Good day, everyone, and welcome to the Qualys Fourth Quarter 2017 Earnings Conference Call. This call is being recorded. At this time, all participants are in a listen-only mode. Later we will conduct a question-and-answer session and instructions for asking a question will be given at that time. Additionally, we do invite you to email any additional questions to ir@qualys.com. I would now like to turn the call over to Joo Mi Kim, Vice President, FP&A and Investor Relations. Please go ahead, ma'am.

Thank you, Gene. Good afternoon and welcome to Qualys’ fourth quarter and full year 2017 earnings call. Joining me today to discuss our results are Philippe Courtot, our chairman and CEO, and Melissa Fisher, our CFO. Before we get started, I would like to remind you that our remarks today will include forward-looking statements that generally relate to future events or our future financial or operating performance. Actual results may differ materially from these statements. Factors that could cause results to differ materially are set forth in today's press release and in our filings with the SEC, including our latest Form 10-Q and 10-K. Any forward-looking statements that we make on this call are based on assumptions as of today, and we undertake no obligation to update these statements as a result of new information or future events. During this call we will present both GAAP and non-GAAP financial measures. A reconciliation of GAAP to non-GAAP measures is included in today's earnings press release. As a reminder, the press release, prepared remarks, and an accompanying investor presentation with supplemental information are available on our website. With that, I’d like to turn the call over to Philippe.

Thank you, Joo, and welcome everyone to our Q4 earnings call. Melissa and I are pleased to report another great quarter that included both strong revenues and continued profitability. We closed 2017 with 19% annual revenue growth normalized for MSSP and FX and record full year EBITDA margin of 37% while at the same time growing our headcount almost 30% to 869 full-time employees. We are happy to report that we see continued momentum with our Cloud Agents, in fact, we had a record number of Cloud Agent subscriptions in Q4 and we ended 2017 with almost 6 million Cloud Agents purchased over the last twelve months, 3 times the amount we had at the end of 2016 and a 27% increase over the last quarter. These results reflect our position as the leading security and compliance cloud-based platform that is centrally managed and self-updating, allowing our customers to consolidate their stack while helping them build security and compliance into their digital transformation initiatives. This is evidenced by the fact that our penetration of leading enterprises worldwide has increased, from 68% of the Fortune 50 in 2016 to 74% at the end of 2017 and from 60% of the Fortune 100 to 70%. And these are companies which are standardized on the Qualys platform. These market share gains have been driven by our unique ability, as mentioned previously, to help our customers drastically reduce the cost and complexity of deploying and maintaining a plethora of security and compliance solution across on-premises, end-points and cloud environments. This in turn enables us to expand our share of wallet in our over 10,000 customers and attract new customers as well. In fact, 32% of our enterprise customers have now deployed three or more solutions compared to 25% a year ago. Our competitive position…

Thanks, Philippe, and good afternoon. Before I start, I'd like to note that except for revenue and billings figures, all financial figures are non-GAAP unless stated otherwise. 2017 was another great year for Qualys as we successfully released several new products, features and enhancements while growing revenues by 19% and achieving record EBITDA margins of 37%, despite our continued investment in the business, including 27% year over year growth in headcount in 2017. As Philippe mentioned, we sold 6 million Cloud Agents in 2017, three times the amount we had sold at the end of 2016. Our Cloud Agent platform, as you may recall, is the underpinning technology of many of our new solutions including FIM and IOC, and these results provide a solid foundation for adoption of these newly released solutions. In 2017, we also saw very good growth both from existing customers and new customers. Vulnerability Management continues to be a strategic solution for our customers as we experienced a re-acceleration in bookings for our Vulnerability Management category, partly influenced by customer adoption of newer VM-related solutions like Cloud Agent and Threat Protection. In fact, the percent of bookings contribution from new products released since 2015 more than doubled to 12% in 2017 from the previous year. Continued adoption of our platform is a contributor to larger deal sizes and we saw a meaningful expansion in average revenues for enterprise customers with multiple Qualys cloud apps in 2017. As an example, at the end of 2016, enterprise customers purchasing four or more solutions generated on average approximately $180,000 in annual revenue. At the end of 2017, we saw that level of revenue generated with enterprise customers purchasing only three or more solutions. Turning now to the fourth quarter results, we are delighted that both revenues and profits exceeded…

[Operator Instructions] Our first question comes from Siti Panigrahi of Wells Fargo. Your line is now open.

Congrats on a good quarter. Philippe, just at a macro level, I just wanted to get your view on IT security spending, your expectation this year and some of the drivers, such as like GDPR or anything that you have seen going to help drive growth for Qualys.

I think, as we discussed quite a few times, I think what is driving our business -- so there two questions here, what is the overall spending and what drives Qualys. So I would say what continued driving the security spending is obviously the fact that our taxes not subsiding at all but what we see here is that buyers are [seemingly] [ph] more careful in the sense that absolutely the huge demand that we see everywhere is too consolidate the stack. And that of course is very good for us because that’s exactly what our platform does. Do more with the same amount of money so we don’t see contraction spending. We see much more wiser purchasing. As far as Qualys is concerned, what drives all business naturally is the fact that people realize that because everything is interconnected with almost everything, you cannot secure what you don’t know. So that’s essentially a, our customers are now deploying more of the VM solution not less. So that of course is very good. We see that in Europe particularly. GDPR is an element but not, we don’t see that as a major driver. I think what we see in GDPR is that it forces a company to rethink the security because the cost of compliance is too onerous. So we see GDPR as accelerating a board the initiative of companies to essentially accelerate their transformation, which means retuning their IT solutions and then thinking of building security into their platform. That’s what we do with Societe Generale and quite a few other companies. And that, of course, is very good for our business. So for us, we see all this changes which are happening, very favorable for Qualys because essentially you have that unique cloud platform that we have created which allows to consolidate the stacks. Give you visibility, deploys absolutely globally across endpoints on-premise and cloud environments. So I think we are extremely well positioned.

All right. It's good to see cloud [indiscernible] and adoption, but as you look into 2018 guidance, what are the new products that you mentioned. What are the new products you expect to contribute on a significantly in 2018.

So today we have what you know, we won GA with our file integrity monitoring with our detection of Indication of Compromise. We start to see adoption of those services very well received by our customers. And I think all the other services that we mention, we are going to deliver in the same scenario. Customers are absolutely telling we are doing the right things. So it's difficult for us to say today which is the one which is going to accelerate faster than the other one. In few months of course we would have enough data points to be able to tell you that. But today we see adoption from all of them very well received. And lot of customers went in for new services to hit the road.

Thank you. Our next question comes from Howard Smith with First Analysis. Your line is now open.

First, just housekeeping. Melissa, is there any effect, material effect and revenue or deferred balances or billings from NetWatcher, kind of inorganic numbers.

No, NetWatcher transaction very small. The numbers are immaterial.

Perfect. And then in terms of the new customer additions over the year. So some nice metrics there. And we have talked about the company being exceptionally good at harvesting and penetrating existing customers. But it seems that you are doing a better job of landing some large new customers. Where do you feel you are kind of where you would like to get to in terms of your capabilities there? Are you most of the way there kind of exiting the year or you still have significant emphasis to put forward as far as new logo acquisition strategy.

So as you have seen, we are very proud of the fact that we essentially accelerated our penetration at the top end price significantly going from 70% of the Fortune 50 to 74%, and also to now to 47% of the Fortune 500. So we continue penetrating very well at the high end because we have a unique scalability. Now we start to see that now we have an ability because we have more new services to really accelerate our penetration on the mid-market and we see a huge opportunity now for this at the SME world. We are starting to do significant deals. I mean the SME market which is the small and medium enterprise, which today we characterize as a company between 500 to 5000 people. A large deal was $50,000 a year. Now today we see deals of $150,000, even to $200,000. So we see a very unique opportunity because of course there is many many customers. So you are going to see being more aggressive now that we have more service structure, totally integrated. So we are going to be more aggressive in the midmarket, which is also by the way moving very much into the cloud and there are integration capabilities with all this cloud platform is also quite unique. So we see also a very big expansion, potentially expansion there.

Thank you. Our next question comes from Joel Fishbein with BTIG. Your line is now open.

Congratulations on the excellent execution again guys. I have one for Philippe if I may, and one for Melissa if I can. Philippe, very excited about the two acquisitions that you did. But you mentioned in your prepared remarks that M&A is going to still be part of the DNA. It's looks like you guys have a lot on the plate right now. Is there still room for M&A in the near-term or are you just saying that that’s part of the DNA going forward. And then I will ask one more.

Yes, absolutely. In fact, as you know everything we do we try to do that in a thoughtful in a measured way. We don’t jump into a position to boost the top line. We do that because we see first about that our customers are really asking us to provide this capabilities. Also very careful at not integrating companies where we will have to redo everything, rearchitect because that is a long road. So we want to do acquisition where we can inject, if you prefer, this new DNA or new technology into our platform and that’s what we have done essentially with Nevis and NetWatcher, and with a company that I have just mentioned that we have entered into a term sheet that will be exactly the same thing. And third, we absolutely do not want to pay this absolutely same premium value that today we have in the U.S. where you see these companies which are [indiscernible] revenues and you have to pay $200 million to get them and then you have will have to re-architect everything because very few of them are already cloud based. So we are shying away from this one. But, yes, we are going to continue very aggressively to look at small companies which have very good technology that we can integrate and that we pay reasonable price. We are string to device some metrics of how many engineers you have like in the old business of Microsoft and Microsoft was saying, okay, we are acquire a company and how many engineers do you really have, okay, and we would pay a million dollar per engineer. That’s what is their formula. And so we are starting to derive some of this interesting metric with the acquisition that we have done and the few that we have today in the works. Does that make sense?

Yes. It makes great sense. And Mellissa, just a quick follow-up. Obviously, you guided margins flat for 2018 which is very understandable considering how much you guys have expanded margins and accelerated growth at the same time. But as we have talked about before, it feels like there are still more leverage in the model long-term. Is that the case and I know you are not giving guidance past 2018 but there still feels like there is leverage left to go.

Yes. I would agree with that. We continue to believe there is an opportunity to accelerate revenue growth and expand margins. Given the growth opportunities ahead of us, we are continuing to invest but we are able to do that in a way that still maintains industry leading margins. And we said in 2017, it's going to be an investment year and we ended up expanding margins. As of now we believe the margins will be kept flat but there is absolutely opportunity for the future.

Thank you. Our next question comes from Melissa Franchi of Morgan Stanley. Your line is open.

Philippe, you talked about how the vulnerability management business accelerated in the quarter. I am just wondering if you could touch on what's driving that acceleration and then what you are seeing in terms of competition.

So as far as the acceleration essentially, finally people realize that you cannot secure what you don’t know and then that you have to go get variabilities everywhere. So the old days of doing few critical servers and the perimeters are gone and so that’s good for our business. And because we uniquely scale for our existing customers, it's pretty easy to deploy. It costs almost nothing accept the, I think, expanding the subscription. And that should go back to [indiscernible] vis-à-vis the competition is to really differentiate us very well with the competition, especially at high end of the market as we I alluded earlier. In other words the point I want to make, some of our competitors have said that they have huge penetration of the enterprise with that. So, yes, they may have some servers here and there but for us when we say that 70% of the Fortune 50 or 47% of Fortune 500, or 70% of Fortune 100 are using Qualys, means they expand dollars essentially on the vulnerability management and a few other applications on our Qualys platform. So this is not just one small instance. This is really true standardization. So as far as the competition is concerned, you know you saw the IDC reports which clearly show that compared to Rapid7, if you look out to like [older then] [ph] the two last month spending, Rapid7 and Tenable, so Rapid7 is restarting to lose significant momentum here. As we can see in the vulnerability management space, you saw that most of their growth came from their acquisition of the Web Application Scanning, which added $8 million to the 2016 numbers. This is the IDC numbers which are always really -- believe in IDC, I think I mentioned that. Quite a few times I believe in their methodology. They check the numbers. So this is really what went through for them over the years. And Tenable is -- Tenable, we are not strong environment yet. In fact we are not selling to really gear up to go in the performance. I think we are going to compete big time against them there because this is their stronghold. They are also very strong in the consulting, [investors] [ph], which they are trying to upgrade to Tenable IO. So you are going to see also much more aggressive there as well. So we don’t see really Tenable in the large deployment. In fact we replace quite a few of their home grown solutions which we have recently did with a major cloud provider. So all in all the competition is there which is good but I am not losing my sleep over them essentially.

Thank you. Our next question comes from Sterling Auty with JPMorgan. Your line is now open.

This is Jackson Ader on for Sterling tonight. Questions from our side. With 27% headcount growth in 2017, what are we kind of factoring in maybe for 2018? I know margins being guided flat but with the 150 basis points tailwind from ASU 606. It looks like there is going to be some incremental investment. And so we are wondering if that was going to be encapsulated and where that would be spent.

Yes. When we do our budgeting and planning process, we look at across each function, what's needed. I would expect similar growth in headcount in this year but there is also other spend going on in terms of spending servers and storage for the platform. There is new systems that we will be putting in for the first time this year in HRIS system and FP&A system. So there is other areas that are going to add to it.

And also if you look at headcount specifically, so there is way they are bit misleading because of our significant expansion India. If you look at the two acquisitions and the acquisition we have done with Nevis, this is an acquisition in India. We are planning that term sheet is another acquisition in India. So obviously the headcount in India, if you look for the cost perspective, we have almost a 1:10 ratio. So that’s a significant advantage that we have here because we have established a stronghold in India with very good operation of close to 400 people now there and we will continue hiring there quite aggressively.

Thank you. Our next question comes from Anne Meisner with Susquehanna. Your line is now open.

First question is for Philippe. As you mentioned, it looks like you're investing a lot more in the federal space, which is an area that I believe should be a huge opportunity for Qualys. And I was just wondering, would you expect your new VP and GM to kind of grow the go to market presence for that vertical and is this the year that we should expect to see an inflection point in terms of the revenue contribution from federal?

So the answer to the first part of your question is, yes, absolutely. That’s the mission. And in fact we have also -- we are also gearing up from the partner side as well to have essentially expand, if you prefer, our partnerships in the federal space. As far as the second question in terms of generating revenues, while still pretty modest because you know it takes time, we may receive, I think, we are hopeful that we could get come boost at the end of the year. In September, when budget has to be spent. But essentially the growth in terms of revenues is 2019 because it's the standard. We believe we are really going to be very successful in the federal because not only we are FedRAMP certified, but most fundamentally, we have what they need. Today, the federal market has a problem, which is they have absolutely, a need for scale and none of the current solutions are satisfying them. And they cost more and more maintain and to update. And of course the attacks are not slowing down so the complacency is there so we can really, absolutely help the federal government. So our time has come, fundamentally.

Thank you. Our next question comes from Jayson Noland with Baird. Your line is now open.

Mellissa, a follow up on 606. I think you said 150 basis points of impact. Is that starting in FQ1 and would that be a couple of pennies of upside there.

That is starting in Q1 but that’s already baked into our guidance. So we will obviously share the impact as we get into the official adoption by the end of the quarter. And it's obviously going to depend on ultimately what the mix of new and renewal bookings are versus our other commission expenses. But as you said, that is already baked into our guidance.

And Philippe, a question on new products, you have launched a lot of products and you have got a nice pipeline for this year. And I guess, the question is on sales structure and the introduction of a new product. Could you remind us how you are structured and how you intro a new product and what the, say is there a sales overlay team that works as account management, that would be interesting.

Yes. So first of all probably the most important point is that all the new services are already enabled in our platform. So for the existing customers, you can request a trial directly from your application and we did already provision. In some cases you may have to ask for a few more appliances and so forth. This is pretty minor. And so you can really try and buy. So that facilitates the deployment, the sales. It's absolutely unique with our model. Now as far as sales force is concerned specifically, yes, we have an overlay of SMEs. In fact, we made some, recently some changes in the structure itself with our subject matter experts, now we make them report in the project management team. So they could get closer to engineering fundamentally and so we could accelerate the feedback from customers who are on this product, go to market, the feedback. So kind of directly be pumped back into engineering. So we could make this new solution work much quicker. And so that’s the new change we have done but that’s not where is - it's important but I think we serve the sales force much better. And on the sales force itself, we are also now segmenting our sales force a bit more with the sales force more dedicated to the very large account because of absolutely multi-million dollar account, and essentially create the kind of support structure which reflects, a sales structure which reflects the different type of accounts. And finally we are now also aggressively looking at adding new business sales people because we have, again, more solutions and you are going to see us launching quite a fed services to create market awareness and lead generation. So 2018 is going to be a fantastic year for us and with all these new services, because they become a huge differentiator vis-à-vis all of our competition which they are still in that point solution and they try to integrate that. But for us it's absolutely, totally transparently integrated. So that’s where we are. So I think we are very confident.

Thank you. Our next question comes from Gur Talpaz with Stifel. Your line is now open.

This is actually Chris Speros on for Gur. Can you talk about the drivers of the success you have seen in your land and expand strategy? Specifically our multi-product customers primarily Cloud Agent customers that have deployed multiple agent products.

No, it's from everywhere. In fact, essentially if I will say, care to summarize, we are building and delivering good solutions that do what we advertise. We don’t hype as many of these other security solutions that you hear that it all works together. It deploys and works. So that and you can try if you are a customer. So we don’t push things with the market. We let our customers go into the home page and so it's effective for everybody. So now I think every service is growing at their own pace and very well. And we are just there to make sure that how far it works and that we continuously improve them and that we continuously innovate. And Qualys is known to do that very well and of course we are having a growing customer base, that’s the power of what we do. A very good renewal rate and of course the more services they adapt, the more sticky it will become and of course the more growth, the more profitable growth we have enabled.

Our next question comes from Erik Suppiger with JMP. Your line is now open.

Congratulations on a very good quarter. You had talked new product billings in the 15% range. Can you give us any sense for how much of that is Cloud Agent versus the other services?

Yes. It's still today mostly Cloud Agent, Erik. Which, as I have mentioned, we move very positively as we share Cloud Agent as a Trojan horse for the adoption of our new solution. Our new solutions that rely on the Agent.

Can you give us a sense of how rapidly the not Cloud Agent component of that 15% is growing?

They are both growing very well. It's mostly Cloud Agent and Cloud Protection which is a overwhelming portion of those. And they have both been continued to do very well.

Yes. And as I mentioned earlier, we start now to see the adoption of File Integrity Monitoring and the detection of Indication of Compromise. We launched GA just a few months ago.

Okay. And then I think you said Europe was going well. Did you have any comments on how North American business, how that was performing in the quarter?

So American business is performing as we have been performing, quite well. But Europe we saw some increased momentum in Europe because -- this is something that you may recall that I had predicted because in Europe the networks are not as big, so in the U.S. our growth has been driven by bigger up sells essentially, or bigger revenues from new customers. In Europe, the growth now is fueled by existing customers expanding essentially their vulnerability management solution to see more of the network as well as adding new services. So more on that in works but now the growth is coming from a combination of more VM deployment and addition of the new services, of other services. So very, put together.

Thank you. Our final question comes from Patrick Colville with Arete Research. Your line is now open.

Great quarter. I got a couple of questions. You mentioned that NetWatcher is immaterial to your revenue and guidance, billings guidance for fiscal year '18. Is it also immaterial on the cost side? And is that a factor behind the flat op margin guide?

No. Overall, as a company with very early stage show, it's really immaterial to our financial statements. And just as a reminder, we don’t give billings guidance, we give revenue guidance.

Okay. And for a typical GDPR customer, related customer, which kind of products will they be using?

So the big thing with GDPR is that obviously GDPR essentially forces you to demonstrate to the regulator that you have been a good guardian across the privacy and the security of the data of your customers. So part of that is of course have a very strong product management program and a very strong very compliance program which, where this is where Qualys excels. So it's a natural driver for us. There is a bigger start. What we see happening in Europe is that GDPR is forcing company to accelerate their future transformation and what is very unique with Qualys. Why, because they realize that trying to continue growing is natural part of software solutions. Security solutions that are very expensive, that are difficult to deploy and do not speak with each other. It's a little bit futile, so to say, when something has to change here because we are never going to prove to the regulator that we are doing a good job. And even if we do, it would cost us a fortune and will take us a long a time. So that’s fundamentally what every, if you prefer, CIO, in Europe now is thinking. That most of those that I have spoken with, everybody is on the same map here. And so the name of the game now is let's accelerate our digital transformation, like Societe Generale publicly announced. And then the question is, we cannot continue bolting on the security solution by throwing this additional enterprise add-on. We need to already build the security in. And this is where our cloud, private cloud platform becomes extremely unique because you cannot really secure the cloud from another cloud. So you need to be capable of going inside of this new architecture and that’s exactly what our cloud platform does. Not only our Agent, but the entire cloud platform itself. So we are extremely well positioned as probably the only company today who can claim that we can help to built the security into your digital transformation. And you are going to hear us speaking more loudly about that during our RSA in April.

Thank you. I show no further questions in queue so I would like to turn the conference back over to Ms. Joo Mi Kim.

Thanks, Gene, and thank you all for attending our fourth quarter and full year 2017 earnings call. We look forward to seeing many of you later this month at the Jeffries 2018 Cyber Security Summit in Austin, Texas, and JMP Security Technology Conference, Morgan Stanley TMT Conference in San Francisco.

Thank you. Ladies and gentlemen, that does conclude today's conference. Thank you very much for your participation. You may all disconnect. Have a wonderful day.