOs a continuous and updated view of their global IT assets – and I will speak of that a bit later – with two-way synchronization with our CMDBs. Such capability is, in fact, the cornerstone of security, as there is no security without visibility.
In Q2, we continued to innovate and deliver on our product roadmap. We release our Container Security App into GA. This new cloud app enables customers to build continuous security into their global container deployments and DevOp processes at any scale, and integrate the results into one unified view of their global hybrid IT security and compliance posture, breaking down silos and lowering ownership cost.
We announced a new groundbreaking app for global IT asset inventory and CMDB synchronization I just spoke about. The Asset Inventory Cloud App uniquely provides a single source of truth for all IT assets within hybrid environments, including on-premise assets, endpoints, cloud, and early next year, as mentioned earlier, mobile environments. We believe the solution is significant because it solved one of the most vexing issues for IT and is critical for security as you cannot secure what you do not know. This new service is now in beta and we expect it will go GA before year end.
We added new out-of-the-box Security Assessment Questionnaires capabilities to streamline GDPR compliance, and we bought a minority stake in 42Crunch as our first venture investment and signed a distribution agreement with them. 42Crunch has developed an API security platform enabling organizations to quickly deliver applications built on secure APIs. Similar to Qualys, their solution enables customers to build security in.
We also held our first Qualys Security Conference customer event, as well as an online Analyst and Investor Day event, which were great successes. We showcased how the Qualys Cloud Platform is uniquely able to collect and analyze data from millions of different sensors enabling the five key tenets of security today: visibility, accuracy, scale, immediacy, and what we call transparent orchestration. We also provided in-depth technical sessions covering our later solution, including Container Security, which is now in the GA; digital certificates management and IT Asset Inventory and CMDB synchronization.
We see strong demand for our solution from the federal market as we increased our go-to-market capabilities this quarter in the federal vertical as follows. We announced an expanded partnership with Carahsoft to market, sell and distribute the FedRAMP-authorized Qualys Gov Platform to federal agencies as well as state and local governments, and appointed Anna Wheeler, formerly at Akamai, as VP of Public Sector Solutions.
While looking forward to our federal CIO/CISO interchange in the fall, as we believe we are uniquely positioned to meet the ever-growing security and compliance requirements of the federal government. With our expanded internal team, we have mutually agreed with Second Front Systems to maintain our business partnership rather than pursue an acquisition at this time.
Additionally, we continue to leverage the Qualys Cloud Platform to broaden market awareness and generate demand as we have done successfully with the launch of CertView and CloudView. We have seen great response to the release of CloudView and CertView, a successful lead generation effort, which serves to distribute our Qualys platform to more users from which we can sell many additional solutions. We have had over 6,500 activations, out of which, over 700 are active users already.
Additionally, our Qualys Community Edition, a free version of our Cloud Platform to provide organization, including SMBs, consultants and MSPs with a unified view of IT, security and compliance, was released for general availability today. We're excited about our roadmap and we continue to find innovative companies, which we can acquire to accelerate our time to market.
In summary, we're enthused about our leadership position as our platform, which uniquely again provides full visibility across on-premise assets, endpoints, cloud, and soon, mobile environment, enables the company to consolidate the stack, considerably reduce their spend and build security into their digital transformation initiatives.
So before I turn the call over to Melissa to discuss our financial results, I would like to welcome Jason Reeds (sic) [Ream] to our board of directors. Jason is the CFO of Miratech (sic) [Mitratech] Holdings. Prior to that position, he was the CFO of Relativity, and prior to that, the CFO of SolarWinds. As we continue to grow our SME/SMB business, we expect to leverage his experience at SolarWinds, which built a leadership position in the IT management software market by using a cost-efficient go-to market model, leveraging powerful, easy-to-use products, similar to those that Qualys provides in the security software market.
I would also like to thank both Don Dixon and Amer Deeba who are departing Qualys after 17 years of service. Don joined the Qualys Board as a Lead Independent Director in 2001 because he shared our vision of a cloud-based platform for security. Around the same time, Amer joined Qualys and leveraged our platform strength to build the Qualys brand, most recently serving as Chief Commercial Officer.
Thanks, Philippe, and good afternoon. Before I start, I'd like to note that except for revenue, all financial figures are non-GAAP, unless stated otherwise.
As Philippe mentioned, we continue to see strong demand for our expanding set of applications, reflected in the following financial and operational highlights. Revenues for the second quarter of 2018 were $68.2 million, which represents 23% growth over the same quarter last year. The percentage of enterprise customers with three or more Qualys solutions rose to 37% this quarter, up from 28% a year ago. The percentage of enterprise customers with four or more Qualys solutions rose to 19% this quarter, up from 11% a year ago.
Average deal size continued to increase in Q2, growing 16% year-over-year. 8.1 million Cloud Agents were purchased over the last 12 months. We saw good growth from both Cloud Agent and Threat Protection bookings. New products released since 2015 contributed approximately 15% of total bookings in the quarter, up from 9% in Q2 2017, and we have a strong current deferred revenue balance of $151.4 million as of June 30, 2018, 21% greater than our balance as of June 30, 2017.
Our scalable model continues to drive industry-leading margins and significant cash flow as reflected in our adjusted EBITDA for the second quarter of 2018 of $26.7 million, representing a 39% margin, as compared to 37% for the same quarter last year. For comparability purposes, Q2 adjusted EBITDA margin would still be 39%, adjusted for the impact of ASC 606, specifically the amortization of commissions. Operating cash flow for the second quarter of 2018 increased by 47% year-over-year to $24.2 million, and we now have over 1,000 employees, with over 500 of them based in India.
This quarter, we accelerated our investments in enhancing shareholder value by spending $7.3 million on capital expenditures, including principal payments under capital lease obligations, $5.9 million in aggregate on 1Mobility and 42Crunch, and $17.9 million on the repurchase of 235,539 shares. We have $80.6 million remaining in our share repurchase authorization.
Driven by our great results, our momentum in the marketplace and our scalable operational model, we are raising fiscal year 2018 revenue guidance to a range of $278 million to $279.2 million. We are also raising fiscal year 2018 non-GAAP EPS guidance to a range of $1.46 to $1.50, and we expect capital expenditures in the second half of 2018 to be front-loaded. For the third quarter, we expect capital expenditures to be in the range of $9.5 million to $10.5 million. And for the full year, we expect to be around the high end of our prior guidance of $28 million.
We were delighted to share with you our vision, strategy, product road map and financial outlook at our online Analyst and Investor event in June, and we are looking forward to hosting you at our User Conference, November 14 and 15.
In conclusion, we believe that with the continuous platform enhancement, its increased adoption and our scalable operational model, we can continue to grow our revenues and boast top-tier margins.
With that, Philippe and I would be happy to answer any of your questions.
Thank you. And our first question comes from the line of Howard Smith of First Analyst (sic) [Analysis]. Your line is open.
Yes, thank you. Congratulations on the quarter. Philippe, I want to clarify something in your prepared remarks where you talk about the 6,500 activations and 700 are active users already. Can you just explain kind of activations versus active users and how it kind of progresses? And I may have a follow-up.
So as you know, like with all these kind of new service when you bring them to market, you have a lot of people who join and then some people forgot. And so, of course, we are putting all the methodology behind to try to remind people that activating is not enough, they need to use it. So it takes some time. But today, through this 6,500, we have effectively connected with 700 of those customers which are becoming heavy users and also starting to discuss with them about upsells.
So they are really qualified, if you prefer, at least at this time. So if you look at the traditional metrics, you saw pretty good success. And I'm sure, as we continue connecting with the other ones, which have not activated – have not really used it for various reason, to try to get additional of these customers becoming more active and, as a result of that, enjoying the benefits of our very unique cloud platform.
Okay. So it sounds like it's meeting your expectations as kind of lead gen. And is that both for new customers that you can then sell the other products as well as kind of upselling the existing customers to the full paid version, et cetera? Is it working both ways kind of...
Exactly, exactly. It's both. Absolutely. And for our existing customers, it's a godsend because it validates for them, as we can see, the fact that they already have deployed the Qualys platform. There is more goodies coming to them. And then, of course, we can discuss with them about upselling these complementary services that goes with them.
Great. Well, I thank you. And congratulations again.
Thank you very much.
Thank you. Our next question comes from the line of Alex Henderson of Needham. Your line is open.
Hi, good afternoon. This is Dan Park on for Alex. Thanks for taking my question. So I know during the Analyst Day, you highlighted you only had about 1% penetration into the federal market. With the successful launch of the Gov Platform and the recently announced expanded partnership with Carahsoft, how big do you think this opportunity could be?
At this point, this opportunity is significant. If you look today, roughly, we're only at 1%. Your typical security company typically has about 20% of their business in federal. Some go to up to 40%, which I think is a little bit too much because then you depend on kind of very unique customers. But I think , today, we're already shooting to go ahead and get 20% of our revenue.
Now, the question is time. We have also established – so of course, now with Carahsoft, particular which has a formidable distribution capabilities in government, we are now also bidding big contracts. We have expanded our team, we'll continue expanding our team. We have today very, very unique and very happy customers who have one of these agencies that you could not really name, which is now, A, fully disconnected version of our cloud platform.
We have another very big integrator, which is another private cloud platform as well. As you know, we have FedRAMP-authorized which is [Technical Difficulty] (16:33). And we are now also getting to do FedRAMP High. And the other thing which we're doing in federal, which is going to be also very significant is that our cloud platform now is ready to be fully hosted in Amazon.gov and all these other cloud providers for the government as well. So that, obviously, will give us many opportunity to bid on contracts.
As clearly, federal is moving to cloud solution. Of course, we are not sure – additional cloud solution need of course to follow their specific certification. But I think we're well on our way and capable of doing that. So, FedRAMP High is going to be some – significant for us as well in the near future.
Okay. Perfect. Thank you very much.
Thank you. Our next question comes from the line of Robert Breza of Northland Capital. Your line is open.
Hi, thanks for taking my question. Congratulations on the quarter. Melissa, maybe as you've spoken, or maybe you or Philippe spoken, in the prepared remarks about the portion of people that are in India. Can you talk to us about how you see the margins trending maybe over the medium to longer term and what's that leverage base you have there and how you're capitalizing on it? Thanks.
So maybe before Melissa give you some more specific detail, let me remind what that team in India is. So, it is something very unique many years ago when we decided to re-architect our platform, so we could essentially integrate more and more and develop our ourselves best-of-breed solution. So, we made a big investment in India. So under our Chief Product Officer, Sumedh, we have put ops, DevOps, customer support, engineering, QA, customer support and product management. And we literally cloned the structure in India where we have today 500 people, and that's essentially what we do. We have attracted significant talent. There is a huge pool of talent. In fact, we have plans to continuing significantly increasing our headcounts in India so we can continue developing and supporting products as we are developing more and more applications. So of course, Melissa could speak about the economics, but the first priority was to find talent. The number one challenge today that every company has is to attract talent. And today, we have really find the formula, we're very happy with that. We have a fantastic team.
And also, the second thing that India does for us, we have a quite successfully two companies, which were Nevis Networks that you see today, which is essentially the technology which is behind our global IT Asset Inventory, our quarantine, and the integration, as you can see, is almost now done since we went into GA. So, we are moving to beta, so we are moving into GA now very soon.
And then, the other one is 1Mobility, where we expect to go beta in the early part of next year. And we're also now looking at these other companies, like the small companies 20, 25 people, who have significant technology that they have built, are coming to us because they see a very good home, where their technology can thrive. And currently, our discussion with two of them, it's premature to make any announcement at this stage, but we feel very active and the economics are quite significant because instead of paying hundreds of millions for similar technology that if we would have to do that in the U.S., we are down to few millions.
And so, with that, Melissa can give you a little bit more colors on the statistics that you were asking for.
Yeah. So Rob, thanks. I'm going to answer it first in the near term and then answer the longer term question. So, we had a great first half in terms of both revenues and profitability and we're proud of our industry-leading margins. We do plan to continue to invest, though, given the growth opportunities we have ahead of us. And since our second half revenue comps are tougher, we do expect second half operating margins to be down from the first half, resulting in flat margins for the year.
Over the longer term, what we presented at our Analyst and Investor Day was our 2021 outlook for low-20 to mid-20s revenue growth, and an expectation of EBITDA margins between 40% and 42% and free cash flow margins of between 35% and 40%. And as we mentioned, not only we're getting significant leverage from India from a cost perspective, it's a comp perspective which allows us to accelerate our ability to go to market with new solutions.
Great. Congratulations.
Great. Thank you.
Thank you very much.
Thank you. Our next question comes from the line of Melissa Franchi of Morgan Stanley. Your line is open.
Okay. Thanks for taking my question. Philippe, I'm wondering if you could just talk about what you're seeing in terms of pricing on the core VM product. And then, if you could maybe just talk a little bit about what you see in terms of contract value when a customer adopts the Cloud Agent versus maybe just like a traditional VM customer?
So, I don't know if we have made this kind of calculation specifically, but Melissa can give you a bit more color after specifically. As far as the price of the core VM, we don't see much really pressure. It's more, sometimes, the competition in order to try to displace us or try to win a deal. They are going to, of course, to drop the price. But as you know, our competition is not really profitable. And so – and the fact that we are now, as you have seen in the numbers that Melissa told, that we have more and more for our customers, which are adopting three and four more solution, it makes us significantly more sticky.
In addition, these free services that we are also delivering, it's make them also very sticky, and of course, I think we are, from a price standpoint, we are protected. We saw Rapid7 many – quite a few years ago being very aggressive against us and they were not successful. So, I think we believe we can maintain our price fundamentally. And we are very cost effective because we eliminate significant costs. It's easy to deploy Qualys, don't have all that overhead that other solutions have. And so, I think we feel very, very solid regarding our pricing.
Yeah. So I'll add a few data points, Melissa, to help you think about it. So in general, with the Cloud Agent, if you were paying, let's say, $1 for VM, we would pay $1.20 for the Cloud Agent VM. Remember, as we've discussed with the way our customers buy, they often – they're expanding into a new solution. They will start small and expand over time. So as we've talked about anecdotally, our customers have not fully deployed Cloud Agent where they have deployed Vulnerability Management, the exception being, and we talked about this last quarter, we're starting to see customers wanted to play in the endpoint. For that, they need the Cloud Agent, and so, they will go straight to a large Cloud Agent VM deployment in that case.
Yeah. And I could add one more thing on that subject. I mentioned that in the last earning call that we have one large company who deployed 250,000 endpoints – agent for their endpoints essentially to do VM and Policy Compliance. That company is now already looking very seriously at the IOCs. So, that's another. Of course, remember, our agent enables multiple stream of additional services. And I'm really happy to let you know that we have another similar, in fact, company now deploying another about 200,000 agents again. And again looking at VM first and Policy Compliance and now starting to evaluate our IOC solutions. And so, that we see a gain. It's just maybe a slow progression but it's pretty solid, sustainable, and we see our – now our agent going to the endpoint, and of course, it goes into the cloud. The fantastic integration we have done with Microsoft and now with Google and with all of the cloud providers, our agent are the right architecture for the cloud. There's no question about that as well.
Great. Well, thank you for the color.
Thank you.
Sure.
Thank you. Our next question comes from the line of Erik Suppiger of JMP. Your line is open.
Yeah. Thanks for taking the question. I got a few here. One, I think you had said the new services were about 15% of revenue. It's been at that level for a little bit. Do you think that contribution from the new services could start to pick up or what are your expectations as you look out over the next year?
Secondly, did you give the number of cloud agents that activated in the quarter? And then, I have a follow-up for Melissa, but I'll take those two first.
Yeah. Thanks, Erik. So in reality, our newer solutions are doing very well. In fact, our bookings for that group grew over 100% year-over-year. And the way to think about it is, as I mentioned previously on the discussion with Melissa, is that our customers tend to start small and expand over time, which is a source of profitable growth for us, and you see that in the penetration metrics.
So, Cloud Agent penetration went to 14% of our customer base this quarter from 12% last quarter, and in the multi-product adoption metrics that I covered, such as enterprise customers with three or more solutions going to 37% this quarter from 34%, last quarter. And as Philippe mentioned, this makes us even more sticky with our customers.
Okay. So, it sounds...
Also...
It sounds like that will start to move up as we look forward as those penetration rates continue to improve. Is that...
Yes, of course, it will. But let me make another point, Erik, is that the fact that our base is increasing so that even though you see the 15%, it's a 15% on an increasing base. So already there, you have a kind of a very nice pick up, and of course, as the customers deploy more, then of course, you should start – you will see some acceleration.
Again, everything in Qualys, you have to realize we don't push our customers to do deal which are going to end up into, like in many other, end up into shelfware. You pay for what you use and our customers have the tendency to start smaller and then deploy over time, not all of them but the immense majority of them.
So we're very happy because they like the service and it's all – and then it becomes very cost effective because as you know, it's much easier to set additional services to existing customers and much more cost effective than to try to, of course, get additional customers.
And unlike other companies, we don't incent ourselves first by products, so we let it come naturally, as Philippe was describing, so that our customers – we have natural high renewal rates as a result, of course, to just shoving in a shelf.
Yeah. Absolutely. And this is the core of all profitability is on one hand, the platform which allows us to develop quite efficiently services that you can mention that we did essentially what Evident.io has, with six engineers in India. And then, once they are on the platform, the distribution is instant and very cost effective. And then, of course, on the search side and the support side, it's significantly more easier to support and to – a solution that where everything is centrally managed and self-updating and that where customer can try and then buy. So it's a very efficient model that we've built over time, very, very consciously. And that's why we have this margin that nobody can believe that we have essentially.
Okay.
And so, on the Cloud Agent question, we provided that we have – we sold 8.1 million over the last 12 months. So that's the base from which we can upsell a number of our other solutions that rely on the Cloud Agent. From a technology perspective, that's a subscription base to think about.
Okay. And then, in your guidance, based on our calculations, it looks like OpEx goes up notably. In the fourth quarter, margin comes down a little bit. Is there any reason why your December quarter OpEx would bump off? And is that something that would remain at those levels or is there anything that would change after that?
Yeah. So as I said earlier, we do expect second half operating margins to be down from the first half as we continue to invest in the business. It's a number of areas. It's more senior-level hires in sales and marketing we're planning on adding. We're doing implementation of systems in G&A, such as we're putting in Workday this year, as well as an FP&A tool. We also have in Q4 our User Conference, which is significant amount spend. That's also in sales and marketing. So there is a bit of seasonality in some of the spend in sales and marketing, for example, but it's also continued hires and R&D to get products into beta and from beta into GA.
Very good. Thank you very much.
You're welcome.
Thank you. And our next question comes from the line of Rob Owens of KeyBanc Capital Markets. Your line is open.
Thanks and good afternoon, guys.
Good afternoon.
As you talked about your longer term model and acceleration in revenue, if I look at the first half of this year, your billings, whether we look at kind of the total billings or even the quarterly billings, it's growing at a slower rate than revenue. So couple of questions. Melissa, what's the ASC 606 in there? Because I'm sure that held down that recognized or realized Q1 billings. And then, number two, does that come through acceleration to achieve that higher growth rate or is there something that's more in period, like from MSSP or something, that would help you get there? Thanks.
Yeah. So on ASC 606, there's actually no impact to our top line. It's really just the amortization of commissions. I think with regards to the billings question, look, we were delighted that our current billings exceeded consensus. Our current billings was $71.9 million this quarter. But as we've consistently said, that billings growth is not a proxy for annualized bookings growth on a quarterly basis, because it's impacted by factors such as the timing of invoicing, the duration of the current deferred revenue and FX. So we've consistently said that we believe that trajectory of our annual revenue guidance is the best proxy for business momentum because certainly current bookings inform that guidance.
Yeah. In addition, the total billings are absolutely not representing at all of our business because we do not incentivize. We do three-year deals and we got quite a few of those, but these three-year deal with annual payment. And, of course, we do some three-year deal with everything paid up front. But we do not encourage our sales forces or we don't commission them to bring these deals. It's more the customers coming to us. So this is very irregular. Why would we go and try to give additional discounts when we have so much cash, at the end of the day. So that's not a good business decision. And that's why the total deferred revenues of the billings are not really representative at all of our business.
And maybe, Melissa, you want to add something on that?
Yeah. Well, two things. So as Philippe was saying, total billings distorts your ability to compare companies based on an annualized bookings or annualized recurring revenue metric, since it's based on total deferred revenue which includes your non-current portion, which is based on prepaid multi-year deals. And since often prepaid deals come at a discount to the cash, we have no need to do that.
I think with regards to the other part of your question, Rob, we do expect to see our ability to increase our revenue growth. The outlook we have given for 2021 at the Analyst and Investor Day of low to mid-20s is based on our ability to continue to sell more into our existing customers, which we can more easily do as we have additional solutions come out, but also to bring our new customers as, again, we have many different solutions to attract them to our platform with.
Great. And then, you mentioned how you have high renewal rates. What are those renewal rates at this point, I guess, both from a gross and a net basis? And with the addition of all these new products, what are you seeing with that trend line of net renewal rates? Thanks.
Yeah. So we provided at our Analyst and Investors event our updated dollar net expansion rates, which we – that's what we focus on, and it's been increasing nicely over the year. So it's 109% in the last quarter over the LTM period, about 106% the year before.
Yeah. And another point you may want is that we have today a business that we have segmented very well in the sense that we have the enterprise, the SME and the SMB. And associated with these markets, we have also, if you prefer, done a product segmentation, where we have Qualys Enterprise, Qualys Express and Qualys Express Lite. And, of course, the renewal rates in the SME/SMB, especially on the SMB, are certainly not as high, obviously, than in the enterprise.
So when you look at that number, this is an aggregate number and which means you could see our enterprise business is even healthier than that. But we do not disclose essentially the mix at this stage. At some point in time, I think we really are now gearing up now that we have all these new services and these free go-to-market services, we're really going to focus on the essentially as well on the SME/SMB to try to accelerate our growth there because we see unique opportunity.
Sounds good. Thanks for your answers.
Sure.
Thank you. Our next question comes from the line of Sterling Auty of JPMorgan. Your line is open.
Yeah. Thanks. Hi, guys.
Hi.
On the fed initiatives that you have going through partners, et cetera, is there incremental infrastructure spend that's going to be necessary to support, especially when we think about the DoD side of the government?
Not really. Not per se on the subscription, et cetera. And what we typically have is that you need essentially, of course, to do FedRAMP High, for example, that would be – it's a big effort. So, you have initial cost. But when you look in overall perspective, of course, when we provide, for example, a disconnected platform, we charge more for that platform than we charge for a platform where Qualys automatically – remotely manage everything. So all in all, the answer to your question is not significant.
And also, we leverage a lot of integrators as well. So as you know, we don't have professional services. We don't do professional services. Everything that we do is subscription-based, 100%. So, we don't have this additional cost, of course, to carry.
Got it. Got it. And then, Melissa, I missed it if you said it in the prepared remarks, but what was the FX impact on the topline and on expenses in the quarter?
Yeah. So it impacted our revenues by about – it was a positive impact of about 100 basis points to our growth rate. It was less than $0.01 to EPS, a couple of hundred thousand dollars online.
Got it. Thank you.
Thank you. And our next question comes from the line of Anne Meisner of Susquehanna Financial. Your line is open. Anne, your line is open. You may be on mute.
Sorry. Can you hear me now?
Yes.
Yeah. Yeah, we can, Anne.
Oh, great. Hi. Thanks for taking the question. So, the question is for Philippe. I was hoping to get an update on the patch management solution, which, I believe, is targeted for the second half. As you prepared to launch that capability, how are you looking at the go-to-market strategy there with respect to the buyer and the organization that you're targeting? Are you going to be targeting the same security team that focuses on Vulnerability Management, basically for the set of patches they're allowed to push out themselves or do you think that would be a product that's used by kind of a broader IT organization?
So, I think we need to distinguish here the SMB versus the enterprise. So, what we believe with the patch management, which effectively is going to go to market at the end of this year. As you may remember, we delayed it because we put priority on the passive scanning, et cetera. So, we're realigning a bit our engineering resources. We always have seen the patch management as a kind of a no-brainer for the SME/SMB because for them, everything becomes integrated, their networks are small, so we see – we have always seen a great interest in that market.
On the enterprise, it's a little bit more complicated because they all have their own patch management solutions. The problem that the enterprise as today is immediacy of patching. So, we're looking at our solution today not necessarily as a replacement of their existing infrastructure, but being there for immediacy. Because if you look, for example, at vulnerabilities at WannaCry, you certainly have to patch across multiple environments, Unix and this and Microsoft. And today the current patching solution on the enterprise are pretty, pretty tedious.
So, we think that we are going to enter through that use case in the enterprise through the immediacy when you've got to patch quickly. And of course, we would integrate also with some of the services. But we see the immediate take essentially on the SME/SMB because that's a no-brainer for them. It's all integrated, you push a button and you're done. And the cost, of course, is not that significant either and you don't have that many systems to patch as well.
Okay. Perfect. That's helpful. Thank you very much.
Thank you. Our next question comes from the line of Gur Talpaz of Stifel. Your line is open.
Great. Thanks. And a follow-up to that question, Philippe, maybe give us an update here on the Passive Network Discovery product you plan to launch this year, and I think maybe taking that one step further, how important do you think Passive Network Discovery ultimately is for full IT Asset Inventory?
This is absolutely strategic. I think this is something that we're very proud, that we're so happy that it's coming. I've been patient, if you may, to get that done. I'm so happy that is on beta. In fact, Sumedh gave to one of the large customers a demo – real live demo about what was that about a week ago. I was, myself, personally floored. I could not believe the degree of integration that we have done. So fundamentally, to answer your question more specifically, is that the passive scanning does a few things. First of all, on the discovery of your network discovery, the scanning technology that we have mastered is really not good for the Asset Inventory, just give you a kind of a discovery, you can see what's going on but you don't have much visibility.
Conversely, the agent technology we have also mastered, give you full visibility of the assets, whatever – what they are, what's on this asset, what has changed. The problem is that, of course, if you want to do your global IT Asset Inventory and you have, like most company, no clue about what you have, you get it with an agent. You have to know first. So, that's where the passive scanning comes in. The passive scanning listened now to the traffic and we detect any devices that connects. We have done a huge effort at fingerprinting large area of devices. We're adding also on the top of that the itime (41:32) capabilities.
So now, certainly, we can identify those assets that comes in with great precision, thanks to the passive scanning. And now the question becomes do you want to have that device being managed, yes or no? Should that device have an agent or should we use authenticated scan or whatever other techniques, and then, of course, we continuously monitor that and I'll synchronize.
In order to do that, that's a very important point that I'm making, you need a back end, which is absolutely significant robust today, not only an elastic search which, of course, allows you to essentially categorize, identify all these assets pretty quickly because you cannot use an Oracle database to do that. It will take you forever. So today, we have index on our elastic search clusters, 250 billion data points. We could do twice as much. Also, you want to have all that information that we collect also coming from different sources communicating very well. So on our Kafka back end now, we have scaled that back end to 9 billion events a day, I mean, significant. So, we have the muscle, the engineering, everything behind.
Now, to finish the passive scanning also, we have a lot of other interesting use case as with our IOCs, like suddenly, we could identify not only just compromised device but suspicious devices and we'll eliminate the suspicion by listening to what's coming in and out of that device that we are deemed suspicious because we have classified all these – the matter where in two families, instead of just looking for precise hash or match, we can now look for what we call a family match.
Other a very significant usage of the passive scanning is on the IoT. Because again, the IoT devices, it's very difficult to put an agent, although Qualys is coming with an SDK, so IoT vendors are going to be capable of building their own agent. But then, you also want to listen to the device because it's et cetera. So then, it's all about fingerprinting all these devices, which we're doing. We have a big team in India now doing nothing but fingerprinting. We are fingerprinting all the devices, as we speak, of a large manufacturer car company in Europe. So if you prefer that passive scanning is also a foundation for our forthcoming IoT solution, we have the backend, we have the platform, so we need of course a detection, and the passive scanning is very strategic for that.
So, this is significant and that the scale at which we do, and no competitors of ours had that totally integrated in the platform. So, some competitors have the passive scanning since quite a while, but it's another application. It's not at all integrated with a platform. And that integration is not a walk in the park, I can tell you, because of the scale at which you need to really apply that technology.
Yeah. That's really helpful color. Thank you. And Melissa, can I ask you one question here?
Yeah.
If we look at the sort of the billings makeup here, the deferred makeup, there's a clear trend towards current mix in terms of relative makeup. Have you seen durations kind of shortened here over the past few quarters trending towards one year?
Yeah. So, I would say a couple of things. First of all, because as we discussed earlier, we don't intend ourselves first to go after prepaid multi-year deals. You have seen our non-current declining. So as a result, you're seeing – from a growth perspective, you're seeing it in the current deferred revenue. And again, that's really how we manage our business. So, I know I'm going to sound like a broken record, but we really do think, if you're going to compare companies, you need to look at annualized metrics, and for us, an annualized metric is going to be based on our current deferred revenue, not total. And I suspect that's true for many companies because they're all going to have their non-current portions of their longer term multi-year deals and they're non-current.
Yeah. And let me give you another color here. For example, when we have a customer who has cash and wants to do a three-year prepaid. So they come to us and they say we'd like to have a discount for that. So we say, really? And so, we can say no. And some people say okay or you don't give me enough, more of the typical scenario, then in that case, they go back to the three-year, which is annual payment. It's all still up front, which is good for the cash, but we don't get of course. And so, they have the price protection for three years, which is good for them. And for us, I don't have to discount. So that's the reason why we don't want to incentivize.
We see, by the way, today, because of all the solution that we have, we are starting to see some large companies saying, we will have to acquire all of your apps and without counting. So again, we're very careful. We are not going to go and discount every day to get a bigger deal. And then, of course, so we have that patience, which I think comes from the model itself.
So prepaid, we have now some demands for monthly billings, which are also to avoid that because this is more invoices that we've got to manage. That comes more from our MSSP partners. And then, we have the tendency then to do with them some kind of quarterly payments more so they could aggregate there, instead of having us sending a lot of invoice.
Yeah. And just to go a little bit deeper, Gur, there is an impact – the other thing that will have an impact on your year-over-year growth is the duration of your current deferred revenue. And so, over the last, I would say, last few quarters relative to the year before, maybe slightly shorter, but that's right generally. There's a number of factors that impact the year-over-year growth rate of billings that are not impacting our year-over-year growth rate of bookings. So it's really not on a quarterly basis a great proxy, but...
Just one – yeah.
...if you are, just going to use something current is better than total.
And just for your sales force, do you incent on ACV. Is that how you kind of doing things?
Right.
Yeah.
That's exactly right.
Yeah. So the sales forces incentivized different, but it's 100% ACV. And essentially, we have, of course, the new business team which is essentially sold on the new business. And our renewal teams or farmers are incentivizing both the renewal as well as the upsell.
And I think from your perspective, right, I mean, you want to – you're not going to value a company that sells three-year contracts, has a few dollars in their total deferred, that's a three-year contract versus one year for us. Over three years, it's going to represent the same amount. Perhaps, we're just going to get it collected each year, the $1, and they've gotten it up front.
Yeah. Another thing also which is interesting is that (48:36) tell you how strict we are with our model. We have some companies who absolutely want CapEx. So, of course, they want CapEx because that's what they need. So what we do is essentially we create a sort of a CapEx solution. However, we only take the revenues as we deliver the service. So we don't mix any kind of sort of CapEx perpetual license. Everything that we do is 100% subscription-based and we take the revenue as we deliver to the service.
That's all. That's very helpful. Thanks for the deep color there. I appreciate it.
Okay. Thanks, Gur.
Thank you. And our last question comes from the line of Alex Henderson of Needham. Your line is open.
Thank you very much. I was looking at the – for the first time in the 30 years I've been doing this – the value of the rupee versus the dollar and I see it's down 7.6% since the beginning of the year. Assuming rates are rising here and flat there, we probably see some more improvement in the back half, although obviously you don't want to forecast currency. But given almost a 10% benefit from the exchange rate versus the Indian currency, one, what are you doing in terms of hedging against that? And, two, if we stay at that level through year end, how do you expect to take that benefit? Will it be through additional investment in R&D resources or will it be something that you use to roll through the margins? How would you approach it?
Yeah. So today, I mean, we have a very big plan to expand our head count big time, and we have the machine. So I think all the benefits, it goes right back. If you look today, one of the ways is that if you look at the differential between the engineering, in engineering you have a factor of 10. And so, obviously, we can house significantly more people, and that give us a very unique muscle out there, and we've really mastered that relationship between our Indian subsidiary and Qualys. We now hire some people which have been with Qualys. They come here.
So we have really done a – Sumedh, in fact, this is really the credit has to be given to both Sumedh, our Chief Product Officer; and Rima, our HR, our Head of Human Resources, Rima. And they both spent quite some time in India. And myself, by the way, I go a minimum of one time a year to India because I want to absolutely show to them how much we value them. It's a huge source of talent, which is absolutely incredible.
And Pune turned out to be the best place because they have absolutely very strong universities, technical universities. There is a huge pool of talent in Pune, not speaking of the square footage. We are now further expanding our buildings, our campus that we sit now in India. So the difference is $1.5 a square foot versus $50 here in the Silicon Valley. It's a huge difference, huge difference.
Yeah. And just to add onto what Philippe said, obviously, the business plans for expansion there, it's for the business; it's not actually because of what's happening with the exchange rate, finances inside the business.
No, it's a good godsend. I mean, it's...
Right.
So the question was to what extent will you reinvest it or would you prefer to push it through margins?
Alex, so far, we have invest, yeah, big time. I mean, there is so huge opportunity. We are going to acquire few companies at some point in time, and that's another 20, 25 people that comes in we totally integrate with our solutions. We are even now looking at other location in India. India is becoming also a very big market for us. We're starting to do a lot of good job there as well. Remember, all the Indian outsourcers are Qualys customers and Qualys partners. So, having a strong presence in India is very important. You see also a lot of large companies have their IT in India now. So, we're extremely well-positioned.
Yeah. The one thing I'd just add on is remember, Alex, it's (53:04) of the cost differential. It's still not a meaningful portion of our expenses. The total dollars we spend there are (53:12).
Great. Thank you.
Yeah.
Thank you. And at this time, there are no further questions. I'd like to turn the conference back over to Ms. Melissa Fischer for any closing remarks.
Thank you, Amanda, and thank you all for attending our second quarter 2018 earnings call. We look forward to seeing many of you in a few weeks at the KeyBanc Technology Leadership Forum in Vail and at Citi's 2018 Global Technology Conference in New York in September.
Okay. Thank you.
Ladies and gentlemen, thank you for your participation in today's conference. This does conclude the program. You may now disconnect. Everyone, have a great day.