Qualys, Inc. (QLYS) Q3 2026 Earnings Report, Transcript and Summary

Ladies and gentlemen, thank you for standing by. Welcome to Qualys' Third Quarter 2026 Investor Call. [Operator Instructions] Please be advised that today's conference is being recorded. I would like now to turn the conference over to Blair King, Investor Relations. Please go ahead.

Thanks, Michelle, and good afternoon, and welcome to Qualys' Third Quarter 2026 Earnings Call. Joining me today to discuss our results are Sumedh Thakar, our President and CEO; and Joo Mi Kim, our CFO. Before we get started, I would like to remind you that our remarks today will include forward-looking statements that generally relate to product capabilities, future events or future financial or operating performance. Actual results may differ materially from these statements. Factors that could cause results to differ materially are set forth in today's press release and our filings with the SEC, including our latest Form 10-Q and 10-K. Any forward-looking statements that we make on this call are based on assumptions as of today, and we undertake no obligation to update these statements as a result of new information or future events. During this call, we will present both GAAP and non-GAAP financial measures. A reconciliation of GAAP to non-GAAP measures is included in today's earnings press release. And as a reminder, the press release, prepared remarks and investor presentation are all available on the Investor Relations section of our website. So with that, I'd like to now turn the call over to Sumedh.

Thank you, Blair, and welcome to our third quarter earnings call. AI has fundamentally transformed the adversary's playbook, graduating from accelerating existing attack techniques to autonomously operating inside live production environments. To put the scale of this shift in perspective, Microsoft's recent Patch Tuesday disclosed 1,414 new vulnerabilities in a single release compared to 93 before the advent of Frontier AI. That's a 15-fold increase in exposure volume within the last 7 months alone that every enterprise must now absorb in real time. Within 10 minutes of Microsoft publishing this advisory, Agent Insta, powered by InstaScan, posted scanless detections in a customer's environment, giving them an immediate view of their exposure, no scan cycle, no agent disruption, no days-long wait, the detection at AI speed. But detection alone changes nothing if what follows still takes weeks. Still relies on manual handoffs and still can't prove the exposure is closed. Events like the PHP2Shell disclosure and others are just a warning of what lies ahead and the need for speed from disclosure to remediation is clear. Durable pre-breach risk management requires a vendor-neutral agentic AI risk fabric that can autonomously transform detections into proven remediation of actual exploitable risk at the speed of modern attacks. Against this backdrop, we delivered another strong quarter of revenue growth and profitability alongside one of our most meaningful quarters of platform innovation to date. The execution reflects a clear shift in how customers evaluate and select their security platforms. The traditional CTEM model wasn't built for this moment, and it shows more findings, more theoretical risk scores, more dashboards and more handoffs, each one a gift of time to an adversary that now operates at machine speed. When customers can't patch fast enough to outrun autonomous exploitation, the last thing they need is another tool that tells them what's wrong and passes the problem to someone else to fix. CISOs are looking to update their boards with their plan of action against autonomous exploitation with a road map of autonomous remediation instead of more manual tools and processes. That architecture was already losing before the Frontier AI era. Today, against an AI-powered adversary, it's indefensible. We developed the vision and built the AI native ROC powered by our ETM solution over 3 years ago to end that cycle entirely. Today, Agent Insta powered by InstaScan is detecting newly exposed vulnerabilities at customer systems in less than 60 minutes of disclosure on average. Agent Val powered by TruConfirm has already performed approximately 9 million exploit validation across customer environments and still 11% of those confirmed exploitable, eliminating 89% of that noise would have been otherwise consuming security and IT resources. And TruRisk Eliminate with Agent Sara has helped customers deploy over 180 million patches in the last 12 months alone with 60% of those running autonomously, doubling from 30% a year ago at a rollback rate of fewer than 1 in 8,000. Together, they operate natively in a continuous closed loop that proves autonomous closure within hours, not weeks. The AI-native ROC isn't a road map. It's not a vision slide. It's operational, measurable and provable and that's nearly all enterprise and federal customer conversations are centered. Carrying this momentum forward, we are further evolving our ETM and TruRisk Eliminate capabilities through an expanded ecosystem of remediation solutions. Over the last 2 quarters, we introduced our AI-powered Patch Reliability Score, Agent Sara's wave-based remediation, peer-to-peer patching and AI-guided rollbacks. The cumulative effect of our TruRisk Eliminate agenda gives organizations confidence to deploy in production environment with rollback rates below 0.1% across well over 0.5 billion patches delivered to date, including more than 200 million executed autonomously. That customer confidence is translating into accelerating adoption with patch deployments up 47% from the advent of frontier models in early April of this year and autonomous deployments growing even faster. The biggest blocker to faster patching is lack of confidence in operational outcome. At our recent ROCon conference in Austin, we built on this foundation by announcing what we call autonomous RemOps, brought to life through TruRisk Eliminate 2.0 with TruConfidence. TruConfidence is a remediation and orchestration intelligence engine delivered on a straightforward operating principle, fix the minimum, credit existing controls, choose the right remediation path, control the rollout and prove that it held. Three new capabilities represent meaningful new ground for Qualys. First, before a corrective action is raised, TruConfidence assesses the protection already provided by third-party security controls, so customers don't duplicate their efforts. Second, it extends coverage beyond endpoints to cloud applications, perimeter and edge assets, including router switches, firewalls and air-gapped infrastructure that historically sat outside response workloads because they cannot run an agent. And third, built on the rollback capabilities we introduced last year, post-deployment operational resiliency monitoring through partners like Dynatrace now tracks system health to confirm that environment remains stable post patch. When a patch doesn't hold AI-powered Patch Failure Analysis explains the root cause in plain English and recommends corrective action. The result is an AI-native ROC that serves as both the system of record and the system of action for cyber risk reduction. Other vendors entering the mitigation conversation are orchestrating a handoff for agent-based endpoints and passing a patching recommendation to a third-party tool without giving the operational confidence and no verification that the fix was successful, be applied or that the environment remains stable afterwards. The Qualys platform was purpose-built to eliminate that handoff entirely and delivers natively integrated Autonomous RemOps with TruConfidence at scale, rapidly proving closure across every domain and asset type. With Qualys, no asset, whether it runs an agent or not and no exposure, whether a patch exists or not will be left without an immediate path to closure. Our continuous innovation and industry-leading capabilities are now garnering significant recognition from customers, partners and independent analysts. In the 2026 Forrester Wave for Proactive Security Platforms, Qualys received the highest rating among all evaluated vendors on the key criteria, including network visibility exposure, business-driven prioritization and remediation. Additionally, KuppingerCole named Qualys the highest rated leader in the 2026 Leadership Compass for Attack Surface Management, earning the top position in both product and market leadership, both underscore our customer-driven engineering and growing competitive differentiation across the platform. Moving to our business update. The number of customers spending $500,000 or more with us grew 15% from a year ago to 243. Let me now share a couple of recent wins, which illustrate why organizations are turning to Qualys to help unify their security stacks, operationalizing the ROC and put autonomous remediation to work. First, we closed a new low 7-figure annual booking deal with a large government agency. This agency had been running on an on-prem vulnerability management program for years, scanning with one vendor manually triaging across disconnected dashboards and handing patch cycles off to yet another vendor. As the detection volumes surged, the model was breaking down, response backlogs were growing and the agency kept falling further behind. Seeking to streamline operations, the agency ran a highly competitive process and selected Qualys to help activate its ROC on a single FedRAMP high authorized platform. In doing so, it landed with 7 Qualys modules right out of the gate, including ETM, ETM Identity, VMDR, TruRisk Eliminate, Policy Audit, TotalCloud and TotalAppSec. The net result is that this agency has now consolidated a fragmented multi-vendor workflow into a unified AI-powered risk fabric. A fabric that detects exposure within minutes of disclosure, validates actual exploitability so teams can act on real risk rather than theoretical scores and automates response by natively applying patches and other compensating controls when patches are too risky to deploy or unavailable. What used to take weeks from detection to confirm fix now takes hours and a patch backlog that has been compounding security debt for years is now under control. Given the success of this deployment, the customer is now actively evaluating Total AI and planning to deploy agentic AI workflows across its operations. The second was an existing large federal agency, which has struggled to manage its cloud and infrastructure security using siloed tools, while manually consolidating findings with no unified view of risk. Prioritization relied on CVSS security scores rather than validated exploitability and their security and IT teams are making critical decisions on incomplete data. Threat response had historically followed a pattern we hear too often. Security operations identified the vulnerability, opened a ticket and hand it to an IT team running a third-party patching tool, a cycle that averaged weeks from identifying threats to assumed fix. With the advent of the CISA BOD 26-04, which requires agencies to operationalize risk-based remediation and address AI accelerated threats that compress expert time lines to hours, that cycle was no longer sustainable. Our own threat research unit's 5-year analysis of more than 1.5 billion critical vulnerability instances shows that Qualys customers have already remediated approximately 173 million exposures before they were entered in CISA's KEV catalog, which is exactly the kind of proactive posture this directive now demands. In response, this customer evaluated several solutions and chose Qualys to operationalize its ROC automation. Where competing solutions aggregated data and continue to generate theoretical risk insights, Qualys was the only platform in the evaluation that could detect at AI speed across hybrid environments, hyper-prioritize millions of findings to the exposure that genuinely required immediate action and autonomously fix them. That translated into bringing third-party sources into the platform while consolidating several siloed tools in a 7-figure annual bookings upsell, adding ETM and TruRisk Eliminate while expanding the existing Qualys footprint. This customer is now aligning with the agency's risk tolerance across 9 separate bureaus, unifying detection with Agent Insta, exploitability-based prioritization with Agent Val, and recognizing the operational efficiencies and speed of automation, wave-based zero-day remediation with Agent Sara. These wins, alongside several other 6- and 7-figure federal and state wins in Q3 underscore the growing demand we see in our federal, state and local government business, driven in part by agencies moving to meet these new operational requirements. They also reflect a consistent pattern we see across the business as more and more customers move from evaluating the AI native ROC to operationalizing. Complementing this momentum, QFlex is emerging as an effective lever for platform adoption and ETM expansion. In the first full quarter following GA, QFlex customers increasing their average annual bookings by over 20% compared to their prior year annual bookings, while many added new modules to their subscription. Both wins I had just described with direct examples of QFlex in action. The new federal agency customer consolidated into a QFlex commitment spanning all 7 modules from day 1, while the existing agency added ETM at TruRisk Eliminate while expanding deployments at a footprint that already included 7 Qualys modules. In both cases, QFlex gave them the flexibility to commit more extensively across the platform while preserving the ability to shift investment as their risk priorities evolve. That's the commercial pattern QFlex was designed to create. Customers commit at a larger -- at a higher level because the model removes the friction of predicting exactly what modules they might need 12 months from now, which in turn drives higher utilization across the platform and positions us for larger upsells over them. Turning to strategic alliances, I'm pleased to announce that we recently delivered several new technology integrations spanning mobile identity, IoT and OT systems. As more organizations adopt the AI native ROC as their autonomous risk fabric for pre-breach risk management, the value of that fabric grows with every new source of risk intelligence it can ingest, normalize, prioritize and act on. These partnerships strengthen our multi-vendor architecture, extend the ROC's coverage and serve as a key differentiator for Qualys. In summary, over 3 years ago, we set out to transform Qualys from a company steeped in vulnerability management, detection and response to a holistic vendor-neutral pre-breach risk management platform defined by measurable, proactive and automated risk reduction at scale. This quarter, with the AI native operational and gaining customer momentum, TruRisk Eliminate with TruConfidence extending our reach to every type of asset, a growing federal customer business, strong product road map and early QFlex adoption, broadening how customers commit to the platform. We are seeing the clearest evidence yet that organizations are choosing Qualys because we don't stop at just telling them what is wrong. We prove it's fixed. That's now driving larger commitments, deeper adoption and stronger competitive differentiation while reinforcing our confidence in durable long-term growth. With that, I'll turn the call over to Joo Mi to further discuss our third quarter results and outlook for fourth quarter and full year 2026.

Thanks, Sumedh, and good afternoon. Before I start, I'd like to note that except for revenues, all financial figures are non-GAAP and growth rates are based on comparisons to the prior year period unless stated otherwise. Turning to third quarter results. Revenues grew 11% to $188 million. As a result of our strategic emphasis on leveraging our partner ecosystem to drive growth, the channel continued to increase its contribution, making up 55% of total revenues compared to 50% a year ago. Revenues from channel partners grew 24%, offsetting a 2% decline in direct. By geo, 15% growth outside the U.S. was ahead of our domestic business, which grew 7%. U.S. and international revenue mix was 54% and 46%, respectively. In Q3, our overall net dollar expansion rate remained unchanged from last quarter's 105%. The net dollar expansion rate of customers with prior year purchase at ETM or CSAM subscriptions improved to 108%, up from 107% last quarter. Moving on to product mix. ETM, CSAM combined made up 12% of total bookings and 14% of new bookings on an LTM basis in Q3, up from last year's 10% and 11%, respectively. Next, Patch Management made up 9% of total bookings and 18% of new bookings on an LTM basis in Q3. This compares to 8% and 16%, respectively, in Q3 of last year. Lastly, TotalCloud made up 5% of total LTM bookings in Q3, unchanged from a year ago. ETM and CSAM, combined with Patch Management are driving a meaningful shift in our bookings composition towards higher-value solutions. We expect that trajectory to continue as customers deepen their engagement with the platform. TotalCloud remains an important growth lever for the business. We are focused on improving adoption within our customer base. Reflecting our scalable and sustainable business model, adjusted EBITDA for the third quarter of 2026 was $89.9 million, representing a 48% margin compared to 49% last year. Operating expenses in Q3 increased by 11% to $72.2 million, driven by investments in sales and marketing, which grew 17%. With this strong performance, EPS for the third quarter of 2026 was $2.12 per diluted share, and our free cash flow was $100 million, representing a 53.2% margin compared to 52.7% in the third quarter of last year. In Q3, we continued to invest the cash we generated from operations back into Qualys, including $1.8 million in capital expenditures and $53.6 million to repurchase 330,000 of our outstanding shares. As of the end of the quarter, we had $176.1 million remaining in our share repurchase program. With that, let's turn to guidance, starting with revenue. For the full year 2026, we now expect revenues to be in the range of $736.9 million to $738.9 million, which represents a growth rate of 10%. This compares to prior guidance of $732 million to $738 million. For the fourth quarter of 2026, we expect revenues to be in the range of $191 million to $193 million, representing a growth rate of 9% to 10%. Shifting to profitability guidance. For the full year 2026, we expect 46% EBITDA margin, a low double-digit increase in operating expenses and free cash flow margin in the low 40s. We expect full year EPS to be in the range of $8.07 to $8.14, up from the prior range of $7.74 to $7.88. For the fourth quarter of 2026, we expect EPS to be in the range of $2.05 to $2.12. Our planned capital expenditures in 2026 are expected to be in the range of $9.5 million to $11.5 million for the fourth quarter of 2026 in the range of $2.3 million to $4.3 million. With that, Sumedh and I would be happy to answer any of your questions.

[Operator Instructions] And our first question will come from Jonathan Ho with William Blair.

Congratulations on another set of strong results. Sumedh, I wanted to start with sort of your comments around getting customers past some of their concerns around automated patch management and shifting that mindset away from the human in the loop towards full remediation. Can you talk a little bit about how that pathway works and ultimately, what that can mean from a revenue or net retention standpoint?

Yes, that's a great question. And I think nothing reflects better the mood in terms of what people are looking for then the CISA BOD 26-04 essentially requires within 72-hour remediation of critical vulnerabilities. And so if you look at vulnerability management, the 3 core components really are how quickly if you can detect it, then you have to prioritize the ones that need to be fixed and then you have to actually get it fixed. And so if you're talking about 3 days to do that and your existing approach on scanning is taking anywhere from 2 to 5 days to just get the information first, then you are applying manual prioritization on top of that. And then if the remediation is taking you weeks to get that within IT tickets or it's always an emergency, people are struggling with that. And so what we are hearing in terms of conversations with our customers is really at the end of the day, to achieve that 72-hour or 24-hour remediation cycle that people are looking for, everybody has to sort of look at some sort of a road map that takes you into fast detection, which we're doing with InstaScan less than 60 minutes. Quick prioritization with Agent Val where we're able to reduce significantly the number of things that need to be fixed because we are testing existing controls and saying we don't need to fix it. And then the last piece, which is, as I mentioned in the earnings call, the only reason people don't patch everything is because they don't have enough confidence that it will not cause an outage. So with the advent or with the release of our Eliminate 2.0 with TruConfidence, what we have done is focused on remediation intelligence to be able to provide customers with AI-powered reliability scores, additional comfort in knowing that certain things when they are deployed, we can actually tell them if the patch is going to be safe or not and monitoring with somebody like Dynatrace that if there are any issues. So the more we are providing in terms of having them see the value of that they can actually do this in an automated way with the confidence -- with something like Dynatrace and the intelligence built in. That's really the only meaningful direction we can go now. People are looking to say, how do I go back to my Board and give them that road map on how we are going to go from 0% automation and remediation when we are fighting AI-based autonomous exploit, how do we put ourselves on a road map that over the next couple of years, we can actually get to the point where more and more automation can happen in a much quicker period of time. And so if you look at the way we have aligned ETM and Eliminate, that's sort of how it is where ETM is helping you either pull data from VMDR or from other third-party scanning solutions and very quickly figure out which of those exposures are exploitable. And then additionally, if you want to look at getting it remediated as well, then ETM or rather TruRisk Eliminate 2.0 with TruConfidence is the additional thing that they can purchase to get to that point. And so that's really how we're seeing customer conversations as they're looking to say, how do we go -- how do I go back to provide confidence back to my organization that we can actually meet these requirements that are coming up more and more where you have to remediate within 3 days or 24 hours, given how much -- how many vulnerabilities and exploit Patch you're seeing coming out of these AI models that are being used by attackers.

That's very helpful. Just in terms of the pipeline, Joo Mi, can you maybe help us understand sort of the sustainability of Qualys' booking strength. I mean, I think the CCB number was a little bit down from last quarter, but still very healthy here in the mid-teens. How should we be thinking about sort of that -- the shape of the pipeline and maybe the sustainability of that over time?

Yes. If you take a look at our bookings trajectory, what we see in the business today is really a healthy 8% is approximately what we're expecting for Q4 calculated current billings. And that stems from the fact that if you take a look at our beat in Q3, it was a really strong quarter, another double-digit current billings quarter at 14%, albeit like you mentioned, slightly down from 15% last quarter. Part of it was due to -- we had a really strong federal quarter. I think that the examples that we gave in the script kind of demonstrates our strength. We executed well, and this is something that we hope to continue. But with that said, it can be lumpy. We do have some in the pipeline for Q4. But right now, from non-federal business perspective, we kind of expect the 8% as a base case for calculated current billings, ending the full year, full year calculated current billings growth at 11%.

And our next question will come from Roger Boyd with UBS.

Congrats on the results. I wanted to double-click on Jonathan's question, Sumedh. We all hear from CISOs that operational confidence is the biggest barrier to automated patching. I guess how is that product suite resonating with nonsecurity buyers within enterprises? And is that at all changing your selling motion around the product? Are you bringing those nonsecurity buyers into the sales process? And is that at all giving you access to additional budget?

Yes, very good question. I think what we are seeing right now is -- and when we started with Patch Management a few years ago, sort of the first ones in the industry come, we learned a lot from that, and there always has been a bit of that pushback from those IT teams because they might be using existing scanning solution, et cetera. But we did pretty well over the years convincing those buyers, the value of Qualys and our ability from a cybersecurity Patch Management perspective. And what we're seeing now post the Frontier AI model era, we are seeing that IT teams and security teams are actually coming together. We have been on calls where we have more conversations with the CIO teams as well now because they are all looking for some way for solutions that are focused on cybersecurity risk management. And with now with TruConfidence, we do get into conversations with our IT teams to say, well, how are we giving higher confidence that we can separate patches that can be low impact but high value, how do we help them understand which ones will not cause an outage? How do we help you mitigate instead of patching. So that level of intelligence and information is definitely giving higher confidence to the IT teams. So what we do see is CIO, CISOs are in certain conversations coming to the table. In some cases, right of the bat, they are going into autonomous remediation for 20%, 30% of the estate. In some cases, they are saying, let's start consuming your intelligence first so that our IT teams can still fix things faster by leveraging the intelligence you're providing. And over time, we will move into a model where maybe we start by taking 15%, 20%, 30% of the stuff we can automate as we build the confidence. But like I said, the whole point of releasing that TruConfidence was -- it was very clear that the biggest blocker to patching is the lack of confidence they will not cause an outage. And if we can provide AI-powered intelligence to make that decision much smarter and quicker, then we are going to see more and more adoption of this going forward. And so conversations are very much driven by our ability to remediate and that's the starting point for many conversations is how can you help me remediate so I can go back to the Board and give them a story about how we are going to do autonomous remediation against AI-based autonomous exploitation. And then that leads into conversations around ETM, how ETM can further reduce what you're remediating and by using ETM and Eliminate together, you're reducing your operational risk while at the time, increasing the speed at which you're able to actually get the things that are important fixed quickly. So we're pretty excited about the conversations that we're having right now. And like I said, things like the CISA BOD in trying to ask people to remediate things in 3 days is definitely a driving force to say, what's an architecture that does not have siloed solutions that can really focus on getting that 1% fixed really quickly so I can meet these guidelines.

Got you. And then, Joo Mi, nice to see the strength in federal wins. We've been hearing you talk about the opportunity there for a couple of quarters. Nice to see that manifest. Can you just talk about the relative strength, relative to what you typically see in that vertical? And it sounded like that was an area of outperformance. Any commentary on how the rest of the commercial business kind of trended relative to your expectations.

Yes. I think that primarily the beat was driven by the federal business. We haven't seen this type of outperformance when it comes to this vertical. We have been focused on making sure that we're building this pipe all throughout the year, and we are very pleased to see that the deals that we were working on actually ended up closing in Q3. And so that's really reflected in the current billings. So if you take a look at our net dollar expansion rate, in the quarter is at 105%, that hasn't ticked up. And I think it kind of indicates that rest of the growth really came from the new logo acquisition, which was primarily federal.

And our next question is going to come from Rudy Kessinger with D.A. Davidson.

Congrats on the strong quarter. Look, I think the question on a lot of investors' minds is really strong current calculated billings growth the last 2 quarters, 16%, 14%. You're guiding only 8% for Q4. I guess should we take the mid-teens growth the last 2 quarters to be an indication that we might see an acceleration in revenue growth at some point near term? Or should we look more towards that trailing 12-month figure that has improved a little bit, but been relatively more stable. I think that's just what everybody is asking here is, should we expect acceleration in revenue growth near term or not?

I think it's more of the latter. Based on what we were able to deliver, [Technical Difficulty] has to do with post-Mythos, a lot of the discussions that we were having with a small cohort of customers that we have in place. And then in Q3, the primary -- the beat was from the federal, albeit we would love that to continue where we'll continue to work on that, but it could be lumpy. And so from our perspective, the base case remains, of course, where we don't see a significant change in the net dollar expansion, which is our key KPI. So that 105% is healthy. It stayed the same from Q2. Right now, we don't see that materially changing. We are hoping that we continue to outperform the new logo acquisition, but this is based on the pipeline that we see for Q4 and kind of staying the course in terms of no material change in the sales cycle, the close rate. What we see right now is ending the year strong with current billings, closing the year at 11% for the full year and then the revenue closing the year at 10%.

Okay. Super helpful. And then secondly, just could you talk about the competitive environment, Sumedh, and just who you're seeing there and how things have maybe changed versus a couple of quarters ago or maybe even a year ago? Are you seeing more of the larger platforms in there that post-Mythos have really amped up how much you're talking about patching and vulnerability scanning, things of that nature?

We have been talking about vulnerability management evolving for a few years now before this whole thing came about, and that's why we started really focusing on Patch Management and remediation capabilities. And today, we present a very compelling case for somebody who wants to actually do remediation in their production environment with the 0.5 billion patches deployed so far with extremely low rollback rates, we have established ourselves as not just the vendor that is detecting tons and tons of new vulnerabilities, which as you saw with the patches, you're going to get more and more findings. So what we are seeing is the vulnerability management is evolving where it's about -- not just about finding and detecting CVEs because it's just unmanageable at this point in the number of CVEs being detected. It's really about being able to do validation of those exploits like a hacker would and then actually running into remediation and doing remediation with high confidence at a much faster speed. And so that's where for us, we -- even if a customer has some other detection capability for CVEs with ETM, what we are seeing with those customers when they come and build a ROC and they work with Qualys, they are pulling either using Qualys for fast detection or they're pulling data from maybe some other solution they might have and leveraging the Qualys ETM license to then figure out if that thing is exploitable and then the Eliminate license to then go and run remediation so that they can actually get rid of that particular exposure in the 3 minutes -- in the 3 days, as [ CISA ] has said. So I think for us, we see that continuing more -- less conversations about how many CVEs are you detecting more about? Are you able to detect them fast than computing solutions, which are taking 2 to 3 days for scanning. And then the last piece is ultimately, how can I build an automated workflow. The issue is that if you have a separate scanning solution, a separate prioritization capability and a separate remediation capability, that makes it a lot harder to really get to that 3-day remediation or 24-hour remediation that people are looking for. So the conversations are less about can somebody detect more CVEs? Really, our conversations we're seeing are more about how do you help me build a story that I can take back to the Board that shows a road map for autonomous remediation as a response to autonomous exploitation.

And our next question will come from Brian Essex with JPMorgan.

I'll echo my congrats on a second quarter of pretty healthy billings growth. I guess, Sumedh, a couple of things stand out more from a trend perspective that I wanted to ask you about. One is the really nice growth in international business, sustainably in the mid-teens, particularly when you compare it to domestic, which kind of had a tailwind of Fed, as you noted, this quarter. And then also the partner contributions also seem to be ramping nicely. Is there a correlation between those 2? And how do we think about each of those in terms of your ability to win new logos outside of the Fed business, which I noted you had a strong new logo traction with this quarter?

Yes, that's a great question. And we have been doubling down on working with our partners over the last few years. And so we're pretty happy with the way that contribution from partners has increased over time while maintaining our margins as well. So we do continue to see that as a way that we are going to see long-term impact. I think what we are also -- our non-U.S. business always tends to be more partner driven, of course. But in general, I think what we are seeing is that right now -- and typically, we don't see that knee-jerk reaction from our customers who are larger customers, enterprise customers. Everybody is sort of going through a cycle right now of -- this is a fundamental shift in the way vulnerability management has been done in the past and to be able to do the exploit validation that's now specifically required and this is as an example, or to do autonomous remediation, structurally, they have to figure out within their organizations, how they can bring IT teams along, what kind of changes they need to make in terms of the team, the structure, the processes, et cetera. So a lot of the conversations that people are engaged in right now with us are about how do we continue over the next few quarters and next few years on changing out how vulnerability management is done. And our partners are a key part of that. So they are turning to the trusted partners to say, help me go back with a plan for autonomous remediation, and we are continuing to work with those partners. And so for us, we do see that the more and more we work with our partners and you see the mROC partners program as well, our partners will be working with these customers to help them plan out their autonomous remediation capabilities and Qualys obviously, is going to be a key part of that. So we do see this more as a continued long-term area of investment, and we're excited about building out these capabilities with our partners.

Got it. Is there anything to infer about the profile of the international customers and what might make them a little bit more, I guess, ripe for better growth than domestically? Or how do we think about the -- what you're seeing in one geo versus the United States?

Nothing really to call out that's different from what we have seen in the past.

And our next question will come from Joseph Gallo with Jefferies.

This is Grant Darling on for Joe Gallo. I wanted to start, the billings beat was really strong. Revenue beat a little bit narrower than usual. Just to start, anything to call out with large deals or linearity and maybe how we should think about that going forward?

Current billing tends to be not exactly a great proxy when you're looking at how to recognize revenue ratably. But to call out the Q3 revenue, the linearity was worse than what we typically see in the quarter. So that did impact that revenue that came in slightly lower at 10.7% versus the 8% growth rate in Q2.

Got it. And then maybe just to unpack the expectations around that 8% billings in 4Q. Just as we're hearing about PHP pipeline opportunity patching, is there something from a renewal base side? Is there anything in 4Q that's maybe making you more optimistic on the 2027 trajectory versus 4Q?

I mean I would say, like I said in the -- what I mentioned earlier that we do see customers engage when these kind of things happen. But even in the past, when Log4j and stuff came, we don't see that knee-jerk reaction immediately, and that's like immediate in the quarter. Of course, those cohort of customers that are up for renewal that already are having conversations about ETM and Eliminate in that quarter, those conversations can be more fruitful at times. But overall, when you look at the customer base and the opportunity that we have, we see this as a continued conversation with these customers who are very engaged with us to figure out what's the right way for them to make the changes internally within their teams, their processes to be able to roll out and give their management confidence in a new way of doing vulnerability management that is truly AI-driven and is able to do autonomous remediation with the confidence of not having operational outages. And so those conversations are going to continue. We're seeing good pipeline of conversations happening there, and we're excited to see how and when these conversations will end up closing once these guys are able to go back and make the changes and put the proposals in front of their management. That's going to take some time. So I think right now, we're focusing on those conversations rather than some sort of a knee-jerk reaction immediately happening this quarter.

And the next question will come from Mike Cikos with Needham.

I just wanted to come back to the QFlex customers that we're adopting. The average annual bookings increase of over 20% versus prior year was an impressive stat. I know it's early here, but was that 20% plus similar to what you guys had seen in the prior quarter? Or is the prior quarter just too small to even start comparing and contrasting? I'd just love to get a sense of how that 20% plus tracked versus precedent as well as how we're looking here into Q4.

Yes, it was really too small. So we just went on GA with QFlex last quarter. So what we wanted to do is just give you an indication, an anecdotal example of us, even though it was a small cohort of customer that started with QFlex last year, just to give you a sense of what we're kind of expecting going forward, this is in line with our expectation as in if you purchase QFlex, what will enable our customers to do is try out other products, which makes it much easier when it comes to the annual renewal when they come, they'll be able to convince themselves or better justify the increase in spend with Qualys. So it was a great kind of a testament or a validation of the whole point of QFlex, why it could be a win-win for both parties.

And our next question will come from Meta Marshall with Morgan Stanley.

As you've expanded the budget or the audience of budgets and interested buyers and that brings much more of a resiliency audience, has that changed kind of what partner channel you think will be the most successful or the ones that you're making investments in?

I'm not sure I understood the question. So it was hard to hear you, sorry.

Sorry, as you kind of focus on more -- getting more CIOs and kind of resiliency budgets involved, is that changing kind of the overall -- what channel partners you think will be most successful are the ones that you're looking...

Yes, that's a good question. I mean I think we are seeing more conversations that are -- with our managed service partners, our mROC partners because the CISOs are looking at less about, like, how can I more efficiently buy this particular tool and more about guidance on how they can have a risk-based conversation with their boards and management. And so when those kind of conversations come up, we tend to see our large MSSP partners, our mROC partners that are -- authorized mROC partners are the ones that work with us closely because they're able to go in and have conversations more around business risk rather than just because the number of CVEs and patches, they went up 15x, it mean that the budget is going to go 15x, right? So how are you going to work with that particular customer to be able to work with them and put a plan in place that allows them to find the right investment, optimize across the platform and have a risk-based conversation with the Board. So I don't know that it's really changing the partner conversation, but it does end up becoming more strategic when it's the conversations with the MSSP partners and the mROC partners.

And our next question will come from Joshua Tilton with Wolfe Research.

I just have 2 kind of clarification questions. My first one is, I think a lot of us on the call are seeing 2 really solid quarters of current billings growth. And there are a million different things, I would call it, in like in the cyber narrative that we can all want to and try to and hope to point that those 2 quarters of billings growth are coming from, whether it's Mythos or AI or whatever other awesome narrative that you want to point to today. But it sounds like on the call, you're trying to tell us that these 2 quarters kind of seems to be pretty unrelated. Last quarter, the outperformance was driven by just some outsized Mythos spending. And this quarter, it seems to be driven by a good Fed vertical quarter. I'm trying to just understand like is that how we're supposed to interpret it? And if that's the case, like, I guess, how do you -- I guess, how do you view your 8% base case for Q4 versus the last 2 quarters, and you kind of also pointed us to that same base case and have now outperformed. Are there just less opportunities for outperformance in Q4 versus the last 2 quarters because we don't have the Fed quarter closing and that mythos spending is behind us. Does that make sense?

Yes. So the reason why we called out the primary drivers of the outperformance or the beat that we hadn't necessarily expected was so that you understand how our business is performing. So I would say right now, the base case is 8%. Not to say that these outperformance will not continue going forward. It could be due to different reasons. But like, for example, Q4, what we see in the pipeline is 8% based on the historical close rate, historical sales cycles, but it could very well be the case that we have another strong federal quarter, right, which could explain the beat. So there is a scenario where you have a base case of 8%, there's room for outperformance. But with that said, we're not assuming that as a base case today. So what we talked about post-Mythos is at that point in time, we had a small cohort of customers that we were talking to already about upgrading to ETM and purchasing Patch Management, Eliminate at that point in time, and then they ended up executing. And since then, of course, we have other customers that we have continued to have discussions around, and those set of customers could easily close in Q4 as well. So the reason why we called it out is so that you understand kind of what we expected and then the potential upside was greater in 2026. And I think it will be greater in Q4 based on the conversations that we have and the size of deals that we're seeing today.

Okay. Super helpful. And then maybe just one other point of clarification is you did say that, that linearity was a little worse this quarter, which is what drove the lighter revenue beat. I think those mechanics totally make sense. Can you just help us understand like, at least from your perspective, why was linearity worse? Like, what do you -- is there a reason as to why linearity came in below expectation?

Yes, it really has to do with the timing of the closing of the deal. So for example, Q3 was a strong new logo acquisition quarter. And like it ended at the near the end of the quarter, so it impacted the revenue recognition. So it really depends on the percentage of the deals coming from new as well as upsell versus the renewal and the timing of that close and how much we're able to recognize in the quarter that could have like a couple of hundred thousand impact on the revenue.

And our next question will come from Shrenik Kothari with Baird.

This is Zach Schneider on for Shrenik. So maybe to follow up to that last one, actually. Previously, you've talked about how the change you're seeing with customers were starting with a larger deployment and not materially shorter sales cycles. Curious to hear in Q3, if that remained the pattern or if you're now seeing evaluations convert faster or purchases happen outside normal renewal windows.

Yes. From a business that kind of closed sales cycle perspective, you don't really see a material change or an improvement. That's part of the reason why our base case in terms of what we're expecting for the growth rate remains the same. From a sales productivity perspective, win rate, from all those traditional metrics perspective, it remains of course and we don't see significant changes one way or the other. What we are seeing is some of the larger deals that we don't necessarily are able to predict exactly when the deals will close are closing at different time period of time. So for example, in Q3, it was a really strong quarter. We hadn't anticipated all these deals in the federal space to close in Q3. Some of them could have deeply slipped into Q4, especially because their new logo acquisitions, but they ended up closing in Q3, which was great for us.

Got it. That's great. And then maybe among customers that renewed the core subscription while continuing to evaluate ETM or TruRisk Eliminate, are the incremental purchases or some of those at least now closing? And are they landing at the scope that you guys originally expected?

I think the conversations continue to be strong. I think we're excited about what we are hearing from them around elimination and deploying that. Like we talked a few times earlier, right, it just really depends on a little bit how internally their organizations are able to move to make it happen quicker or maybe taking a little bit more time because they would have to sometimes bring along their dev team, sometimes they have to bring along their IT team. So that -- when it comes to the Eliminate capabilities, et cetera, that becomes a little bit of a thing where it might take a little bit longer at times, it might move a little bit quicker. So some of that really impacts on yes, do they have the runway now to make it part of the renewal itself or they want to add a little bit, but then they want to add more once they get the broader teams onboarded. That timing sometimes can be really figured out by their IT team. I mean one of the federal examples we gave was a new logo for us, but they didn't have Qualys and they deployed Qualys within less than 6 weeks. They already had tens of thousands of agents deployed with no issues and the CISO went in through the platform and said, "Hey, what's this button do?" And he said, he could see a patch all button. So he worked with his IT team to press the button and they have 300,000 patches deployed within -- going from no Qualys at all to within 6 weeks having deployed 300,000 patches with 0 outages, right? So in their case, they were able to bring along the IT team and move fast. In some cases, it takes a little bit longer. So it just depends a little bit on how they're internally able to make. It's not just adding the license of the same capability. So that's where we are also working with these customers where some of those deals might close a little bit sooner. Some of them might take a little bit longer as they go through work with their internal teams to get this to happen.

And our next question is going to come from Luke Morison with Canaccord.

So we've had several high-profile AI discovered vulnerability events this year, most recently, obviously, PHP2Shell in October. Maybe just stepping back from any one of those incidents, like what does an event like that do to your buying cycles and pipeline? And does it have a tendency to maybe pull decisions forward?

Yes. So we've been consistent about this even all the way back to when SolarWinds and Log4j happen is what we see with our customer base is not a typical knee-jerk reaction where they're just somehow suddenly buying in the same quarter just to show that they're doing something. A lot of our conversations with customers tend to be -- when you take a step back, what is -- what are these celebrity vulnerabilities as we like to call them indicating. And by the way, on the same day as PHP2Shell, there was a [ Node.js ] vulnerability that was also pretty critical. But now when you have overlapping vulnerabilities like that, people don't even know how to track so many of these coming out. So like I said, the conversations with our customers are less sort of knee-jerk what can I do immediately, but more about the fact that overall approach towards vulnerability management cannot continue the way it has been where it takes a week to scan another week to import the data into a CTEM solution, which then gives you your dashboard. And then that dashboard is then reviewed by the IT team and then tickets are created and things are fixed in like 3 weeks or 4 weeks, that has to fundamentally change across processes, across tools, across different teams. And so what we see is a pretty good increase in the number of conversations on how to do when it comes to that. But that doesn't necessarily mean immediately that this quarter or something that we're going to see them purchase a bunch of things. I think it again goes back and depends on their ability a little bit to go and make that happen politically also within their own environment and those who are able to bring their IT teams to the table quicker. We see them move faster and others are still working through to say that they will need to work on making sure they get the right alignment because this is not just the security team there buy one tool and it's going to be done, right? It's going to be a change in process. How do we go from 1-week detection to 60-minute detection? How do we go from a theoretical validation to actually running the exploits ourselves and not having those exploits go crazy on us and then how do we actually do some form of autonomous remediation. So a lot of these are less about just buying more of the tool and more about fundamental change. But the encouraging thing for us is those conversations about changes in how they're going to do vulnerability management, exposure management moving forward are happening. And so that excites us that over the next few quarters and years, we are excited to see how that's going to build up into our business.

Yes, makes sense. And maybe just for my follow-up, if I look back over the last, call it, decade plus, I would think most incremental security budget has gone to detection and response with response obviously being after an incident occurs. If I think about this new paradigm, as AI shortens the time from disclosure to exploit, do you see budgets actually moving from that reactive side of the market to the proactive side where you guys are living?

There's no doubt that we are seeing those conversations in terms of how do we take a newer approach to pre-breach risk management because the number of things coming at us are so significant and the speed at which they are being exploited are so high that everybody needs to look at a new paradigm and you cannot wait for a breach to happen to then take a response after that. I think I always talk about this is like when you're buying a car, you kind of have your airbags that if you hit something, the airbag is going to protect you, but it doesn't mean you're not going to buy a car with brakes. And that's the same thing that if you have good brakes, doesn't mean you're not going to get airbags. So I think the way we look at it is ability to take proactive actions to prevent any issues from happening is becoming more and more part of the conversation now. But like I said, it does take them a bit of effort to change organizationally and tool-wise internally. So I have no doubt that over a period of time, we're going to see the shift where more and more proactive risk management is a focus. It is just now a question of when that timing is and how we're going to get there. But we are seeing definitely a more focused approach on pre-breach risk management to complement, and that's why we have the concept of a ROC, which complements the SOC. So the SOC is after the fact the ROC is more proactive risk management.

And our last question will come from Rob Owens with Piper.

I was hoping to touch a little bit on large transactions. It looks like one of your better quarters in terms of over $500,000 deals to date. Just what's driving that execution at this point? And are you actually seeing lands that large? Or is that mainly within the installed base?

Like I said, I think the desire to kind of have the end-to-end workflows, which is more complex in larger customers. And so the Qualys in the way our platform is always tend to solve the more complex problems for the more complex customers. And so the adoption of those capabilities is sort of what is driving that increase in that $500,000 plus. And so again, it depends quarter-to-quarter, but I think we're happy with that direction. And we're looking forward to continuing that momentum by working with those customers and finding a way -- when new customers also come, right, they're not looking just to replace a scanning solution with another scanning solution. So they are looking to add remediation, they're looking to add ETM. And so you see that in the numbers as well where new bookings, ETM bookings, percentage of some of these capabilities is also higher. So we do -- we are seeing that on both sides in terms of the interest in evolving their overall risk management program and not just adding another scanner or replacing a scanner with another scanner.

And Joo Mi, with retention rates remaining at 105%, have we flattened out here? Or could you still see some volatility moving forward in terms of that number potentially going down a bit?

We're not expecting that right now. Based on the momentum of the business, I think that it's more likely that it moves up rather than down or like most likely scenario, of course, is right now kind of recording 105% last quarter, 105% this quarter. With that said, ETM, CSAM customer cohort did go up from 107% to 108%. So based on that, I would say that for now, we're not expecting a tick down in Q4.

Thank you. This does conclude today's conference call. Thank you for participating, and you may now disconnect.