Qualys Inc
NASDAQ:QLYS
If you don’t study any companies, you have the same success buying stocks as you do in a poker game if you bet without looking at your cards.
Utilize notes to systematically review your investment decisions. By reflecting on past outcomes, you can discern effective strategies and identify those that underperformed. This continuous feedback loop enables you to adapt and refine your approach, optimizing for future success.
Each note serves as a learning point, offering insights into your decision-making processes. Over time, you'll accumulate a personalized database of knowledge, enhancing your ability to make informed decisions quickly and effectively.
With a comprehensive record of your investment history at your fingertips, you can compare current opportunities against past experiences. This not only bolsters your confidence but also ensures that each decision is grounded in a well-documented rationale.
Do you really want to delete this note?
This action cannot be undone.
| 52 Week Range |
119.24
205.89
|
| Price Target |
|
We'll email you a reminder when the closing price reaches USD.
Choose the stock you wish to monitor with a price alert.
This alert will be permanently deleted.
Qualys Inc
You don't have any saved screeners yet
Good day, everyone, and welcome to the Qualys Second Quarter 2019 Earnings Conference Call. This call is being recorded. At this time, all participants are in a listen-only mode. Later, we will conduct a question-and-answer session and instructions for asking a question will be given at that time.
I would now like to turn the call over to Vinayak Rao, Vice President, Corporate Development and Investor Relations. Please go ahead, sir.
Good afternoon and welcome to Qualys’ second quarter 2019 earnings call. Joining me today to discuss our results are Philippe Courtot, our Chairman and CEO, and Melissa Fisher, our CFO.
Before we get started, I would like to remind you that our remarks today will include forward-looking statements that generally relate to future events or our future financial or operating performance. Actual results may differ materially from these statements.
Factors that could cause results to differ materially are set forth in today's press release and in our filings with the SEC, including our latest Form 10-Q and 10-K. Any forward-looking statements that we make on this call are based on assumptions as of today and we undertake no obligation to update these statements as a result of new information or future events.
During this call, we will present both GAAP and non-GAAP financial measures. A reconciliation of GAAP to non-GAAP measures is included in today's earnings press release.
As a reminder, the press release, prepared remarks, and an accompanying investor presentation are available on our website. Starting this quarter, we are also providing a supplemental historical financial spreadsheet for analysts and investors.
With that, I’d like to turn the call over to Philippe.
Thank you Vinnie and welcome everyone to our Q2 earnings call. Melissa and I are pleased to report another solid quarter in terms of revenue growth and profitability. We are also very pleased to report strong acceleration in our Cloud Agent subscriptions, with almost 24 million now, 23.6 million to be precise.
As we have discussed before, our Cloud Agent is the underpinning of seven security, compliance and IT solutions today; Vulnerability Management, Policy Compliance, File Integrity Monitoring, Indication of Compromise, Patch Management, Asset Inventory, and the upcoming Certificate Management and more to come.
In 2008, we were one of the first companies to file a cloud agent patent application and our innovation has been recognized by four issued patents and one pending continuation application.
The four issued patents cover agents, including low-footprint hosted agents or host-less agents, which perform full security and compliance assessments of endpoints and cumulatively include over 100 claims of varying scope.
As previously discussed, our goal is to make our Cloud Agents ubiquitous and to that effect, we announced on Monday that we will offer our Global IT Asset Discovery and Inventory App to the community as a free service, so we can all regain the visibility we lost due to the fragmented nature of IT, rapid growth of IoT, and move to the cloud.
We will be showcasing this revolutionary offering next week at Black Hat combined with a major awareness campaign. Since the announcement, we have over 800 sign-ups and received outstanding feedback from our existing customers and industry luminaries.
In fact, global IT asset inventory is one of the biggest challenges, if not the biggest, for organization and the cornerstone of security as you simply cannot effectively secure what you do not know or do not see.
With our free service, companies of all sizes can automatically build their global IT asset inventory across on-premise, endpoint, cloud, container and now, mobile environments. Including in this free offering is our Asset Discovery capabilities, namely, the passive scanning that provide instant visibility of any device that connects to the network. Such an integrated offering provides unprecedented and continuous visibility of both known and unknown assets.
As organizations download our Cloud Agent for implementing global IT asset inventory, we make it frictionless to subscribe to our paid Apps because no additional infrastructure is required. In addition to the paid solutions, I previously mentioned, customers utilizing our free Asset Inventory will have the opportunity to subscribe to additional paid features such as synchronization with their CMDB and full life cycle software inventory.
By distributing this free solution from our platform to generate meaningful demand of our paid apps, we leverage our cloud model, which is a key element of our profitable growth, driving value for both our customers and shareholders. Furthermore, this multi-product adoption naturally increases the stickiness of our platform and helps make us impenetrable by our competition, who do not offer the same breadth of solutions.
In terms of our newer solutions, we saw continued growth this quarter in customer adoption for our File integrity monitoring solution, as we have now added incident reporting, API integration, rule-based alerting and event correlation capabilities, as well as created a light version for those requiring compliance only with PCI requirements.
In Q2, for example, a large online travel agency selected our FIM solution over a competing point solution in order to effortlessly leverage the Qualys Cloud Agents they had already deployed for Vulnerability Management and Policy Compliance, and now they can have a single-pane view of vulnerabilities, configuration and file integrity.
We also have a healthy pipeline in Patch Management, which we release recently, which enables IT and SecOps teams to quickly target critical common vulnerabilities and exposures, then deploy the patches across endpoints, on-premises or cloud assets and verify remediation, all from one console.
We continued to made good progress on other global solutions this quarter including: the release of our IOC 2.0 App into general availability, which provides a quantum leap in IOC detection with new detection, investigation and response capabilities that not only identify in nearly real-time known IOCs, but also suspicious devices.
IOC 2.0 includes: enhanced attack detection using commercial file reputation threat feeds, which extend the detection of attacks often missed by anti-virus agents by integrating additional threat feeds directly into the platform.
Second, behavior-based scoring engine to prioritize response malware remediation, which factors in additional behavior attributes including file analysis, process state, and network connections to prioritize response based on how the attack is behaving in the network.
Third, a new response platform microservices allowing analysts to easily configure rules for real-time alerting and actions using the same Query Language, QQL that they already use for two-second search visibility. And finally, API integration with third-party SIEM, threat intelligence platforms, incident handling/response systems, security orchestration and automated response platforms, and IT Ticketing systems to automate rapid sharing of threat information with security and IT operational platforms. This really brings our IOC 2.0 really at the top solution to identify Indication of Compromise.
And the launch – finally the launch of our Qualys Canadian Cloud platform, the addition of this new location marks another milestone for Qualys' expanding global operations, which now includes eight locations on three continents. We continue to believe that because of our cloud-based architecture and the priority, we made to invest in the extensibility and capabilities of our platform. Qualys is one of the few companies well-positioned in the security market evolution.
As we highlighted last quarter, we see a new generation of MSSP emerging to address the security needs of small and mid-sized customers with hybrid environments. That’s why Coalfire Systems selected Qualys’ vulnerability management and continuous monitoring capabilities this quarter to integrate into their Secure Cloud Automation Services.
We invite you to Black Hat next week to see our new technologies and campaigns. We will hold a product luncheon for investors and analysts, which will showcase the technology around our IOC 2.0 as well as our future data lake solution. As we have discussed, current incident response solutions are quite complex and costly, because they require organizations to collect disparate sets of data from multiple vendors and bring it into their SIEMs with full contextual information. We believe we have a unique advantage in this large market, because we already collect, enrich, normalize and correlate trillions of data points across on-premises, cloud, and soon mobile, OT and IoT environments, and I should say, now mobile and OT and IoT environments.
We are also pleased to welcome Gerhard Eschelbeck, a renowned cybersecurity leader, to our Advisory board. Gerhard is the former Vice President of Security and Privacy Engineering at Google, and previously held CTO positions at Sophos, Webroot and Qualys. We look forward to leveraging his unique background and extensive experience as we continue to grow the Qualys Cloud Platform.
In conclusion, we are delighted to offer the community a new free prescription for security. Accelerating adoption of our Cloud Agent unlocks a significant revenue opportunity for us and more importantly, solves painful problems for our customers including not having clean uniform data for a view of their global IT asset inventory. The breadth of our solutions across environments enables us to offer customers greater visibility, accuracy, and scalability while ultimately enabling customers to drastically reduce their overall spend.
With that, I’ll turn the call over to Melissa to discuss our financial results.
Thanks, Philippe, and good afternoon. Before I start, I'd like to note that, except for revenue, all financial figures are non-GAAP and growth rates are based on comparisons to the prior year period, unless stated otherwise. We’re delighted with our Cloud Agent adoption, which lays the foundation for future revenue growth and industry-leading profitability. Evidence of our continued progress also reflected in our accelerated multi-product adoption and the growth in the number of customers with over $500,000 in revenues, as well as our strong gross for dollar retention rate, which for enterprise customers with five products is 99%.
Our Q2 financial and operational highlights include; revenues for the second quarter of 2019 grew 16% to $78.9 million; platform adoption accelerated as the percentage of enterprise customers with three or more Qualys solutions rose to 44% from 37%; and the percentage of enterprise customers with four or more Qualys solutions increased to 24% from 19%.
Cloud Agent subscriptions accelerated to 23.6 million over the last 12 months, out of which 3.5 million Cloud Agents were purchased by single Cloud Platform customers. This is up from 17.9 million for the 12 months ended in Q1 2019.
New products released since 2015 contributed approximately 25% of total bookings in the quarter, up from 15%; and our average deal size increased 3%, influenced by higher growth in the total number of customer orders.
Our scalable platform model continues to drive superior margins and generates significant cash flow. Adjusted EBITDA for the second quarter of 2019 was $33.4 million, representing a 42% margin versus 39%. Q2 EPS grew 42% and we generated strong free cash flow for the second quarter of 2019 of $31 million, and for the first half of 2019, $66.3 million, representing year-to-date growth of 25% over the first half of 2018.
In Q2, we continued to invest the cash we generated from operations back into Qualys, including $5.9 million on capital expenditures, including principal payments under capital lease obligations, and $16.2 million to repurchase 183,948 of our outstanding shares. We have approximately $91 million remaining in our share repurchase authorization.
We remain confident in our model driven by our foundation of recurring revenues and expanding suite of applications. We are maintaining the midpoint of our fiscal year 2019 revenue guidance. Our current fiscal year 2019 revenue guidance is now a range of $321 million to $322.5 million.
We are raising fiscal year 2019 non-GAAP EPS guidance from a range of $1.89 to $1.94 to a range of $2.03 to $2.07. We are also raising our fiscal year 2019 EBITDA margin expectation to be in the range of 39% to 39.5%.
And for the third quarter, we expect capital expenditures to be in the range of $5 million to $6 million. We are very excited about the acceleration of our Cloud Agents subscription, with our innovative technology demonstrated by the issuance of four patents. Looking forward, we see additional opportunity to accelerate Cloud Agent adoption with the free launch of the asset discovery and inventory app.
Our Cloud Agents make it frictionless to enable many of our paid subscriptions which provide us the opportunity to accelerate revenue growth as well as expand margins in the future. As Philippe mentioned, we look forward to seeing many of you at Black Hat for product launch in showcasing our upcoming campaigns and products.
With that, Philippe and I would be happy to answer any of your questions.
[Operator Instructions] Our first question comes from the line of Howard Smith from First Analysis. Your question please.
Yes, thank you. Congratulations on the solid results. Kind of two related questions on go to market strategy. First of all, historically, you've really kind of showed your customers the products and let them adopt to kind of one at a time.
You've increasingly been going to try and do some C-level selling and now that you have such a sweet and you're getting 5 plus adoptions. Where are you on that kind of the C-level dictating that where you can as an organization, you're going to use Qualys and where are you in terms of it, it still being almost all bottoms up product by product?
Yes, so essentially -- yes, yes, so very good question. So the fact the launch and I hope you could be at Black Hat where you're going to see the massive campaign that we are doing. So this is just the beginning of that awareness campaign that we are creating which of course at the present, you know start bottom up.
But of course, now with the Global IT Asset Inventory, we have what every CIO needs to have. And so, we are going first and we’ve already started to go to our existing customers and you're going to see the second leg in that campaign. We are wanting to have our customers speaking about value that Global IT Asset Inventory brings.
And when I say customers, from the very top and of course we are going to make that resonate and essentially engage CIOs which are not Qualys customers. And so that's of course the second foot -- or the second leg, I should say, of our campaign. So it's all starting.
Great. And then in terms of the Cloud Agent adoption, is it really they're adopting that as you promote that and then they see the applications it enables and start to increasingly contract for those, or do you feel the solutions customers are seeing those solutions and saying, now I need. That's my excuse to go back and operate to the Cloud Agent?
It depends. It depends. So what we see today is finally, the customers have been able to break through IT which didn't want another agent and now they are really pushing Qualys to essentially, I would say one need at a time. That's what the agent does instead of the standard scanning.
So there now, it's essentially we have earned the confidence of our Cloud Agent with that number of Cloud Agents, there's no more issue, they are very non-intrusive. So we're breaking the barrier of the IT resistance. This is what is happening now.
And this is for the on-premise if you prefer, while moving now more and more on to the end points which is the password not there, so that's new. The other factor of growth is also on the cloud. We start to see now more and more adoption of our agents in the cloud environment because the idea for that as well.
So that's the way it starts. And then as you just mentioned, is now customers say, wait a minute, that agent I can do this, I can do that. And there's nothing to really install. So it's already installed. Everything is under managed set to the billing. You don't have additional servers. So now of course, you start to look at the advantage, the cost advantage and also the fact that everything comes into -- one single platform.
If you come at Black Hat, I strongly urge you to come and see the demo of our Global IT Asset Inventory, -- at your fingertips, not only you can in 400 milliseconds find any devices on your environment and identify everything, the open ports, everything -- you can identify everything and as well all the probabilities, the Indication of Compromise and all these additional services.
They all come at your fingertips. So that has been the fruit of many, many years of effort. Essentially, we adapt to the cloud as you know very early. And compared with our traditional competitors they have to rearchitect everything to just catch up to where Qualys is. So that's finally arriving to that -- to where we want it to be. And that was a long road, but I think we're very extremely happy.
Great. Appreciate the color. Thank you.
Thank you. Our next question comes from the line of Dan Ives from Wedbush. Your question, please.
Yeah, thanks. Can you just talk about new products in terms of the trajectory there going into the rest of the year? What type of traction do you guys have factored in there in terms of even qualitatively or qualitatively?
So I think as we mentioned in the press release, our File Integrity Monitoring, we have added additional functionalities is starting to really get very good traction. And now we also believe that with the detection of Indication of Compromise, we have already brought that at a significant new level. So we are really looking toward that. And of course, our Patch Management is doing really well. We have a really big pent-up demand on the Patch Management. Because again, everything is out of the same console, you don't have to deploy another application and you have the immediacy, which is what we offer.
So we're very happy with these new services. I would say they are coming-of-age. And of course, we're working on more solutions. We are also very looking forward on the Indication of Compromise. We are also moving into the endpoint EDR market and you're going to see a lot of new things coming in 2020 again, out of that one single platform. And that's really the big differentiation we have.
And just add on to that. So as I mentioned, our new products as a percent of bookings was 25% this quarter, we feel very good about. And we're really excited about the opportunity to accelerate Cloud Agent adoption with the additional features that were added to both SIEM and IOC as well as the release of the free asset discovery and inventory app because as Philippe said, we're potentially eliminating the resistance from IT and actually providing an incentive for them to download the Cloud Agent.
And then it's frictionless for users to subscribe to additional paid apps. So as historically said, we don't assume a material -- we don't assume contribution into revenues from new solutions that are not materially contributing yet. And to date, most of the new products as a percent of bookings are still Cloud Agent, VM, Policy Compliance and Threat Protection. But we see a great opportunity.
Yes. And I will add, passage scanning, which is essentially the component of our discovery or if you prefer the direct competition to ForeScout is now in beta will be GA on September 5, and with the component of our free offering. And then from there, we have a significant upsell, which is the quarantine capabilities which will be a big upsell. So by giving something of real value to the market, I believe we have created a significant disruption in the market. I'm receiving every hour now messages from industry experts saying, oh, what you have done is fantastic. And so I think we are very, very happy.
Thank you.
Thank you. Our next question comes from the line of Chris Eberle from Nomura Instinet. Your question, please.
Yes. Hey, guys. Thanks for taking the questions. This quarter, Cloud Agents from a net add perspective seems like a pretty big move up relative to the last couple of quarter of just 1 million or so a quarter. Did you guys change anything this quarter that kind of drove that increased adoption? And just the second part of that, once you start to see the Cloud Agent downloaded, what's the lag time between downloading the agent and then the greater adoption of further application?
Sure. So we're very excited about how our Cloud Agent subscriptions – with the adoption with this quarter. We actually saw acceleration, as I highlighted in my comments. Out of the adds, 3.5 million were for a Cloud Platform customer. But even without that, you would have seen acceleration. So we really see this, what we offer, taking hold in the marketplace. Our customers versus the agent in conjunction with the solutions, they're not downloading the agent separately. It comes with a solution that they're using. And the time in terms of adding additional solutions vary. There are customers who are buying multiple solutions at once and there is time to add on over time.
And yes, we believe, of course, by having offered the free Global IT Asset Inventory, this is a godsend for existing customers which love it. But also, it's a very cost-effective way of gaining new customers as well because, of course, once they deploy the agent, certainly, they can immediately try all these additional services and without having to install anything else. And again, installing our agent, by the way, is not difficult at all. And while putting, by the way, additional packaging to make that much even easier so people know exactly what they need to do. So we put a very big effort on the packaging.
We have also now a team in India of what we call the technical account representative, which are essentially on-boarders, which are technical people which are there not to sell, but are there to make sure that the customers have the first good experience. And if they have any questions, we have also now a robot, a bot which comes automatically as soon as somebody wants to download something so we can establish a communication with the customer.
So as you can see, we have been behind the scenes. We've been gearing for scale. That's essentially what Qualys is all about. When you look to that, our platform answers now in 400 millisecond a query, if you want to know anything about a device, 400 milliseconds later, you've got that. And that's because we have indexed 3.3 trillion data points on our ElasticSearch clusters. We indexed everything, all the data that we capture. So again, this all about scale, ease of deployment and, as a result of that, frictionless adoption and I think we're getting there..
And just to reiterate something Philippe said in his prepared remarks, which is a key theme we've talked about, which is the ability to leverage our platform as a distribution channel is a key element of our profitable growth. And so you see the release of the free Asset Discovery and Inventory app as a perfect example of that.
Got it. And can you just update us on the percent of the customer base that's using Cloud Agent today? I think it was at 18%, you said last quarter?
Yeah, still a really meaningful opportunity. It's only in 20% as of this quarter. And again, as we've talked about in the past, it's still early in the sense of deployment on the endpoint. So within our cost – within those – that 20% of the customer base, I still think there's a meaningful opportunity for expansion. And at that free Asset Inventory and Discovery App potentially will accelerate that.
Got it. Great. Thanks.
Thank you. Our next question comes from the line of Jonathan Ruykhaver from Baird. Your question, please.
Yes. Good afternoon. Melissa, you just mentioned endpoint, and so I'm wondering if you could help us understand maybe some of the obstacles in terms of adoption there. I think you've added endpoint application for 18 months or so? You can correct me on that. But just what you're seeing, how much runway? It seems like there's a part of runway, but I think more importantly, what are the challenges to adoption?
I think, the challenges are I believe, are starting to be behind us. As I mentioned earlier, in the beginning, it was the fact that, if you look at these enterprises there were like nine agents as an average. Today, we see interesting enough that some companies today have only now reduced that to two agents, which is the CrowdStrike agent and the Qualys agent. We have a few examples of those because our agent replaced already quite a few agents already. And so -- and of course, we are also moving into the CrowdStrike space, as you will see you during the early part of next year as well, with the IOC, with the enhancement we made to IOC. So I think this barrier are now starting to fall down.
The fact that, especially we have now an agent on older mobile, which is part of that Asset Inventory, so in Q4, we are going to invest another very big requirement for customers, having the ability to also look at their mobile devices, essentially tablets and phones. So I think that resistance, which was huge in the past, now today, is diminishing. And furthermore, because that our Global IT Asset Inventory serves both the security and the compliance and the IT people, now they have that visibility, the three of them. Of course, they look at things differently.
But the beauty of our architecture is that we bring all the information into one place, and then from there, you can have the IT view, the security view and the compliance view, and out of that one single platform. And that's the big difference again. So I think we are very confident that we are going to see acceleration of the Cloud Agent deployment, of course, that global -- as that free Global IT Asset Inventory, including with the passive scanning capabilities, I think is really what we believe will make that happen.
And I guess that leads to my second question, Philippe. The feedback around the Global Asset Discovery and Inventory service has always been very strong, and there's a clear need in the market, that type of visibility. I'm just trying to understand, it seemed like it was an easy monetization opportunity. So now that you're giving it free, what are the specific paid products that we should look to initially as kind of demonstrating the success of that free strategy?
Yes, so that's a very good question. In fact, this is really the core of our strategy for -- on one hand, we know that by giving that free we really provide a -- we have a lot of goodwill in our industry because that's a problem which was absolutely has never been really well solved.
But the second thing, if you look now from a business model standpoint, if you look today, as I mentioned earlier, currently today, our Cloud Agent enables 7 different services, and I named them: Vulnerability Management, Policy Compliance, File Integrity Monitoring, detection of Indication of Compromise, et cetera. So if you look at the cost so today at large scale -- and I'm going to give you numbers like if we are a big deployment.
So the cost for us to really give the agent free of charge for that Global IT Asset Inventory is about $0.20. In return, the aggregate value of these services will be net again of -- for storing, et cetera, and updates, et cetera, will be about $10. So you have effectively a 50 times, 50x return on your investment in, I would say, across three to four years at the most.
And so that's, at the end of the day, the potential that we have creating for ourselves here, with a solution that deploys and instantly provide you value because what's very unique with our Global IT Asset Inventory is that you, the customers, have nothing to do. It's our solution, which automatically categorize, tells you how many Windows devices you have, how many Mac devices you have, how many database you have, what type of database. You also have the ability to find and reply all of your job instances, et cetera. All of that is at your fingertip.
Now we don't give everything free, but we give the core component free, so you can have -- you automatically created your Global IT Asset Inventory in a very continuous way. So every time there's a new change, automatic, it's updated. And now you can, for a little bit more dollars, you can now upgrade and synchronize with your CMDB.
Today, we have the full two-way integration with ServiceNow. And so our goal here is to become the source of truth, and today -- and we can earn that. And again, if you could come at Black Hat, our staff will be very happy to give you a real live demo of that. You're going to be absolutely floored by how much information we capture, how quick it is and how comprehensive it is.
And just to add on to that. I think from a financial point of view, where you would see that is in -- you would see that manifest itself in revenue growth. And the reason I say it that way is because the adoption of the three asset discovery and inventory apps could accelerate both what I'll call older products as well as new. Older because, again, this eliminates the resistance to putting an agent on endpoints and say, many companies that haven't yet done VMware Policy Compliance and the endpoints are starting to do that. But then, again, it also may propel new solutions being adopted. So we have multiple vectors of revenue growth.
That’s helpful. Thank you. Thank you very much for the insight.
Thank you. Our next question comes from the line of Nick Yako from Cowen and Company. Your question please.
Thanks guys. You mentioned a major awareness campaign in the prepared remarks. But are there any more details you can share around just the overall strategy to drive awareness of the free asset inventory app?
Oh, yes. Yeah, I could be specific. So when you will arrive -- I could tell you that. So when you will arrive at -- in Las Vegas at the airport, you're going to see a huge banner everywhere. You're going to go to your taxi, you're going to see that, what we call, that new prescription for security. Every -- you're going to walk through the halls of Black Hat, you're going to see, of course, again, that campaign and you're going to arrive into our booth.
Another thing that I will mention is that there is also multiple, if you prefer, likes into that campaign. If you'll read the press release, you will see that the Cloud Security Alliance has essentially endorsed Qualys and are bringing that to their 95,000 members because, again, it's good for the community. This is just not good for Qualys. It's good for the community. So that's the first part of the campaign.
Then from there, we're going to do a lot of -- I mentioned earlier, we have now a team in India, which can absolutely onboard customers who are gearing up for a large volume. I mentioned earlier the first two days, we have more than 800 sign-up, essentially, to our service. So we are geared to have the technical people behind to ensure that customers are properly onboarded. And we are also making big effort on the packaging, so they could really see very easily how it is to download the agent, what they need to do, et cetera, et cetera.
And of course, after that, we're going to see more lead generation campaign. This is the bottom up. And there is a question before -- and you're going to see us doing -- now doing seminars, webinars to go, and in fact, we have one on Friday, starting on Friday with about 100 CIOs and CISOs of the healthcare industry where we’re essentially present and essentially are going to advertise the benefits of that Global IT Asset Inventory.
So we can essentially go now out to every CIO in the world, essentially tell them, now with Qualys, you can have the full view of what you have. Second, you can have the continuous assessment of the security and compliance policies of those assets. You can identify those which are vulnerable to zero days. Those which are compromised or those that we suspect compromised.
You can essentially quarantine them, and then, of course, you can consolidate your stack, which is what large companies must do now, save significant amount of dollars. And on the top of that, our architecture brings you -- enables you to secure your digital transformation, as what we're doing with Google, with Microsoft, with Oracle.
As you know, they’re all of our customers. We help them secure their own platform, and now we’re building that security into their environment for the customers, which we have done extremely well with Microsoft and we are doing that with everybody.
So again, that is -- that didn’t happen in a week. This is 20 years of effort. And we focus not on the growth of the company. We focus on building the platform, and essentially building sustainable growth and highly profitable growth. That's, when we went public, what we said. And I think throughout the years, we’re demonstrating that. But now today, we’re really put the pieces together, and that, you’re going to see a very different companies in the months to come.
Okay, great. And then could you discuss that large single Cloud Agent purchase in terms of the products that customer is deploying? And then maybe as a follow-on to that, do you see an opportunity to drive similar size deals going forward?
I mean, we don't really disclose really much these kind of things because as you know, our customers are always a little bit weary of telling the world what they do. But this is, obviously, a big cloud provider, which has now totally adopted the agent to secure their own platform.
And now you speak of me millions of agents really. And -- so of course, there is more and more cloud providers and there is more and more of those. But for us, more importantly, it’s all of the business -- it's all these additional services that you can build on the top of it.
So, again, the beauty of our Cloud Agents -- now we’re so happy that we have this talent around, is that they span multiple services and we are just at the beginning, when today we have 7, but you can realize that now once you have an agent across while moving into OT and IoT as well, you can realize once you have an agent you can now do enforcements. You can go into responsive.
It's all about the gain to their insecurity. I -- we always believe was one, you need to detect at scale. And then second, you need to respond and you need to eliminate the possibilities. So the fact that our agent gives us the context in real time is significant. And across, again, all this different environment because you cannot today say, oh, I just look at what’s caught on my blogs. That doesn't work anymore. You need to read out the complete view.
And so that's, again, not a walk in the park, and this is the reason why we are moving with the data lake because we have a unique advantage of one, we collect the data. No single, no SIM today on the planet collects the data. They got to take the data from multiple different sources, which is very complicated, very expensive and also very difficult to normalize because you don't know if that application tells you about that device. Is that the same device? You don't know.
So, the big advantage we have with our architecture again is that we have absolutely full contextual value and that's quite significant. So, I think we are entering into a new era of Qualys in which we believe, that's what's our goal. But I think we are really getting very close.
Okay, great. Thank you.
Thank you. Our next question comes from the line of Erik Suppiger from JMP. Your question, please.
Yes, congrats on a good quarter. A couple of questions. One, who is the asset discovery service competing against? And are you sacrificing much revenue by giving that away for free?
That's a good question and by the way, Erik, you remember, you are the one who really -- you were in fact the first one who told us to accelerate the Cloud Agent. You should really think about giving one of your services free of charge. So, since that we followed your lead, and in fact, I was absolutely -- but I was really waiting.
The reason why we didn't move early because I really want -- I was -- we were waiting for that Cloud Agent. So, we needed to create all the libraries and everything, so we could automatically create the inventory because telling the customer to do their inventory themselves, that's the problem you have with the CMDBs. You've got to do everything yourself. So, that's why we waited to have that piece completed and now we have it.
So, to answer your question, there's a plethora of solutions out there. Like Flexera and I can name many other ones. You have Armis, you have quite a few. The problem with all of them is not that they are not good. They do the job, but they are myopic. They only look at a certain part of the environment.
And if you take your security hat on, you've got to have the global view. You cannot just say, I've got that thing -- could you help my windows or I got my grid on this. You need to grow business together which is almost impossible and the CMDBs cannot really do that. They were never designed for that. So, that's really where the difference is.
So, in terms of -- yes, you could -- on one hand, you could say, we are giving away what, the entire -- what ForeScout is doing. We are giving away what Flexera is doing. And you could say, maybe this is $500 million, if not more. But look at the leverage that we have as I was mentioning earlier. With $0.20, then I can get 50 times the return. And the beauty of our solution is that it's automated. So, it's all machines. I don't need a lot of salespeople; I don't need a lot of support people. I don't need -- it's all in the platform. So, it's a very effective model.
And I go back to the early days. A lot of people -- very few people realized that VeriSign was the granddaddy. I always say that. It was the granddaddy of SaaS. They were the first one to have really cloud distribution model.
If you look -- I remember because I was there and what I could see that their salespeople, telesales people could do $4.5 million a year of renewals. So -- and in fact, I took some of their model and that's why we had a model which is so effective. You look at their gross margin today, they are at 70%. So -- because again, they have leveraged the cloud. Now what we do is more complex in a way. I'm not saying that what they do is simple, but we have much more variables. So of course, I'm not saying that we are going to reach 70% gross margin…
Operating margin.
The operating margin, yes. Operating margin, sorry -- is that because -- but I can tell you, we still have under the foot to be capable of leveraging the model again. It's all about the model. And the model is the cloud. The platform is the distribution channel. And that's where you cut a lot of cost, and that's what the digital transformation is all about, eliminating the middlemen and spending which is in between. So there's nothing new here.
Okay. One other quick question. The cloud hosting provider that it took 3.5 million agents, is that the same one that took 5 million agents about a year ago?
No, no. It's another one.
It's a different one. Okay. And if we think about the, your Cloud Agent count in the September quarter, is that going to be a tough comp? Because I think it was the September quarter last year where you had a 5 million -- you had one of the -- one customer that took 5 million. Is that going to roll off in which case that Cloud Agent count could come down?
No. I mean, we would assume that they would be renewing. So to your point, we might not be adding 5 million plus in that quarter, but these are based on 12-month rolling subscription.
Yeah. And we would differentiate with the free agent. We are going to also make sure that we don't -- because, of course, we should have a lot of agents as well which would come from the free service, but we will make sure that we essentially differentiate the…
Free versus the paid.
Free versus the paid ones.
Very good. Thank you very much.
Thank you. Our next question comes from the line of Alex Henderson from Needham. Your question, please.
Hi, guys. So I'm thinking the primary thing that is necessary to get the stock to really have any kind of real acceleration or move in it is the top line growth. You've talked about getting to a 20% plus growth rate at some point. The guidance in the back half doesn't look like an acceleration. It actually looks fairly much of a continuation of what we've been doing.
So can you talk about a little bit of the pings and pongs are relative to what would be necessary to get your growth rate to show an inflection and start to accelerate? And what the headwinds are relative -- is the macro environment or any other variable holding things back? I assume that that's not the case, but it could be. And what is the slope of that acceleration to get to the 20% longer-term target? Is it very, very gradual and then a pickup at some later date? How do we think about that?
Yeah. So first, yeah -- no. Absolutely. So first, we don't see any headwinds in front of us, really. Of course, we need to continue developing product and so forth, but there's nothing that we see as headwind in front of us.
Second, I just want to reemphasize again the fact that we are absolutely 100% subscription based, because when you compare -- when I look at some of our competitors and so forth, when I look at the quarter-to-quarter growth, which is -- essentially it could be like 3%, 4%, that doesn't generate 30% growth.
So where is that coming from? It’s coming from, of course, adding a few spoons or sprinkle of perpetual license here and there. And so we don't have any of that. So the result is that for us to pick up growth essentially, it takes a little bit longer. And that's essentially the way our model is. But of course, the big advantage is that, we are significantly more profitable and that’s something we don't have to do.
So it takes a little bit more time. So we needed certain patience. But that's what we have been all along and I think we are very confident again that we believe that we are going to pick up growth.
And now with all the things that we have done, so we have that kind of footholds in our growth because as we discuss last time and the time before is that, today we didn't have these new services mature enough and so forth to really start to contribute to the growth when we have a huge install base which has been growing very well.
But of course, it becomes harder now with just that VM or the Policy Compliance, or the Web Application Scanning to generate accelerated growth within new services. So we are very happy to see them out today, it's 25% to the contribution for the new services and this is going to continue. And we always say, that look at that adoption.
So it's a question of time. But it's there. I mean, there's no question and we have very strong loyalty from our customers. The other point which is significant, we really believe this Cloud Agent will make us, what I call, naturally sticky as you may remember with customers who have adopted 4 solution, the growth renewal rate is 99%. Those who have adopted 3 is 97%. Those who have 2 is 91%. So of course, these Cloud Agents that’s free global Asset Inventory really are going to make us very sticky.
So in a way, it makes us immune of some of the tactics of some of our competitors, which drop the price but they don't have the breadth of solutions that we have. So we are not losing our sleep at all.
Yes, I'll just add to on, Alex.
Just to be clear, the growth rate guidance for the back half of the year is lower than the growth rate guidance in the first half of the year and it's against easier comps. So I'm still wondering why you're growth isn't accelerating as it's supposed to decelerating?
Yes. So Alex we have a healthy business. We do have a higher negative impact from FX in the second half than we previously expected. We believe -- we expect the growth rate to be negatively impacted by about 1% each quarter, but we’re still maintaining the midpoint of our guidance.
And the reason, for the growth rate from where we are today versus -- versus last year as Philippe explained was that, as we talked about -- our previous growth rate had been bolstered by what we call fractionally price solutions for lack of a better term rate.
Cloud Agent for Vulnerability Management and Policy Compliance or threat protection that were priced at 20% or 30% of these older products. Now many of the newer -- we call sort of the new/new. The newer solutions coming out -- we expect to see deal sizes similar or more than these older products. But today, it's still primarily VM Policy Compliance, Cloud Agent usage and Threat Protection.
And so even in -- and to tie that all back together, even in the 25% of bookings I still -- the new products and bookings, it's mostly those newer products. That's why we are so excited about the additional features that were added on to FIM and IOC as well as the free release of Asset Discovery and Inventory because this potentially will help accelerate both adoption of the Cloud Agent broadly as well as of these newer solutions where we expect deal sizes to be larger and they can potentially have a bigger impact on our growth rate.
If I could just extend the question a little bit. So you've given longer-term indication of a 20% type growth rate. When do you think you might get there? And do you think 2020 is an accelerated growth rate versus '19? I mean those are kind of the basic questions that I think we heard every time we went out on this -- in the field that talked about the stock.
Right. So we talked about our long-term target, which we generally update our model on an annual basis, and we'll just do for our spring Analyst and Investor Day in New York. But the framework hasn't changed, which is fully referenced that the total spend per IP could be 10 times that of $1 of VM. This does include the paid version of our -- of the free versions of Asset Discovery and Inventory, but we are also not expecting our customers to adopt all solutions. In terms of the interim period, we provide guidance for 2020 after Q4 earnings. And so it would be imprudent to provide any direction earlier than that.
Well, thank you very much for the help.
Okay. Thank you.
Thank you. Our next question comes from the line of Keith Weiss from Morgan Stanley. Your question please.
Excellent. Thank you, guys for taking the questions. Filling in for Melissa Franchi here. One question on kind of OpEx and one on your geography. On the OpEx side of the equation, margins continued to be really impressive and extend really well, and OpEx was to be kind of in line with seasonality, but definitely kind of outperforming target. And I just wanted to check in like the outperformance on OpEx, is that because of kind of better leverage you're seeing, or has kind of the spending under paced your projections, does that -- you weren't able to get salespeople up and running fast enough or you were unable to -- or find the sales people or find the R&D dept. Is there any kind of pent-up spending that's helping those operating margins? That's question number one.
And question number two, if you look at sort of geographic growth on the year-to-date basis, Europe has been performing really, really well. It's almost like 30% growth. U.S. has been a little bit less growth at about 10% growth. Anything in particular that explains that dichotomy of sort of the much better growth overseas?
So I'll start with the OpEx. Keith, we are very happy to have you.
Thank you.
So on the OpEx, so you can see from our guidance, we are guiding to -- for contracting margins for the second half, so there is an element of spend that -- it's just really a timing issue. So, we did come in basically lower on headcount expense and operations and sales and marketing. Some of that is higher so we didn't find the right person and so it's -- we expect to see the hiring pickup on those in the second half. Some of it was also we just spent less on trade shows than we needed and third-party consultant to marketing costs. And not to make silly blush, but for example, we've got our campaign and a lot of it was driven by our multitalented CEO. So that helped save us dollars too, so there's also leverage.
Absolutely. Yes, and on the geography, I mean, this is just a very natural evolution of the market when you have today -- of course, we have a very strong penetration in the U.S. as compared to Europe. So what we see in Europe is the natural expansion in Europe of people deploying more cloud solutions and when in the U.S., of course, today, this is where we have the phenomenon, where essentially, we need essentially -- the mass is so big, so we need these additional new services to really propel the growth in the U.S. And again -- so that's something we -- again, we are very, very optimistic with our new services and see accelerated adoption.
It took us a little bit longer, of course, to -- because you need to essentially bring all these new services at the level that we need. It takes time, and we also want to make sure we got the right products. And we don't push solution into our customers. That's also the other very important thing in our model. And I will repeat again, we cannot absolutely -- if we start to have our customers consuming more, so we don't incentivize our sales force to do bigger deal than what the customer can really swallow. The reason is because, if not, they will not renew at some point in time and then we'll have to push more.
And now this is the way enterprise software works. Of course, there's always the music starts at some point in time, but it takes a long time for customer support to find out other new customers wherein you can shove it into them and create a lot of the software without -- with the pure subscription model than ours, you will see that much quicker, because then the stock's down-selling, which is exactly what you want to avoid. So these are the dynamics essentially.
Excellent. Thank you.
Thank you. Our next question comes from the line of Matt Hedberg from RBC Capital Markets. Your question, please?
Hi, guys. Thanks. Melissa, I know you referenced bookings in your prepared remarks and in prior calls. But we are getting quite a few questions or in short-term billings. I think it grew 13% this quarter. Could you talk about sort of the trends in short-term deferred? I think it grew a little bit less this quarter sequentially, than it did last year. I mean, should we think about short-term deferred as this model progresses and we look for revenue to accelerate?
Yes. Thanks, Matt. So we had a good quarter and we have a healthy outlook. As we've discussed, deals move in and out all the time. There are multiple scenarios in which the renewal does not happen at the same time as the anniversary date. So it's hard to normalize for comparison purposes.
Which is why we point to the trajectory of our annual revenue guidance as the best proxy for business momentum, because current bookings certainly form our guidance. As I mentioned, we do have some FX headwinds, but we're maintaining the midpoint of our guidance. And we're also speaking about introducing ARR next year, because it should reduce the volatility you see associated with current billings metric.
Got it. Thanks. And then, maybe, Philippe, thinking about the Capital One breach this week, it looks like it was a misconfigured WAF. I'm sort of curious can you talk about that as a broader issue? And may be how you guys can help prevent that from happening to others?
I mean, this is, as you know -- I think this is a complicated situation here and because, as you know, there is more -- there's the kind of an insider. Whenever you deal with insider, that's the most difficult thing to combat, because they have, of course, inside knowledge of your configuration and they could either find ways to get credentials they should not have. That's the Snowden case. Or they could essentially find or identify vulnerabilities that -- because they were just there.
And so that's the tricky part. So it's very difficult to combat insider threats as we all know. So -- but again, I go back to, it's all about hygiene. So that's where Qualys shines, because we can help you absolutely identify vulnerabilities on your environment at a huge scale across all these different environments.
So that's again what's behind the decision that we made to make the Global IT Asset Inventory free of charge, discussing with our advisory board, with our large customers. In fact, the idea came as well to make that one free from, on one hand, I mentioned Erik Suppiger say, by the way, you will adopt, but then we have also the customers telling us, look, this is such a pain point that we encourage you if you could do something here. And that will give you the visibility you need, because, how could you, if you don't know what you have. As you cannot even identify the vulnerabilities? So that's [indiscernible] if you look at every -- if you look at the Verizon breach report, et cetera, yes, we put a lot of the shiny objects around and this and that.
But if you don't do your vulnerabilities, if you don't configure your system properly, if you don't know that, that camera, for example, is still connected to your network and anybody can have access to it. And if you don't, then you're going to get breached.
And it's that simple and it's becoming very critical in our -- in that environment where now everything is becoming connected with everything, whether you like it or not. And so -- and we are entering that wait until 5G arrives. Oh my God, this is -- so that visibility is crucial.
Everybody will tell you, the experts 100% visibility. On our frame, for example, there's one thing that we don't [technical difficulty] surprised to see how many devices connect to your network via Bluetooth.
So we'll, of course, will introduce that shortly. But you need 100% visibility. And that's the one thing you've got to do. And then making sure that, you are very careful with your contractors. And we extend that visibility to your ecosystem as well. So it's a lot of work. And without visibility, you're going to get breached.
Got it, thanks a lot.
Thank you. Our next question comes from the line of Rob Owens from KeyBanc Capital. Your question, please.
Great and thanks for taking my question. And Melissa, I appreciate the commentary around short-term deferred and deals that move between one quarter and another. But if I look at three out of the last four quarters, you've grown at this consistent 13%.
And with the business setting up to inflect -- achieve that 2021 target of low- to mid-20s growth. At what point do we see that? And does that actually come through in that short-term deferred kind of as a velocity base metric? Thanks.
Yeah, thanks, Rob. So ultimately, 2021 revenue growth will be based on performance -- bookings performance in 2020. There is there is change pursue in deferred revenue but as we talked about many times.
And, for example, the correlation between quarterly billings and quarterly bookings is not always the same. And that's why we are looking to improve how we communicate externally with you guys. And as we mentioned, we are thinking about introducing ARR for next year.
Sure. And I understand that. But I mean, you've got three out of four quarter history of that 13% which theoretically suggest kind of a downward draft in that revenue. So even over time, that becomes an unreliable metric, if we look at again three out of four quarters?
Sorry, I was going to say, if you look at LTM billings, that's going to be much closer proxy to LTM bookings because you have much more normalization. And so what we've had today is the fact that our growth has been supported by this fractionally priced solution, as opposed to generating an impact from more of the higher priced solutions which are things like FIM and IOC, Patch Management, et cetera.
And so, that's really where the opportunity is, as well as -- again, as we talked about expansion on to the endpoint that could feel even kind of -- but also older products in terms of driving future revenue growth.
Great, thanks for the color, Melissa.
Thank you. Our next question comes from the line of Gur Talpaz from Stifel. Your question, please.
This is actually Chris Speros on for Gur. On the call you mentioned that the free Asset Inventory service already had 800 -- can you talk about the makeup of this group in regards…?
It's a mixture. It's a combination of small customers, mid customers and even large customers. So we could give you the breakdown. But we are just at the beginning, so essentially, we are targeting the entire -- for us, we can serve very small customers, we can serve very, very large customers, and the largest customers in the world. I mean we have got 70% of the Fortune 100 today. So they come from all walks of life.
And again, that Global IT Asset Inventory is really a need for everybody. The large company because they have no visibility and the small companies because they have only very few people. And so for them to do the cataloging or further application and what they have -- even if they have the small network, there are very little people to do it.
So because they are the poor IT guys, they do IT, they do security in the small companies, now they have to deal with the cloud and with the mobiles and with this and that. It's absolutely a nightmare. And so I think that's a Godsend for all of them, small or large.
Yes, that's a great color there. But where I was going with that question was, can you just talk about the makeup of the group in regard to the proportion that had already deployed the Cloud Agents relative to the proportion that represents net new Cloud Agent deployment?
Well, I would say, in general, the Cloud Agent has been more adopted in the enterprise than SMB, SME to-date. We don't look at -- track exactly every quarter where the net new adds are, we kind of look at it overall for the business. But what’s -- and this is what's revolutionary about what we're doing with the release of the free Asset Discovery and Inventory app is that, again, it provides an incentive for many prospects, in the low end, let's say, to adopt a Cloud Agent and then it's frictionless to subscribe to paid applications.
Yes, but I guess what I'm asking is the percentage of the 800 customers that have signed up. What percentage of this group had already deployed the Cloud Agent and were just signing up for the Asset Inventory versus the percentage of customers that the deployment of the Asset Inventory would need them to deploy the Cloud Agent?
Got it, got it. That's a great question. We haven't gone through all the data. We just announced them on Monday, so it's something we can get back to you with, Chris.
All right. Thanks Melissa. I appreciate it.
Yeah.
Thank you. Our final question for today comes from the line of Sterling Auty from JPMorgan. Your question, please.
Yeah, thanks. Hi guys. I want to clarify or understand in terms of the Cloud Agent, are the Cloud Agents included just in the core VM pricing? What portion or maybe paid subscription versus what portion are now part of the -- what appears to be the free program? I want to make sure I'm not mixing applies and oranges here.
Yeah, so the numbers that we've released, let me say, 23.6 million Cloud Agent subscriptions. Those are all paid subscriptions associated with the product because you don't just subscribe to the agent just for it to be an agent. Now you can use -- on the VM, you can use from our cloud the traditional scanning technology VM that's not using an agent, right, and you wouldn't need – for example, you can't do that with endpoint, because the laptops leave the network. So, if you want to give VM on an endpoint on the laptop, you'd have to use the agent.
And so we have like when I think about our existing customer base, right. We have a lot of customers who are still using traditional scanning and then many of them rolled over a portion, or all of their VM subscriptions into using the Cloud Agent for VM, because not only can you extended to the endpoints, but also go to the cloud environment and gives you more real-time information, because you're not just relying on the scanning windows. Let me pause, and see if that answers – that makes sense so far.
Yes. Now that -- that definitely helps. And then in terms of the procurement of the new solutions, is there an expectation of what you think kind of moves first? So is it going to be FIM and then followed by Inventory do you think you’re going – in terms of both the timing of GA as well as the customer attraction or do you think there is simultaneous in terms of the uplift?
Well, so, inventory we announced is going to GA September 1, FIM as we know believe added new solutions, IOC or add features, sorry. IOC we went into GA with the new features. In terms of – yeah, the timing of adoption of, like – which ones the people subscribe to the most first? It's always difficult to predict, because we have no data points yet for newer solutions or not enough substantial, I would say. Philippe, would you?
Yeah. And they're also a little bit different, because FIM is more typically for regulated industries rather than because they have to do it. So this is a different rhythm, so they all a little bit different at the end of the day. What we can see to the Patch Management, which is a new service. We have a pretty big demand for Patch Management already. So I think FIM, FIM is taking off. Patch Management will take off. We really believe that new generation, that new version of IOC is going to really rock the world, because unlike anybody else, we can identify suspicious devices. In other words, instead of just – the big advantage of our solution of IOC is that, you give us an IOC instantly we can tell you without scanning anything just querying our back end. We can tell you wherever you, we, you are compromised, and then because who have classified the malware into family. We can now identify the family match, who doesn't really give us 100% assurance that this is a real compromise.
But then of course, with a passive scanning we can look at what’s coming in out of the device, and identify that, if this is behavior which is suspect then we could absolutely now take action and quarantine, which will come in Q4. And then, of course, not only we can also put that device on watch, because as you know, no malware can be dormant, and in that sense, you don't see anything. And so we I think who are bringing IOC to its next level. And so we very well received by our customers as well. So I think that will also help the adoption of our agent as well because again, you need the agent to do these IOCs as well.
Got it. Thank you.
So we feel we're in good shape.
Thank you. This does conclude the question-and-answer session in today's program. I'd like to hand the program back to Vinayak Rao for any further remarks.
Thank you all for attending our second quarter 2019 earnings call. As Philippe and Melissa mentioned, we are holding a product luncheon for analysts and investors during Black Hat on Wednesday, August 7, from 11:00 a.m. to 1:00 p.m. and the registration is available on our website. We also look forward to seeing you at Citi's Global Technology Conference in New York in September. Thank you.
Thank you, ladies and gentlemen, for your participation in today's conference. This does conclude the program. You may now disconnect. Good day.