Qualys, Inc.

Welcome to the QALYX first quarter 2023 investor conference call. At this time, all participants are in a listen-only mode. After the speaker's presentation, there will be a question and answer session. To ask a question during the session, you'll need to press star 1-1 on your telephone. You will then hear an automated message advising your hand is raised. To remove yourself from the queue, please press star 1-1 again. Please be advised that today's conference is being recorded. I would now like to hand the conference over to your speaker today, Blair King. Please go ahead, sir.

Thank you, Norma, and good afternoon and welcome to QALYS' first quarter 2023 earnings call. Joining me today to discuss our results are Sumit Dakar, our President and CEO, and Jumi Kamar, CFO. Before we get started, I'd like to remind you that our remarks today will include forward-looking statements that generally relate to future events or future financial or operating performance. Actual results may differ materially from these statements. Factors that could cause results to differ materially are set forth in today's press release and our filings with the SEC, including our latest Form 10Q and 10K. Any forward-looking statements that we make on this call are based on assumptions as of today, and we undertake no obligation to update these statements as a result of new information or future events. During this call, we will present both GAAP and non-GAAP financial measures. A reconciliation of GAAP to non-GAAP measures is included in today's earnings press release, And as a reminder, the press release, prepared remarks, and investor presentation are all available on the investor relations section of our website. So with that, I'd like now to turn the call over to Smed.

Thanks, Blair, and welcome to our first quarter earnings call. We're pleased to announce that we delivered another quarter of healthy revenue growth and industry-leading profitability. A number of CISOs I have met with over the past several months continue to emphasize four key priorities, identifying all assets in the environment, prioritizing and quantifying cyber risk, finding fast and cost-effective solutions to address risk and ensuring adequate protection against adversaries. The importance of these priorities were further reinforced by the findings in our 2023 TrueRisk report released by Qualys' threat research unit after having analyzed 2.3 billion anonymized vulnerability detections on our platform. According to our research findings in the report, the average number of days to weaponize vulnerabilities in 2022 was 19, which is far less than the amount of time taken by IT teams to patch these vulnerabilities. Organizations are looking for platforms that can help them patch prioritized vulnerabilities before they get weaponized and exploited. The message is clear. Legacy technologies available in the market today that purely focus on generating more and more detections and alerts are not enough to help secure organizations. Against a backdrop of accelerated digital transformation and a cybersecurity skills gap, organizations require further assistance in prioritizing the most severe security findings present in their critical assets and resolving them prior to exploitation. As CISOs look to navigate the current macro and manage increased budget scrutiny, they are recognizing the need for holistic risk-based approach to quantify and align cyber risk to their business objectives and thereby be in a position to communicate effectively with their board and C-level executives. In terms of platform innovation for years, our mission at Qualys has been to drive continuous innovation to advance these initiatives. In doing so, we believe We have built a new security industry paradigm, which today leverages our powerful real-time data processing capabilities across more than 13 trillion data points on a natively integrated platform. Unlike traditional detection-only technologies, the Qualys Cloud platform is proactively enhancing security programs worldwide by not only detecting vulnerabilities and misconfigurations, but also prioritizing, remediating, and preventing risk. with over 45 million patches deployed by our cloud agents in just 2022 alone. And by leveraging the MITRE ATT&CK framework, we now further flexing the power of our platform to combine a continuous real-time view of an organization's security posture through the lens of an adversary which natively integrated preemptive risk mitigation and prevention solutions. These capabilities, along with our cloud threat detection database featuring a unified threat intelligence platform of over 25 threat feeds uniquely provide organizations with a comprehensive risk management solution to deliver quantifiable cybersecurity outcomes essential to protecting the digital infrastructure of companies. Consequently, our strategic vision to consolidate the security stack has caused industry analysts to take notice. IDC recently pointed to a future of vulnerability management which evolves into an integrated cybersecurity risk management platform. Our cybersecurity asset management with external attack surface management, along with VMDR true risk and patch management on a single platform are key to addressing this market demand. Of additional importance, the seismic shift in software application development and digital transformation using open source software is resulting in a surge of software supply chain attacks in response We are taking our innovation to the next level by extending the power of VMDR to manage the risk of software composition analysis in on-prem and cloud environments. With this extension of the Qualys Cloud Platform, security teams can automatically identify open source software across the production environment of virtual images by leveraging the same Qualys agent for deep scan detection and remediation spanning the entire application lifecycle with high efficacy and speed. This development advances our existing software composition analysis and open source software assessment capabilities for DevOps teams to secure container environments in continuous integration and deployment and at runtime as well. In addition to this enhancement, we are also advancing our custom assessment and remediation capabilities in our agent-based VMDR and policy compliance solutions. As organizations develop more and more custom software, the need to expand vulnerability management from third-party software to first-party software is increasing. With this initiative, we are enabling customers to create their own detections for managing vulnerabilities in their own custom software across their entire environment. And finally, we've continued to expand our coverage for public cloud providers by bringing real-time cloud asset discovery and prioritization remediation solutions on a single agent to Alibaba's cloud. Turning now to our go-to-market motion, Q1 remained a tough period. Despite improved upsell performance, new business was challenging as organizations continued to apply additional layers of scrutiny to spending and delay project start dates, which impacted bookings. While we expect these conditions to linger for at least the remainder of the year, consolidation remains a key theme with our customers. Given our thought leadership and continuous innovations, we are fortunate to be engaged in many such conversations. Those conversations are laying a firm foundation for future growth, and our customers are on a long-term transformation journey with us. Existing customers continuing to invest in consolidation with Qualys' platform was evidenced in Q1 by the steady adoption of VMDR, which is now deployed by 50% of our customers worldwide. A few key seven-figure annualized bookings wins with VMDR in the quarter included two global 200 financial institutions, which shows Qualys for its ability to replace traditional siloed security tools and enhance security posture on a unified platform. And one of the world's largest healthcare providers that is leveraging VMDR with TrueRisk to manage a comprehensive risk management platform in both on-prem environments and cloud workloads. Beyond these wins, let's take a look at additional examples that demonstrate how the power of Qualys cloud platform translated into strategic customer wins and provided immediate value to the customer. First, with zero trust transformation underway, we are helping customers standardize their operations across a broad spectrum of security subscriptions. In a high six-figure annualized bookings, a large government agency aspired to move beyond its detection-only solution, further expanded its use of VMDR and policy compliance by adding custom assessment and remediation, cybersecurity asset management, action management, and custom XDR, context XDR. This customer, Selector Qualys, because we offer the only security and compliance stack available in the market today that utilizes both a FedRAMP authorized platform and a single lightweight agent to enable full asset visibility and context-aware mapping to prioritize vulnerabilities, proactively reduce technical debt, automate patching, and future-proof their security architecture with high-fidelity incidence response capabilities across all environments. This is also a good example of how we are benefiting from the investments we're making in the channel to drive new business opportunities. Another marquee six-figure annualized bookings enterprise customer win in Q1 was with a leading business services company in the Fortune 500. This customer expanded their VMDR deployment with TrueRisk while adopting cybersecurity asset management and patch management as part of an initiative to transform its IT security architecture while replacing point solutions from two vendors to the single platform. The ability of this customer to significantly enhance the security program with comprehensive internal and external asset criticality, holistic risk scoring, ticketing and automated patching across multiple environments on natively integrated platform are all key differentiators compared to alternative legacy technologies. With customers beginning to perceive Qualys as a leading risk management platform that consolidates multiple point solutions, we are growing increasingly confident in our ability to drive long-term growth and gain market share. This confidence was again bolstered in Q1 as customers spending $500,000 or more with us grew 27% from a year ago to 162. Growing our partner ecosystem continues to be a key pillar in our go-to-market agenda. In this quarter, we expanded our partnership with a leading MSSP in North America, With its platform already anchored in our VMDR solution, this partner is now launching a managed patching service, further validating our vision that organizations need help with timely remediation and not just more and more detections. This MSSP is standardizing on Qualys' automated patching solutions across Windows, Linux, and Mac operating environments, mobile devices, and third-party applications without the need for a VPN. In addition, illustrating the fast progress we are making in our external attack surface management EASM solution, we extended our relationship with a leading cyber insurance company, which is now ingesting our EASM intelligence field to continuously assess the risk for adaptive cyber insurance for their customers. Furthering our efforts to remove friction in the sales cycle by helping customers accelerate their cloud transformations and consolidate their security stack, We have introduced a new adaptive subscription model for organizations to extend the existing VMDR deployments into cloud and container environments for CSTM and CWPP through our total cloud solution. The early feedback we have received from customers for this model is quite encouraging, and we are looking forward to early adopter customers in the current quarter. In summary, it's our view that during times like this, the best companies continue to innovate, focus on customer satisfaction, and emerge stronger than before. Looking beyond the short term, we believe the powerful combination of our cloud-native platform and frictionless go-to-market motion positions us well for the fundamental holistic risk management platform of the future. Throughout the balance of this year, we will continue to focus on executing our strategic vision, driving customer success, and expanding our lead over the competition with a proven approach to balancing growth and profitability. With that, I will turn the call over to Jumi to further discuss our first quarter results and outlook for the second quarter and full year 2023.