Sumedh Thakar
Analyst · Brian Essex with JPMorgan. Your line is now open
Thanks Blair and welcome to our first quarter earnings call. We’re pleased to announce that we delivered another quarter of healthy revenue growth and industry leading profitability. A number of CISOs I’ve met with over the past several months continue to emphasize four key priorities; identifying all assets in their environments, prioritizing and quantifying cyber risk, finding fast and cost-effective solutions to address risk, and ensuring adequate protection against adversaries. The importance of these priorities were further reinforced by the findings in our 2023 TruRisk Report released by Qualys’ Threat Research Unit after having analyzed 2.3 billion anonymized vulnerability detections in our platform. According to our research findings in the report, the average number of days to weaponize vulnerabilities in 2022 was 19, which is far less than the amount of time taken by IT teams to patch those vulnerabilities. Organizations are looking for platforms that can help them patch prioritized vulnerabilities before they get weaponized and exploited. The message is clear. Legacy technologies available in the market today that purely focus on generating more and more detections and alerts are not enough to help secure organizations. Against a backdrop of accelerating digital transformation and a cyber security skills gap, organizations require further assistance in prioritizing the most severe security findings present in their critical assets and resolving them prior to exploitation. As CISOs look to navigate the current macro and manage increased budget scrutiny, they are recognizing the need for a holistic, risk-based approach to quantify and align cyber risk to their business objectives and thereby, be in a position to communicate effectively with their Board and C-level executives. In terms of platform innovation for years, our mission at Qualys has been to drive continuous innovation to advance these initiatives. In doing so, we believe we’ve built a new security industry paradigm, which today leverages our powerful real-time data processing capabilities across more than 13 trillion data points on a natively integrated platform. Unlike traditional detection only technologies, the Qualys Cloud Platform is proactively enhancing security programs worldwide by not only detecting vulnerabilities and misconfigurations, but also prioritizing, remediating and preventing risk with over 45 million patches deployed by our Cloud Agents in 2022 alone. And, by leveraging the MITRE ATT&CK framework, we’re now further flexing the power of our platform to combine a continuous, real-time view of an organization’s security posture through the lens of an adversary with natively integrated, preemptive risk mitigation and prevention solutions. These capabilities, alongside our Cloud Threat Database featuring a unified threat intelligence platform of over 25 threat feeds, uniquely provide organizations with a comprehensive risk management solution to deliver quantifiable cybersecurity outcomes essential to protecting the digital infrastructure of today’s companies. Consequently, our strategic vision to consolidate the security stack has caused industry analysts to take notice. IDC recently pointed to a future of vulnerability management1, which evolves into an integrated cybersecurity risk management platform. Our CyberSecurity Asset Management with External Attack Surface Management along with VMDR TruRisk and Patch Management on a single platform are key to addressing this market demand. Of additional importance, the seismic shift in software application development and digital transformation using open-source software is resulting in a surge of software supply chain attacks. In response, we’re taking our innovation to the next level by extending the power of VMDR to manage the risk of Software Composition Analysis in on-prem and cloud environments. With this extension of the Qualys Cloud Platform, security teams can automatically identify open-source software across the production environment of virtual images by leveraging the same Qualys agent for deep-scan detection and remediation spanning the entire application life cycle with high efficacy and speed. This development advances our existing Software Composition Analysis and open-source software assessment capability for DevOps teams to secure container environments in continuous integration and deployment and at run time. In addition to this enhancement, we’re also advancing our Custom Assessment and Remediation capabilities into our agent-based VMDR and Policy Compliance solutions. As Organizations develop more and more custom software, the need to expand vulnerability management from 3rd party software to 1st party software is increasing. With this initiative, we are enabling customers to create their own detections for managing vulnerabilities in their own custom software across their entire environment. And finally, we’ve continued to expand our coverage for public cloud providers by bringing real-time, cloud asset discovery and prioritized remediation solutions on a single agent to Alibaba’s cloud. Turning now to our go-to-market motion, Q1 remained a tough period. Despite improved upsell performance, new business was challenging as organizations continued to apply additional layers of scrutiny to spending and delay project start dates, which impacted bookings. While we expect these conditions to linger for at least the remainder of this year, consolidation remains a key theme with our customers. Given our thought leadership and continuous innovation, we are fortunate to be engaged in many such conversations. Those conversations are laying a firm foundation for future growth, and many customers are on a long-term transformation journey with us. Existing customers continuing to invest in consolidation with Qualys’ platform was evidenced in Q1 by the steady adoption of VMDR, which is now deployed by 50% of our customers worldwide. A few key seven-figure annualized bookings wins with VMDR in the quarter included two Global 200 financial institutions who chose Qualys for its ability to replace traditional siloed security tools and enhance security posture on a unified platform, and one of the world’s largest health care providers that is leveraging VMDR with TruRisk to manage a comprehensive risk management platform in both on-prem environments and cloud workloads. Beyond these wins, let’s take a look at some additional examples that demonstrate how the power of the Qualys Cloud Platform translated into strategic customer wins and provided immediate value to the customer. First, with Zero Trust transformations underway, we are helping customers standardize their operations across a broad spectrum of security subscriptions in a high 6-figure annualized bookings in a large government agency aspiring to move beyond its detection-only solution, further expanded its use of VMDR and policy compliance by adding customer assessment and remediation, cybersecurity asset management, action management and custom HDR context HDR. This customer selected Qualys because we offer the only security and compliance stack available in the market today that utilizes both a FedRAMP authorized platform and a single lightweight agent to enable full asset visibility and context aware mapping to prioritize vanities proactively reduced technical debt, automate, catching and future-proof their security architecture with high-fidelity incident response capabilities across all environments. This is also a good example of how we are benefiting from the investments we are making in the channel to drive new business opportunities. Another marquee six figure annualized bookings enterprise customer win in Q1 was with a leading business services company in the Fortune 500. This customer expanded their VMDR deployment with true risk while adopting obviously the asset management and patch management as part of the initiative to transform its IT security architecture while replacing point solutions from two vendors with a single platform. The ability of this customer to significantly enhance the security program with comprehensive internal and external asset criticality, holistic risk scoring ticketing and automated patching across multiple environments on natively integrated platform where all key differentiators compared to alternative legacy technologies. With customers beginning to pursue Qualys as a leading risk management platform that consolidates multiple point solutions, we are growing increasingly confident in our ability to drive long-term growth with and gain market share. This confidence was again bolstered in Q1 as customers spending $500,000 or more with us, grew 27% from a year ago to 162. Growing our partner ecosystem continues to be a key pillar in our go-to-market agenda. In this quarter, we expanded our partnership with a leading MSSP in North America. With its platform already anchored in our VMDR solution this partner is now launching a managed touching service further validating our vision that organizations need how to timely remediation and not just more and more detections. This MSSP standardizing on Qualys automated touching solutions across Windows, Linux and Mac operating environments, mobile devices and third-party applications without the need for a VPN. In addition, illustrating the fast progress we are making in our External Attack Surface Management, EASM solution. We extended our relationship with a leading fabric insurance company which is now ingesting our EASM intelligence field to continuously assess risk for adaptive cyber insurance for their customers. Furthering our efforts to remove friction in the sales cycle by helping customers accelerate their cloud transformation and consolidate their security stack, we have introduced a new adaptive subscription model for organizations to extend the existing VMDR deployments into cloud and container environments for CSPM and CWPP through our total cloud solution. The early feedback we have received from customers for this model is quite encouraging, and we are looking forward to early adopt or customers in the current quarter. In summary, it's our view that during times like this, the best companies continue to innovate, focus on customer success and emerge stronger than before. Looking beyond the short term, we believe the artful combination of our cloud-native platform and frictionless go-to-market motion positions us well for the fundamental holistic risk management platform of the future. Throughout the balance of this year, we will continue to focus on executing our strategic vision, driving customer success and expanding our lever competition with a proven approach to balancing growth and profitability. With that, I will turn the call over to Joo Mi to further discuss our first quarter results and outlook for the second quarter and full year 2023.