News.

2018 Revenue Growth of 21% Year-Over-Year Q4 Revenue Growth of 18% Year-Over-Year 2018 GAAP EPS: $1.37; 2018 Non-GAAP EPS: $1.75 Q4 GAAP EPS: $0.35; Q4 Non-GAAP EPS: $0.51  

 

Foster City, Calif., – Feb. 12, 2019 – Qualys, Inc. (NASDAQ: QLYS), a pioneer and leading provider of cloud-based security and compliance solutions, today announced financial results for the fourth quarter and full year ended December 31, 2018. For the quarter, the Company reported revenues of $74.2 million, net income under United States Generally Accepted Accounting Principles (“U.S. GAAP”) of $14.4 million, non-GAAP net income of $21.3 million, Adjusted EBITDA of $29.1 million, GAAP earnings per diluted share of $0.35, and non-GAAP earnings per diluted share of $0.51. For the full year ended December 31, 2018, the Company reported revenues of $278.9 million, GAAP net income of $57.3 million, non-GAAP net income of $73.4 million, Adjusted EBITDA of $112.4 million, GAAP earnings per diluted share of $1.37 and non-GAAP earnings per diluted share of $1.75.

 

“We achieved a solid fourth quarter, ending a strong year during which we grew revenues by 21%, produced record margins, saw new solutions contribute 20% of bookings and benefited from increased multi-product adoption.  We delivered an impressive suite of new technology and application components to our Qualys Cloud Platform, including our innovative Global IT Asset Inventory application,” said Philippe Courtot, chairman and CEO of Qualys. “We believe that the scalability, accuracy, immediacy and breadth of our Qualys Cloud Platform continues to enable organizations across the globe to build security into their digital transformation initiatives as well as to consolidate their IT, security and compliance stacks.”

 

Fourth Quarter 2018 Financial Highlights

 

Revenues: Revenues for the fourth quarter of 2018 increased by 18% to $74.2 million compared to $62.9 million for the same quarter in 2017.

 

Gross Profit: GAAP gross profit for the fourth quarter of 2018 increased by 17% to $56.7 million compared to $48.5 million for the same quarter in 2017. GAAP gross margin percentage was 76% for the fourth quarter of 2018 compared to 77% for the same quarter in 2017. Non-GAAP gross profit for the fourth quarter of 2018 increased by 18% to $58.6 million compared to $49.5 million for the same quarter in 2017. Non-GAAP gross margin percentage was 79% for the fourth quarter of 2018 compared to 79% for the same quarter in 2017.

 

Operating Income: GAAP operating income for the fourth quarter of 2018 increased by 33% to $12.9 million compared to $9.7 million for the same quarter in 2017. As a percentage of revenues, GAAP operating income was 17% for the fourth quarter of 2018 compared to 15% for the same quarter in 2017. Non-GAAP operating income for the fourth quarter of 2018 increased by 22% to $22.8 million compared to $18.7 million for the same quarter in 2017. As a percentage of revenues, non-GAAP operating income was 31% for the fourth quarter of 2018 compared to 30% for the same quarter in 2017.

 

Net Income: GAAP net income for the fourth quarter of 2018 was $14.4 million, or $0.35 per diluted share, compared to $2.9 million, or $0.07 per diluted share, for the same quarter in 2017. Non-GAAP net income for the fourth quarter of 2018 was $21.3 million, or $0.51 per diluted share, compared to non-GAAP net income of $13.0 million, or $0.32 per diluted share, for the same quarter in 2017. Non-GAAP net income benefited from a $2.3 million true-up of the non-GAAP tax rate; without this benefit, non-GAAP net income for the fourth quarter of 2018 would have been $19.0 million, or $0.46 per diluted share.

 

Adjusted EBITDA: Adjusted EBITDA (a non-GAAP financial measure) for the fourth quarter of 2018 increased by 22% to $29.1 million compared to $23.8 million for the same quarter in 2017. As a percentage of revenues, Adjusted EBITDA was 39% for the fourth quarter of 2018 compared to 38% for the same quarter in 2017.

 

Operating Cash Flow: Operating cash flow for the fourth quarter of 2018 increased by 3% to $26.7 million compared to $25.9 million for the same quarter in 2017. As a percentage of revenues, operating cash flow was 36% for the fourth quarter of 2018 compared to 41% for the same quarter in 2017.

 

Adoption of the new revenue recognition standard (ASC 606): As a result of adopting ASC 606 on January 1, 2018, the company capitalizes commission expenses relating to new and upsell business as contract acquisition costs, and amortizes the expense over 5 years. Without the adoption of ASC 606, commission expenses would have been $1.0 million higher in the fourth quarter of 2018.

 

Fourth Quarter 2018 Business Highlights

 

Select New Customers:

• Banco Santander Spain, Castlight Health, Cathay Pacific, Children’s Hospital Colorado, Databricks, Dyson Ltd., Kering, Old Mutual South Africa, Owens & Minor, Inc., Post Holdings, Shoprite Holdings, State of Kansas, Wind Tre S.p.A. 

Business Highlights:

• Launched the Qualys Container Security solution on the new AWS Marketplace for Containers, enabling customers to gain visibility and security of containerized applications running on Amazon Web Services (AWS), in just a few clicks.
• Announced an integration with AWS Security Hub, which provides Qualys vulnerability and policy compliance findings within AWS Security Hub, allowing users to prioritize risks and automate remediation using native services such as AWS Lambda.

Full Year 2018 Financial Highlights

 

Revenues: Revenues for 2018 increased by 21% to $278.9 million compared to $230.8 million for 2017.

 

Gross Profit: GAAP gross profit for 2018 increased by 19% to $212.7 million compared to $179.2 million for 2017. GAAP gross margin percentage was 76% for 2018 compared to 78% for 2017. Non-GAAP gross profit increased by 20% to $218.8 million for 2018 compared to $181.9 million for 2017. Non-GAAP gross margin percentage was 78% for 2018 compared to 79% for 2017.

 

Operating Income: GAAP operating income for 2018 was $50.4 million compared to $37.2 million for 2017. Non-GAAP operating income for 2018 was $87.2 million compared to $65.0 million for 2017.

 

Net Income: GAAP net income for 2018 was $57.3 million, or $1.37 per diluted share, compared to $40.4 million, or $1.01 per diluted share, for 2017. Non-GAAP net income for 2018 was $73.4 million, or $1.75 per diluted share, compared to non-GAAP net income of $43.7 million, or $1.09 per diluted share, for 2017.

 

Adjusted EBITDA: Adjusted EBITDA (a non-GAAP financial measure) for 2018 increased by 32% to $112.4 million compared to $84.9 million for 2017. As a percentage of revenues, Adjusted EBITDA was 40% for 2018 compared to 37% for 2017.  

 

Operating Cash Flow: Operating cash flow for 2018 was $125.5 million compared to $107.6 million for 2017. As a percentage of revenues, operating cash flow was 45% in 2018 compared to 47% in 2017.

 

Additional Full Year 2018 Business Highlights

 

Market Recognition

• Recognized by IDC for the third year in a row as the market-share leader in the $2.0 billion Worldwide Vulnerability Assessment Market, and as having the fifth largest market share in the $6.7 billion Worldwide Security and Vulnerability Management market.

Products & Features

• Launched disruptive new solutions and features:
  • Asset Inventory (AI): a new Cloud App with capabilities that provide customers a single ‘source of truth’ for IT assets spread across hybrid environments including on-premises assets, endpoints and clouds, with synchronization capabilities to Configuration Management Databases (CMDBs) to keep asset data up-to-date.
  • Qualys Container Security (CS): A new Cloud App that enables customers to build continuous security into their global container deployments and DevOps processes at any scale, and to integrate the results into one unified view of their global hybrid IT security and compliance posture, breaking down silos and lowering ownership cost.
  • Cloud Inventory (CI) and Cloud Security Assessment (CSA): New Cloud Apps that deliver continuous visibility into public cloud accounts and provide an assessment of the security posture of an organization’s cloud resources against misconfigurations, malicious behavior, and nonstandard deployments.
  • Certificate Inventory (CRI) and Certificate Assessment (CRA): CRI continuously scans global IT assets from a single console to discover internal and external certificates issued from any certificate authority across all enterprise IT assets, both on premises and in clouds. CRA assesses certificates and underlying SSL/TLS configurations and vulnerabilities across global IT assets to prevent downtime and outages, and mitigate risks from expired or vulnerable SSL/TLS certificates and configurations.
  • Web Application Scanning (WAS) 6.0: A new integration with Jenkins, Swagger and a new Chrome Browser Recorder extension further automate web application scanning in DevOps, and streamline REST API testing to help teams automate and operationalize global DevSecOps throughout the Software Development Lifecycle (SDLC).
  • Out-of-Band Configuration Assessment (OCA): a sensor and Cloud App that allows customers to achieve complete visibility of all known IT infrastructure by pushing vulnerability and configuration data to the Qualys Cloud Platform from systems that are otherwise difficult or impossible to assess.
  • Passive Network Sensor (PNS): a new member of the Qualys sensor family that natively integrates network analysis functions into the Qualys Cloud Platform, delivering customers complete IT visibility at scale, while drastically reducing cost and complexity. Currently in beta.
  • New Cloud Security Assessment features for monitoring and assessment for the Center for Internet Security, Inc. (CIS) Microsoft Azure Foundations Benchmark.
  • New functionality in our Security Assessment Questionnaire (SAQ) Cloud App that allows customers to better achieve visibility of data across their own network and supply chain for compliance with the European Union’s General Data Protection Regulation (GDPR).
• Introduced the Qualys Consulting Edition, a comprehensive offering for consultants, security consulting organizations and managed service providers (MSPs) that brings them the power and scale of the Qualys Cloud Platform in an easy-to-deploy, easy-to-use and cost-effective solution.
• Delivered three new free groundbreaking solutions:
  • CertView, which helps customers inventory and assess certificates and underlying SSL/TLS configurations and vulnerabilities across external-facing assets to prevent downtime and outages, and to mitigate risks associated with expired or vulnerable SSL/TLS certificates and configurations.
  • CloudView, which delivers customers topological visibility and insight about the security and compliance posture of their public cloud infrastructure for major providers including AWS, Microsoft Azure and Google Cloud.
  • Qualys Community Edition, which gives small organizations unified visibility of their own or their clients’ IT and web assets, allowing users to leverage the Qualys Cloud Platform to automatically gather and analyze security and compliance data from hybrid IT environments.
• Accelerated technology roadmap with key acquisitions and investments:
  • Acquired the software assets of 1Mobility, Singapore, allowing Qualys to provide enterprises the ability to inventory and assess mobile devices, and quarantine compromised or out-of-compliance devices. It also allows Qualys to extend its PCI certification to mobile devices and to deliver a highly scalable Enterprise Mobility Management (EMM) solution.
  • Acquired container-native security company Layered Insight, enabling Qualys to add runtime defense capabilities and automated enforcement to its current Container Security solution, and to automatically correlate deep runtime behavioral analysis with Qualys’ leading threat protection capabilities — delivering DevOps teams high runtime application protection without added container management complexity.
  • Purchased a minority stake in 42Crunch Ltd. as the first Qualys venture investment and simultaneously signed a distribution agreement. 42Crunch has developed an API security platform enabling organizations to quickly deliver applications built on secure APIs.

Business Development

• Provided an integration with the Cloud Security Command Center (Cloud SCC) for Google Cloud Platform (GCP), providing security teams a single pane for security features, policies, and insights across Google Cloud platform, and adding vulnerability management and threat data for compute engine instances within a GCP project.
• Delivered an integration with Illumio's solutions to deliver the industry's first vulnerability-based micro-segmentation, which enables organizations to visualize vulnerabilities across data centers and clouds through a real-time global vulnerability map.
• Expanded our partnership under which Carahsoft will proactively market, sell and distribute the FedRAMP-authorized Qualys Gov Platform to federal agencies as well as state and local governments.
• Deepened the existing relationship with IBM X-Force Red to leverage the Qualys Cloud Platform as part of its Vulnerability Management Services (VMS), deploying the Qualys Cloud Agent and Qualys Cloud Apps into client environments as part of a programmatic vulnerability management approach to identify, prioritize and remediate clients’ most critical vulnerabilities.
• Announced a new integration with Microsoft Azure Stack that provides a single-pane view of the security and compliance posture of Microsoft Azure infrastructure and user workloads, allowing Azure customers to assess the vulnerability and compliance posture of Azure Stack’s control plane infrastructure, and get the advisory published by Microsoft Azure.
• Announced a joint solution, the Healthcare Cloud Security Stack (HCSS) for Microsoft Azure, which allows healthcare entities to build security into their data-driven healthcare decision-making applications as they migrate workloads to the cloud.

Financial Performance Outlook

 

First Quarter 2019 Guidance: Management expects revenues for the first quarter of 2019 to be in the range of $74.5 million to $75.2 million, representing 15% to 16% growth over the same quarter in 2018. GAAP net income per diluted share is expected to be in the range of $0.16 to $0.18, which assumes an effective income tax rate of 26%. Non-GAAP net income per diluted share is expected to be in the range of $0.41 to $0.43, which assumes an effective non-GAAP income tax rate of 22%. First quarter 2019 earnings per share estimates are based on approximately 41.6 million weighted average diluted shares outstanding for the quarter.

 

Full Year 2019 Guidance: Management expects revenues for the full year 2019 to be in the range of $320.0 million to $323.0 million, representing 15% to 16% growth over 2018. GAAP net income per diluted share is expected to be in the range of $0.90 to $0.95, which assumes an effective income tax rate of 26%. Non-GAAP net income per diluted share is expected to be in the range of $1.84 to $1.89, which assumes an effective non-GAAP income tax rate of 22%. Full year 2019 earnings per share estimates are based on approximately 42.1 million weighted average diluted shares outstanding.

 

Investor Conference Call

Qualys will host a conference call and live webcast to discuss its fourth quarter and full year 2018 financial results at 5:00 p.m. Eastern Time (2:00 p.m. Pacific Time) on Tuesday, Feb. 12, 2019. To access the conference call, dial (877) 881-2609 in the U.S. or (970) 315-0463 for international participants with conference ID # 2274058. The live webcast of Qualys' earnings conference call, investor presentation, and prepared remarks can also be accessed at https://investor.qualys.com/events.cfm. A replay of the conference call will be available through the same webcast link following the end of the call.

 

Investor Contact

Natasha Asar
Investor Relations
(650) 801-6172
ir@qualys.com

 

About Qualys, Inc.

 

Qualys, Inc. (NASDAQ: QLYS) is a pioneer and leading provider of cloud-based security and compliance solutions with over 12,200 customers and active users in more than 130 countries, including a majority of each of the Forbes Global 100 and Fortune 100. Qualys helps organizations streamline and consolidate their security and compliance solutions in a single platform and build security into digital transformation initiatives for greater agility, better business outcomes and substantial cost savings. The Qualys Cloud Platform and its integrated Cloud Apps deliver businesses critical security intelligence continuously, enabling them to automate the full spectrum of auditing, compliance and protection for IT systems and web applications on premises, on endpoints and elastic clouds. Founded in 1999 as one of the first SaaS security companies, Qualys has established strategic partnerships with leading managed service providers and consulting organizations including Accenture, BT, Cognizant Technology Solutions, Deutsche Telekom, DXC Technology, Fujitsu, HCL Technologies, IBM, Infosys, NTT, Optiv, SecureWorks, Tata Communications, Verizon and Wipro. The company is also a founding member of the Cloud Security Alliance. For more information, please visit www.qualys.com.

Qualys and the Qualys logo are proprietary trademarks of Qualys, Inc. All other products or names may be trademarks of their respective companies.

 

Legal Notice Regarding Forward-Looking Statements

 

This press release contains forward-looking statements within the meaning of Section 27A of the Securities Act of 1933 and Section 21E of the Securities Exchange Act of 1934. Forward-looking statements generally relate to future events or our future financial or operating performance. Forward-looking statements in this press release include, but are not limited to, statements related to: our expectations regarding our suite of new technology and application components added to our Qualys Cloud Platform; our expectations regarding our IT asset management application; the capabilities of our platform; the related benefits of our strategic acquisitions; the related benefits of our new products, integrations, collaborations and joint solutions; our strategy and our business model and our ability to execute such strategy; our guidance for revenues, GAAP EPS and non-GAAP EPS for the first quarter and full year 2019, and our expectations for the number of weighted average diluted shares outstanding and effective income tax rate for the first quarter and full year 2019. Our expectations and beliefs regarding these matters may not materialize, and actual results in future periods are subject to risks and uncertainties that could cause actual results to differ materially from those projected. These risks include our ability to continue to develop platform capabilities and solutions; the ability of our platform and solutions to perform as intended; customer acceptance and purchase of our existing solutions and new solutions; real or perceived defects, errors or vulnerabilities in our products or services; our ability to retain existing customers and generate new customers; the budgeting cycles, seasonal buying patterns and length of our sales cycle; our ability to manage costs as we increase our customer base and the number of our platform solutions; the market for cloud solutions for IT security and compliance not increasing at the rate we expect; competition from other products and services; fluctuations in currency exchange rates, unexpected fluctuations in our effective tax rate on a GAAP and non-GAAP basis, our ability to effectively manage our rapid growth and our ability to anticipate future market needs and opportunities; any unanticipated accounting charges; and general market, political, economic and business conditions in the United States as well as globally. The forward-looking statements contained in this press release are also subject to other risks and uncertainties, including those more fully described in our filings with the Securities and Exchange Commission, including our Quarterly Report on Form 10-Q for the quarter ended September 30, 2018, filed with the Securities and Exchange Commission on November 5, 2018.

The forward-looking statements in this press release are based on information available to Qualys as of the date hereof, and Qualys disclaims any obligation to update any forward-looking statements, except as required by law.

 

Non-GAAP Financial Measures

In addition to reporting financial results in accordance with generally accepted accounting principles, or GAAP, Qualys monitors operating measures of non-GAAP gross profit, non-GAAP gross margin, non-GAAP operating expenses, non-GAAP operating income, non-GAAP net income, non-GAAP net income per diluted share and Adjusted EBITDA. In computing these non-GAAP financial measures, Qualys excludes the effects of stock-based compensation expense, non-recurring expenses and cash acquisition-related expenses that do not reflect ongoing costs of operating the business. Qualys also monitors Adjusted EBITDA (defined as earnings before interest, taxes, depreciation, amortization, stock-based compensation, other (income) expense, net, non-recurring expenses, and cash acquisition-related expenses that do not reflect ongoing costs of operating the business). Qualys believes that these non-GAAP operating metrics help illustrate underlying trends in its business that could otherwise be masked by the effect of the income or expenses, as well as the related tax effects, that are excluded in non-GAAP gross profit, non-GAAP gross margin, non-GAAP operating expenses, non-GAAP operating income, non-GAAP net income, non-GAAP net income per diluted share and Adjusted EBITDA.

 

Furthermore, Qualys uses these operating measures to establish budgets and operational goals for managing its business and evaluating its performance. Qualys believes that non-GAAP gross profit, non-GAAP gross margin, non-GAAP operating expenses, non-GAAP operating income, non-GAAP net income, non-GAAP net income per diluted share, and Adjusted EBITDA provide additional tools for investors to use in comparing its recurring core business operating results over multiple periods with other companies in its industry. Non-GAAP net income and non-GAAP net income per diluted share for the twelve months ended December 31, 2018 excludes $3.7 million of amortization of intangibles from acquisitions of Nemean, Nevis Networks, NetWatcher, 1Mobility and Layered Insight and $3.0 million of compensation expense from the acquisition of NetWatcher and Layered Insight that do not reflect ongoing costs of operating the business.

 

Qualys has not reconciled non-GAAP net income per diluted share guidance to GAAP net income per diluted share because Qualys does not provide guidance on the various reconciling cash and non-cash items between GAAP net income and non-GAAP net income (i.e., stock-based compensation and non-recurring expenses). The actual dollar amount of reconciling items in the first quarter and full year 2019 is likely to have a significant impact on the Company’s GAAP net income per diluted share in the first quarter and full year 2019. Accordingly, a reconciliation of the non-GAAP net income per diluted share guidance to the GAAP net income per diluted share guidance is not available without unreasonable effort.

 

In order to provide a more complete picture of recurring core operating business results, the Company’s non-GAAP net income and non-GAAP net income per diluted share include tax adjustments required to achieve the effective tax rate on a non-GAAP basis, which could differ from the GAAP effective tax rate. The Company believes its estimated non-GAAP effective tax rate of 22% in 2019 is a reasonable estimate under its global operating structure. The Company may adjust this rate during the year to take into account events or trends that it believes materially impact the estimated annual rate. The non-GAAP effective tax rate could be subject to change for a number of reasons, including but not limited to, significant changes resulting from tax legislation, material changes in geographic mix of revenues and expenses and other significant events.

 

The presentation of this non-GAAP financial information is not intended to be considered in isolation or as a substitute for results prepared in accordance with GAAP. A reconciliation of the non-GAAP financial measures discussed in this press release to the most directly comparable GAAP financial measures is included with the financial statements contained in this press release. Management uses both GAAP and non-GAAP information in evaluating and operating its business internally and as such has determined that it is important to provide this information to investors.

Qualys, Inc.

CONDENSED CONSOLIDATED STATEMENTS OF OPERATIONS

(Unaudited)

(in thousands, except per share data)

	Three Months Ended								Year Ended
	December 31,								December 31,
	2018				2017				2018				2017
Revenues	$	74,200			$	62,915			$	278,889			$	230,828
Cost of revenues (1)	17,525				14,405				66,185				51,580
Gross profit	56,675				48,510				212,704				179,248
Operating expenses:
Research and development (1)	15,073				11,576				53,255				42,816
Sales and marketing (1)	19,341				16,983				70,039				63,855
General and administrative (1)	9,318				10,222				39,049				35,334
Total operating expenses	43,732				38,781				162,343				142,005
Income from operations	12,943				9,729				50,361				37,243
Other income, net:
Interest expense	(60		)		—				(172		)		(3		)
Interest income	1,887				899				6,080				2,674
Other income (expense), net	35				(247		)		(801		)		(536		)
Total other income, net	1,862				652				5,107				2,135
Income before income taxes	14,805				10,381				55,468				39,378
(Benefit from) provision for income taxes	405				7,524				(1,836		)		(1,062		)
Net income	$	14,400			$	2,857			$	57,304			$	40,440
Net income per share:
Basic	$	0.37			$	0.07			$	1.47			$	1.08
Diluted	$	0.35			$	0.07			$	1.37			$	1.01
Weighted average shares used in computing net income per share:
Basic	39,200				38,278				38,876				37,443
Diluted	41,580				41,186				41,897				40,071
(1) Includes stock-based compensation as follows:
Cost of revenues	$	601			$	590			$	2,489			$	2,159
Research and development	2,207				1,715				7,961				5,944
Sales and marketing	981				1,311				4,650				4,755
General and administrative	3,629				4,823				14,990				14,103
Total stock-based compensation	$	7,418			$	8,439			$	30,090			$	26,961

Qualys, Inc.

RECONCILIATION OF NON-GAAP DISCLOSURES

FREE CASH FLOWS

(Unaudited)

(in thousands)

	Year Ended December 31,
	2018				2017
GAAP Cash flows provided by operating activities (1)	$	125,464			$	107,646
Less:
Purchases of property and equipment	(22,775		)		(37,818		)
Principal payments under capital lease obligations	(1,617		)		—
Non-GAAP Free cash flows	$	101,072			$	69,828

Note (1): Includes $2.0 million of compensation paid during the year ended 2018 related to acquired assets.