This conference call transcript was computer generated and almost certianly contains errors. This transcript is provided for information purposes only.EarningsCall, LLC makes no representation about the accuracy of the aforementioned transcript, and you are cautioned not to place undue reliance on the information provided by the transcript.
Operator
Thank you for standing by and welcome to Qualys' fourth quarter 2021 investor call. At this time, all participants are in a listen-only mode. After the speaker presentation, there will be a question and answer session. To ask a question during the session, you will need to press star 1 on your telephone. Please be advised that today's conference may be recorded. Should you require any further assistance, please press star 0. I would now like to hand the conference over to your host. Blair King, Investor Relations. Please go ahead.
Qualys
Thank you, Lateef, and good afternoon and welcome to the QALYIS fourth quarter 2021 earnings call. Joining me today to discuss our results are Sumit Thakkar, our president and CEO, and Jumi Kim, our CFO. Before we get started, I'd like to remind you that our remarks today will include forward-looking statements that generally relate to future events or our future financial or operating performance. Actual results may differ materially from these statements. Factors that could cause results to differ materially are set forth in today's press release and our filings with the SEC, including our latest Form 10-Q and 10-K. Any forward-looking statements that we make on this call are based on assumptions as of today, and we undertake no obligation to update these statements as a result of new information or future events. During this call, we'll present both GAAP and non-GAAP financial measures. The reconciliation of GAAP to non-GAAP measures is included in today's earnings press release. And as a reminder, the press release prepared remarks and investor presentation are all available on the investor relations section of our website. So with that, I'd like to turn the call now over to Sumit.
Lateef
Thank you, Blair, and welcome everyone to our fourth quarter earnings call. We are very pleased to report another quarter of strong financial performance Reflecting a year of progress in our efforts of advancing our go-to-market initiatives, significant platform innovation, and strong momentum heading into 2022. In Q4, cloud agent subscriptions grew 34% year-over-year to 75 million purchased over the last 12 months. There was also a steady adoption of our vulnerability management detection and response, or VMDR solution, which is now deployed by 36% of our customers worldwide. These results continue to validate our security consolidation approach and the power of single agent as customers increasingly transition to VMDR. Our go-to-market enhancements are starting to yield results as we are executing well to seize on heightened demand trends and opportunities we see in the market. The customer stories I will share with you today not only highlight our growing leadership among large enterprise customers, but also the growing desire among CISOs CIOs to consolidate their security stack and leverage automation in their security and compliance operations to achieve expedient remediation of risk in their organizations. Recent high-profile ransomware attacks and critical vulnerabilities like Lock4Shell and PawnKit have highlighted organizations' need for a scalable vulnerability management solution like Qualys' VMDR. That not only accurately detects these vulnerabilities, but also helps reduce exposure time with integrated asset discovery and remediation capabilities. Within days of Apache announcing lock for shell vulnerability, the Qualys research team, engineering team, and product teams released a free 30-day lock shell detection and remediation service, leveraging multiple Qualys capabilities like cybersecurity asset management, VMDR, patch management, and web application scanning. Since the Lock4Shell announcement in early December of last year, the Qualys cloud platform has detected millions of unique Lock4Shell vulnerabilities, underscoring the strategic relevance of our platform in our customer environment. Additionally, given the extensive impact of Lock4Shell to global organizations, our research team released multiple open source tools to help discover and remediate this vulnerability for the global community, further demonstrating both our leadership and commitment to the industry. A few illustrative events in the quarter include an existing Global Fortune 200 customer in the EMEA region, which standardized on Qualys' VMDR policy compliance, patch management, and asset inventory capabilities to cost-effectively consolidate its stack of legacy enterprise security and compliance solutions into a natively integrated platform linking multiple data center and endpoint environments. In addition, a new Fortune 600 Customer selected VMDR and cybersecurity asset management over several competing solutions. The ability to uniquely provide comprehensive asset discovery for security-centric visibility, CMDB synchronization, alerting, and accurate response capabilities once again stood out among vulnerability detection-only solutions in the market and was a key differentiator in our win. We believe these new wins and the early success we are experiencing with our newer applications characterize that when customers are ready to re-architect and consolidate their security stack, Qualys is the best cloud native multi-solution platform to meet their needs. Looking back at 2021, I believe the Qualys team has responded incredibly well to unexpected challenges and opportunities. demonstrating the transformative value of our newer solutions, the depth of our customer relationships, and the extraordinary abilities of our global and diverse team. We continue to broaden our platform and grow our business, building a strong team with additions of new executives, including a new CRO, CMO, CPO, and CIO. More recently, Bill Berty joined Qualys board in December. Bill has extensive go-to-market experience in enterprise software sales and marketing. And we believe he will be a great asset to the team as we build out our go-to-market motion in 2022. With this foundation in place, over the next several quarters, we plan to increase our sales and marketing investment with a focus on digital marketing programs to drive pipeline and customer reach, grow our sales team to further leverage our opportunity in the market, and expand our channel by recruiting and enabling partners. With respect to platform innovation, our goal is to remove friction for customers by making product expansion simple and hassle-free. A customer who may currently only use VMDR should be able to adopt all of our other applications with the click of a button. In 2021, we executed well against this objective while changing the game in security as we brought together asset inventory risk mitigation and threat detection and response into a natively integrated cloud-based platform. We believe these platform innovations have helped customers remediate vulnerabilities much faster than alternative siloed detection-only solutions. Further advancing our platform innovation agenda, I am pleased to announce that our context XDR solution is now GA. As many of you know, this is a natural extension to the Qualys Cloud Platform and our next-generation security analytics and incident response applications. Our context XDR application natively integrates and correlates asset and risk-based vulnerability contexts, patching, EDR, file integrity monitoring, and security telemetry with additional third-party data integration to provide high fidelity detection and response. Customers are telling us they want a simplified solution for security analytics and response. We believe this solution satisfies that demand as it leverages our scalable backend and its array of sensors which already collect and dish normalize and correlate trillions of data points across all environments on a single cloud agent for Qualys customers. While the overall market for this solution is still in the early innings, we are excited about this product and its potential, especially in light of the positive feedback we have received from customers who have been early adopters of our XDR capabilities. Looking ahead to 2022, we plan to maintain a dual innovation strategy. Primarily, we will continue to invest in internal R&D and scale our organization to further differentiate our automation detection and response capabilities. And we will further expand our product portfolio into EDR cloud container security and industrial control system security. Secondarily, making highly targeted and opportunistic acquisitions to enhance our platform and accelerate our time to market. As a reminder, in 2021, We completed the acquisition of TotalCloud to bring visual cloud remediation workflow technology to the Qualys cloud platform. To further support our growth agenda, we plan to invest more broadly in the business to expand our cloud platform presence and to enhance our business processes, tools, and systems to help drive better operational efficiency and business outcomes. In summary, we believe the Qualys Cloud Platform is the go-to solution for agent consolidation, cost saving, increased user productivity, and better cyber protection. We believe we are well positioned to continue our market momentum and expand our leadership as we build out our success, enhance our platform capabilities, and further extend our reach into new and adjacent markets. With that, I'll turn the call over to Jumi to further discuss our fourth quarter results and outlook for the first quarter and full year 2022.
Blair
Thanks, Hamed, and good afternoon. Before I start, I'd like to note that except for revenue, all financial figures are non-GAAP and growth rates are based on comparisons to the prior year period, unless needed otherwise. We're pleased to report continued growth acceleration and strong profitability as reflected in the following financial and operational highlights. Revenues for the fourth quarter of 2021 grew 16% to $109.8 million, up from 13% growth in Q3. While the majority of the beat was due to outperformance in renewal and upsell, with our net dollar expansion rate increasing to 108%, up from 103% last year, a higher than expected growth in new business also contributed to the revenue acceleration. With our Q4 LTN calculated current billings growth, At 18.5%, up from 16% in Q3 and 13% in Q2, we are entering the year with strong momentum and increased confidence in our ability to drive shareholder value. We believe the investments we've made in platform innovation and our single-agent approach have enhanced our value proposition with customers and helped win new business opportunities throughout the year. This quarter was no different. We're excited by the continued adoption of EMDR with total customer penetration now at 36%, up from 32% in Q3 and 19% a year ago. And continued adoption of Qualys solutions increased large customer spend, with now over 125 customers spending $500,000 or more with us. This represents a 17% growth from 2020. We attribute this success to our position as a leading security and compliance cloud-based platform that is centrally managed and self-updating, allowing our customers to consolidate their stack while helping to build security and compliance into their digital transformation initiatives. Our scalable platform model continues to drive superior margins and significant cash flow. Adjusted EBITDA for the fourth quarter of 2021 was 49.6 million, representing a 45% margin. EPS for the fourth quarter of 2021 was $0.84, and our free cash flow for the fourth quarter of 2021 was $35.5 million, representing a 32% margin. In Q4, we continued to invest the cash we generated from operations back into QALYS, including $4.3 million on capital expenditures and $35.1 million to repurchase 273,000 of our outstanding shares. Looking back on the year, we are proud to have continued our product leadership while growing revenue, earnings, and cash flow for shareholders. In 2021, with focused execution, we finally crossed the growth inflection point and started on our journey of revenue acceleration. We operated effectively through the pandemic and management changes in the company to reverse course in delivering better than expected results on both new and existing customer exams. Cloud agent adoption grew over 34% from 56 million cloud agent subscriptions a year ago, and VMDR now accounts for 46% of total bookings. This is a testament to our success in continuing to build relationships with customers and opportunities ahead to seamlessly cross out other quality solutions such as patch management, cybersecurity asset management, multivector EDR, and recently launched XDR. Notably, this was achieved even before a meaningful increase in investment with EBITDA margin of 46%. The leverage we generate demonstrates the efficiency of our model and gives us confidence in stepping up ongoing investments in the business. With the new executive team, we plan to significantly increase investments across business functions to maximize return and also to enable us to remain highly competitive in the talent market. Last year, We grew EPS by 12% and generated strong free cash flow, ending the year with a 43% margin and over $500 million of cash, cash equivalent, and marketable securities on our balance sheet. This is after returning $130 million of cash to shareholders by repurchasing approximately $1.1 million of shares. Given our highly scalable business model, even with incremental additional investments in 2022, we believe that we will continue to deliver industry-leading margins relative to peers. Shifting now to guidance for 2022. Our success validates our thesis that organizations of all sizes are increasingly looking to consolidate their security staff into a single agent with their solution. With an executive leadership team in place, armed with powerful new cloud platform capabilities, We believe the time is right for us to flex the power of a platform in the market and invest more in the business. Given this, we anticipate operating expenses to increase as we expand our sales organization and our channel efforts, as well as focus on digital marketing and demand generation initiatives. Additionally, as a leading vendor of security and compliance solutions, innovation remains a top priority. So incremental investment in our platform is anticipated to enhance automation and cloud security capabilities for our customers. And to support our growth expectations, we expect to make investments in our infrastructure and our people throughout the year. We believe these planned investments will position us to further accelerate our growth and maximize shareholder value. With that framework in mind, for 2022, We expect full-year revenues to be in the range of $482 million to $485 million, which represents a range of 17 to 18% growth. In terms of profitability, we expect full-year EPS to be in the range of 2.87 to 2.92. This implies even the margin in the high 30s with higher incremental increase in expense in the second half of the year. For the first quarter, we expect revenues to be in the range of $112.5 million to $113.1 million, which represents a range of 16% to 17% growth. We expect EPS to be in the range of $0.80 to $0.82. Our planned capital expenditures in Q1 is approximately $6 to $7 million. And for the full year 2022, we expect to invest in the range of $25 to $30 million. In conclusion, as we enter 2022, we remain excited about our opportunity to drive durable top-line growth while leveraging our highly scalable model to maintain industry-leading profitability and margin expansion in the long term. With that, Sumedh and I are happy to answer any of your questions.
Operator
As a reminder, to ask a question, you will need to press star 1 on your telephone. To withdraw your question, press the pound key. Again, that's star 1 on your touchtone telephone to ask a question. Please stand by while we compile the Q&A roster. Our first question comes from the line of Eric Supperger of JMP. Your line is open.
Eric Supperger
Yeah, thanks for taking the question and a good quarter. Talk a little bit about the competitive dynamics that you think you'll see as you start to expand into some of these markets, um, how, uh, how do you, what kind of advantage do you think you'll have as you get into the, the EDR, uh, market and, and what, uh, what features or functions do you think you'll have, uh, to, to compete against the likes of, uh, CrowdStrike and Sentinel one and some of those players?
Lateef
I thank you guys. Great question. I think when we look at, uh, the work that we have done with our customers over a period of time. I think today, a lot of organizations are dealing with siloed solutions, including a lot of the platforms that are out there are either only focused on threat detection, some are focused only on inventory. Others may be on risk motivation. And so I think where we see really the core advantage that we have, and as you saw in the release that we did with ContextXDR, is that we believe that we have a platform that is obviously highly scalable with being a collaborative platform. But it also brings a lot of the additional context that typically detection-only solutions don't offer. correlating long data. So a lot of times analysts really need to find out the context of the asset, the business context, the criticality, what is the vulnerability posture of those assets? Is it running end of life software, et cetera. And that context is missing from any of these XDR solutions out there. And so that's why, as we work with our customers and we saw the challenges that they are facing, we focused on creating a solution on top of our platform, that not only does the log aggregation and obviously we did this very natively on our platform and not really trying to put different technologies together through acquisition. It's something that we felt like natively developing on the platform would give us that native correlation that comes with having a very strong inventory capability, a very strong risk assessment capability. ability to patch. And so ultimately what it does is that it brings the various elements of security that CISOs are looking for, which is first, know what you have. Second, find and remediate your risk. And then third is threat detection and response all together in a single platform. So that ability for us to not only detect the threat actor and take response, but the same agency platform also helping patch things proactively So you're not getting compromised. We see those are some of the key advantages relative to other solutions or platforms that have sort of put together their solutions by taking different technologies.
Eric Supperger
Okay. And, Jumi, in the past, I think you've given a customer count at the end of the year. Do you have a customer count for 2021?
Blair
Yes, before, when we had disclosed over 19,000, it actually included three customers. If you take a look at just our paid customers, it's over 10,000. The growth in the customer base has been in single digits. And so in 2022, our focus and priority is to increase market share, increase in new customer stance. And we're planning to do that by increasing our quota carrying sales risk, in addition to working on some of the other metrics, performance metrics, including the win rate as well as the attainment for reps.
Eric Supperger
Did you say that historically it's been growing in the 10% range or what was the growth that you had said?
Blair
It's in the single digits. It's less than 5% for this year.
Eric Supperger
Okay. All right. Last question. Any updates on your web app security or your cloud container security business? Some of the smaller companies have been showing some good growth in that space. Any updates in terms of your progress on that front?
Lateef
Yeah, I think we continue to see the early conversations, early adoption of some of these solutions by our existing customers. And I think it really comes down to the same conversation that we have is that a lot of the smaller players they end up focusing only on the cloud aspect of it when almost all organizations have to deal with the hybrid environment that includes on-prem assets that includes assets that are remote with workers who are still working from home as well as cloud and multi-cloud and container environments all together and so when they're looking for risk as an example they would lock for shell they don't want to go before different solutions one for cloud define your exposure, one for on-prem, one for endpoints. So we do see that continuing with that consolidation and providing these capabilities on the same platform and enhancing those capabilities, which we plan to do in 2022 with additional updates to those products. I see that the customers will be looking forward to getting a more consolidated visibility rather than sort of having siloed cloud-only solutions and endpoint-only solutions.
Eric Supperger
Very good. Thank you.
Operator
Thank you. Our next question comes from Matt Hedberg of RBC Capital Markets. Your question, please.
Matt Hedberg
Matt Hedberg, thanks for taking our questions. It's nice to see the revenue acceleration for 22 here and momentum to start the year. To me, you pointed out in your prepared remarks some of the acceleration or inflection may be somewhat preceded incremental sales and marketing spend. Just curious if that evolved or maybe redirected any areas you had planned for investment previously, or was, you know, were the targeted areas more decided with budgeting based on what you saw at the time? And then maybe, you know, what was your view around determining the right magnitude of investment?
Blair
Yes, great question. With the new executive team in place, we've had some in-depth discussions with the CRO, CMO, as well as CPO and other executives to determine Where are the right priorities that we should focus on and how do we maximize our ROI? And what we decided on for 2022, there are multiple different levers that we're working on right now. And one of the key priorities is in attracting and retaining great talent. And I think part of that has to do with our quota-carrying sales rep. If you take a look at our sales and marketing headcount, In 2021, we ended the year slightly over 300, which is single digits growth over the prior year. We think that there's definitely a room there where if we're able to increase our sales force, that should help to increase our bookings growth. It's in 60% of our revenue actually comes from direct sales force versus 40% from channel. So that hasn't changed in terms of the magnitude. We're planning to increase investments to the extent possible where we've actually increased our recruiting team to make sure that we're taking advantage of the opportunity out there. I think that given the inflationary pressures and a lot of the companies are facing some challenging times, fortunately for us, given our highly profitable business model, we do have the flexibility to increase spend at this time to not only gain market share, but to scale the team and the business so that we can target a higher longer-term margin where you know, as we said before, we think that given our business model, the fundamentals remain strong. We think that there's definitely a possibility for us to get our margins back up to that 40% plus in the longer term. But for us to do that, we need to be able to accelerate the growth momentum and what we're planning to execute against that this year.
Matt Hedberg
Okay, great. And then, you know, certainly an elevated threat environment. You mentioned the the free 30-day web application scanning trial around Log4Shell in December and the prepared remarks. Just curious around the reception of that free service, you know, did that drive new customers? And then maybe more generally, you know, was Log4Shell, was that something that benefited the quarter? And then maybe, you know, does that persist through 2022?
Lateef
Yeah, I can take that. I think, you know, as you've seen with some of the services we have released throughout the year with ransomware or even SolarWinds earlier, our focus generally and as you heard in the prepared remarks as well, our focus generally is first to create a solution that will help the customer base, existing customer base, other non-customers, their ability to really protect themselves. And that's why we also released open source tools this time that were not targeted specifically at our existing customers. So our goal definitely is to show the capability of the platform and how quickly we can spin up a new service and how quickly the customers, in the case of Lock4Shell as an example, can sign up and start getting value out of a cloud-based solution where they can sign up and start using the web application scanning to detect this in a matter of minutes or hours. And so the way we look at that is that that generates engagement with the various customers and prospects, and it gives them the opportunity to experience the capabilities of Qualys. That doesn't necessarily mean that they are at the point immediately within that timeframe for changing their existing solution or acquiring any solution. But it does help us create that engagement, which, since it's a displacement focus for them, that they are ready to have experienced the Qualys capabilities when their existing products may come up for renewal, et cetera. So I think we look at that as more of an engagement strategy that allows us to have multiple points of engagement and be able to quickly show the capabilities of the platform, not just on the endpoint, but also on the web applications, as an example. And definitely, lock for shell. really highlighted how critical it is to have a really professional vulnerability management solution. But more importantly, it also highlighted that customers, it's not just a vulnerability management solution. They needed the ability to have a solid asset inventory to track, as an example, the list of software that contain lock for shell that was released by CISA that people should focus on so that ability on the platform can not only detect a vulnerable instance, but also provide asset inventory and patch management as a way to get remediation done in a broader scope and then using EDR on the same platform to track if some of those exploits are actually being executed. I think that's the engagement and the power of showing the multiple capabilities was important. So I think in Q4, I would say that a lot of, we were very focused on helping our customers who were really at that point scrambling to respond to that. And we were able to detect millions of these vulnerabilities on customer environment and help them with seeing where they are. And I would say it helped a little bit, nothing material, I would say. It helped with just some customers who wanted to maybe acquire some of those licenses that they were looking for quickly. But I do think that in 2022, it's not just specifically to Lock4Shell, but I think just the elevated conversation around Lock4Shell and ransomware and OneKit has created conversations that we think are favorable in terms of customers looking at vulnerability management, remediation, and a threat detection platform going into 2022.
Eric Supperger
That's great. Thank you.
Operator
Thank you. Our next question comes from Young Kim of Loop Capital Markets. Your question, please.
Young Kim
Thank you. Suman, Jimmy, congrats on a solid quarter and positive guidance. Good to see that business momentum is building here. Sumedh, obviously you're benefiting from the VMDR upgrade cycle within your install base that's driving that additional attach and whatnot. It looks like that's tracking very well. Can you talk about at least qualitatively the velocity and perhaps the timing of the expand once the customers upgrade to VMDR and whether is it more driven by usage or additional attach of additional products? And should we continue to expect the expansion rate improving as more of your customers are on VMDR. Thanks.
Lateef
I think it's a mix of different things. Some customers, as they see the value of VMDR, will increase the licenses for VMDR. Others, as they have deployed the agent, see the value in the remediation. So some of them, when they look for patch management, others, they have compliance requirements and they look at file integrity monitoring. And I think the advantage that I see is that Because we have so many different capabilities on the platform, we're able to meet the customer where they have the need in that particular quarter. From their business needs perspective, what is driving maybe in that quarter, they're being driven more for patch management in another quarter. They may be driven or some other customer at the same quarter may be driven by compliance needs, et cetera. So I think we look at it more holistically in terms of that our fundamental belief that VMDR is a very powerful capability and the single agent will have customers looking to see opportunities to consolidate their existing tool site. And so we're encouraged with some of the initial momentum that we're seeing and we're going to continue to track through that and make these capabilities available for customers to meet them where their needs are rather than, you know, sort of only focusing on one thing or the other.
Young Kim
Okay, great. I mean, has the timing, you know, between the initial upgrade to VMDR and then the additional purchase once they're on the platform, has that timing between the two events, you know, shrank a little bit over the almost two years now or Has that not necessarily changed? And if you look at the cohorts of the first wave of customers who upgraded to VMDR, what is their expansion rate in the second year or second year, yes?
Lateef
Yeah, like I said, I think we focused on it holistically. I don't think there's anything material there to talk about right now. But I think, you know, we continue to see the conversations of the platform consolidation driving, you know, even the initial desire to move to vulnerability management is the future ability to expand into these additional capabilities with this platform is one of the drivers there. And so we continue to see that more.
Blair
Yeah, and just to add a little bit of color to you, you can see that the magnitude and the speed of adoption is much faster than what we had anticipated with 36% of our customers now having BMDR, and it hasn't been that long since we launched BMDR. And the BMDR contribution of total bookings is now nearing 50%. So given that, what we're looking at is on a holistic basis, I think you could tell by the net dollar expansion rate that we shared. It's 108% up from 103%, and I think that, you know, that's partly definitely driven by our strategic move in launching VMDR and the attractiveness and the value proposition that our customers understand and recognize.
Young Kim
Okay, great. That makes sense. Jimmy, just kind of going back to your answer to Eric's question earlier on, is there a way to kind of look at how the mix between new and existing customers have trended, especially since the introduction of the VMDR?
Blair
We're seeing that in 2021, I think that the acceleration and the momentum in the bookings growth and that had translated into revenue growth was primarily driven by existing customers. However, with that said, new bookings did better than what we had anticipated as well. So all in all, we're seeing multiple different levers and signs that the business itself is turning around. If you're taking a look at whether it's from an average deal size increase, average deal size increase for both new customers as well as existing customers. Upsell as well as the retention is higher for existing customers. And so looking ahead in 2022, we think that the material impact to our bookings and our revenue could be driven by new customer land. We'll really focus on gaining market share at this point, and an added investment in sales and marketing will help with that.
Young Kim
Okay, great. And then in terms of your revenue guidance for fiscal year 22, should we expect fairly linear growth throughout the year, or how should we think about what we just saw in Q4 or this past quarter in terms of a strong sequential ramp in Q4?
Blair
Yeah, if you take a look at our revenue growth, it's always lagging, right? So if you take a look at our, I think current billings to revenue is a good indicator. So for example, last year on an LTM current billing basis, even though our current billings trended upward from 8% to 13%, 16%, ending the year strong at 18.5%, taking a look at the revenue growth, it was 12%, 12%, 13%, and 16%. And our guidance for Q1 is 16% to 17%. So we expect that kind of trend and momentum to continue. It won't have a material impact in terms of the revenue acceleration, the momentum, since the revenue guidance for the full year is 17% to 18%. Thank you.
Operator
Our next question comes from Andrew Smith of Barenburg Capital. Your line is open.
Andrew Smith
Hi, just with regard to the step up in investments for fiscal year 22 to further that growth, I've heard the comments on increasing quota carrying reps in digital marketing to drive new sales and I believe you also briefly mentioned investments in the channel too. Can you just break out how you're thinking about that investment? Is investment in increasing quota carrying reps a higher priority at the moment than furthering investment into the channel? Thanks.
Lateef
Yeah, I think it's, I mean, we look at, again, we look at it holistically. I think we're decided to really invest broadly across the board in our people and talent with a focus on sales and marketing. And so quarter carrying sales folks, digital marketing, even investment in product management to help with sales, better sales enablement so we can increase the productivity for sales reps. overall focus on new logo acquisition and the investment there, as well as partnerships, and also investing in solution architects as customers deploy multiple different solutions, having additional technical help that can help do the proof of concepts, et cetera. So I think it's a broad-based approach for us to invest across the board within the company, including acquiring and retaining the right talent. As you see, we continue a lot of organic development on the platform as well. So we're not just in essentially a maintenance mode or something. We continue to invest in R&D and product management as we bring out newer solutions like XDR just came out. So basically asset management came out about six months ago. as a brand new solution. And, you know, we have additional things that we're focusing on with cloud EDR with the rest of the year. So I look at it as more as a broad based investment that includes focus on sales and marketing.
Operator
Got it. Thank you. Thank you. Our next question comes from Brian Essex of Goldman Sachs. Please go ahead.
Brian Essex
Great. Good afternoon. And thank you for taking the question. Maybe Sumedh, I know last quarter you noted a partnership with Red Hat OpenShift, and I was wondering how the traction has been with that, particularly given Log4j and impact to perhaps some open source platforms.
Lateef
I mean, I think if you look at Log4j and the detections that we talked about with millions of detections across the board, I think it was not specifically concentrated just on OpenShift. However, What it also highlighted is that Lock4Shell did not impact just your traditional servers. It impacted endpoints, and it impacted cloud and container environments where we have that partnership with Red Hat. And so the customers who have been leveraging that, you know, they got a better ability to detect something like Lock4Shell in a closed environment like Red Hat OpenShift as an example. But, you know, it is something that we saw broad-based across the board in many different infrastructure that we were able to discover a lot for Shell, including the containerized environment as well. And that's sort of where the customers see the value of a platform that's bringing all these different capabilities because those customers who are on OpenShift were also at the same time trying to figure out all their endpoints of the cloud resources, everything that had locked for Shell. we were able to show that to them in a single pane of glass instead of just one aspect of the infrastructure.
Brian Essex
Got it. Super helpful. Thank you. And then maybe, Jimmy, just as we're fine-tuning our models for the guidance, just kind of baking in what the implied impact is to net income and operating margins, I think that'll be probably offset by deferred revenue growth. How should we think about free cash flow margins in light of the investment ahead? And to what extent might, you know, billings and deferred revenue offset some of the spend as you have kind of a timing difference there from a revenue recognition perspective?
Blair
Yeah, in terms of the free cash flow, we anticipate lower relative to EBITDA margin than prior years, just because we do have increase in cash taxes that we anticipate paying. I mean, with that said, we don't know what's going to happen with the tax reform, but that's one lever. The second lever is because of the new tax legislation that's going into effect in 2022 and the mandatory capitalization of R&D expenses, we do see some pressure there. As well, as the increase in CapEx spend, we are guiding to 25 to 30Million this year. Obviously, if there's an additional incremental bookings acceleration, there's additional pressure on call and it might actually be higher too. But with that said, all in all, there's no change in terms of our overall billing and different tax, like that different revenue that we anticipate this year. So there might be a little bit of pressure, but not significant.
Brian Essex
Okay, that's very helpful. Thank you.
Operator
Thank you. Our next question comes from Hamza Fadawalla of Morgan Stanley. Please go ahead.
spk09
Hey, guys. Thanks for taking my question. Before I begin, I just wanted to congratulate you over the last year taking on CEO and accelerating momentum that Qualys has had. Thank you. So, Jimmy, maybe a question for you. Do you think this is sort of the final reset, if you will, for Qualys in terms of the investment year? Because clearly, you know, you've got line of sight now into 20% revenue growth. It seems like you have the sales leadership. You've got the strategy here. Do you think this will be the year where margins finally bottom? And if so, where do you see them bottoming? I remember last year you mentioned 40% EBITDA margin was with sort of the floor that you were looking at, it seems like this year is going to be lower. So where do you see that bottom?
Blair
Great question. I'm hesitant to say the bottom and the timing of it in light of the current report that just came out. I think that last year when I had talked about I don't see a reason why we couldn't maintain EBITDA margin above 40%. I don't think any one of us expected the inflationary pressures that we're seeing right now with our latest CPI report coming out at 7.5%. And one of the things that we are keeping in mind is we feel that we're very fortunate and that we have a very strong, highly profitable and sustainable model. And so what we have based into the guidance is a wage adjustment. And given that it's increasingly important for us to attract and retain top talent. And so just to give you a little bit of color on this is Without this change in the macroeconomic trends, I think that our guidance would have been 40% plus on the EBITDA margin. So with that said, we are planning to invest outside of that in sales and marketing, our R&D, as well as customer support and operations. But, you know, if we see the ROI where that actually gives us a return that we think makes sense to further accelerate momentum in 2023 and 2004 onwards, we could have margin kind of continuing on in the high 30s or even potentially lower, but it would have to make sense and it would have to be justified from a growth perspective as well. I hope that gives a little bit of color, but I think for right now, this is what we have planned that we think that that makes sense to maximize shareholder value.
spk09
Maybe it's a follow-up, Jimmy, on your earlier comment about VMDR. So it's almost 50% of your bookings now, and you talked about the higher net retentions. So are you in this phase where the customers who may have bought VMDR at a heavily discounted rate or perhaps, you know, even bought it for almost free, you're not going back to that renewal phase and saying, hey, you know, you found value from the solution. We're not going to true up that price to what the actual value that's being delivered is.
Blair
That's not how we're approaching, and that's not the discussion that we're having with customers. We really think of it as a relationship and a partnership. And so how we're approaching it is when they recognize the value, they're actually increasing the cloud agent deployments and more prone to purchasing additional solutions as well as increasing their spend in the MDR itself. And so if you take a look at our bookings trajectory and our revenue guidance, that does take into account what we're seeing right now based on that. And I think that because of that, we're really optimistic about the potential acceleration and the momentum that we're seeing. Okay.
Operator
Thank you. Thank you. At this time, I'd like to turn the call back over to Samantha Carr for closing remarks. Sir?
Lateef
Thank you very much. In conclusion, as we enter 2022, we remain excited about our opportunity to drive durable top-line growth. while leveraging our highly scalable model to maintain industry-leading profitability and margin expansion in the future.
Operator
And this concludes today's talk.
Lateef
Thank you. Sorry, I just wanted to finish the rest of it. I had to turn over my page. Thank you all for joining today. I wanted to briefly reiterate that we believe the future of cybersecurity resides on a single unified platform driven by solutions. designed to solve key IT and security and compliance challenges. We're entering 2022 with strong momentum to accelerate growth along with a balanced approach to profitability. We look forward to sharing continued progress in coming quarters. Thank you.
Operator
And this concludes today's conference call. Thank you for participating. You may now disconnect.
Disclaimer