Qualys (QLYS) Q3 2019 Earnings Call Transcript

Qualys (QLYS 0.36%)
Q3 2019 Earnings Call
Oct 30, 2019, 5:00 p.m. ET

Contents:

• Prepared Remarks
• Questions and Answers
• Call Participants

Prepared Remarks:

Operator

Good day, everyone, and welcome to Qualys' third-quarter 2019 earnings conference call. This call is being recorded. [Operator instructions] I would now like to turn the call over to Vinayak Rao, vice president, corporate development and investor relations. Please go ahead, sir.

Vinayak Rao -- Vice President, Corporate Development, and Investor Relations

Good afternoon and welcome to Qualys' third-quarter 2019 earnings call. Joining me today to discuss our results are Philippe Courtot, our chairman and CEO; and Melissa Fisher, our CFO. Before we get started, I would like to remind you that our remarks today will include forward-looking statements that generally relate to future events or our future financial or operating performance. Actual results may differ materially from these statements.

Factors that could cause results to differ materially are set forth in today's press release; and in our filings with the SEC, including our latest Form 10-Q and 10-K. Any forward-looking statements that we make on this call are based on assumptions as of today, and we undertake no obligation to update these statements as a result of new information or future events. During this call, we will present both GAAP and non-GAAP financial measures. A reconciliation of GAAP to non-GAAP measures is included in today's earnings press release.

As a reminder, the press release, prepared remarks, investor presentation and supplemental historical financial spreadsheet are available on our website. With that, I'd like to turn the call over to Philippe.

Philippe Courtot -- Chairman and Chief Executive Officer

Thank you very much, Vin. And welcome, everyone, to our Q3 earnings call. Melissa and I are really pleased to report another solid quarter in terms of revenue growth and profitability. We also are very pleased to report strong growth in our paid Cloud Agent subscriptions with almost 28 million now, 93% growth from prior year quarter.

As discussed before, our Cloud Agent is the technology platform for seven security, compliance and IT solutions available now, namely vulnerability management, Policy Compliance, file integrity monitoring, Indication of Compromise, patch management, Asset Inventory and the upcoming certificate management and with more to come. In terms of our newer solution, we saw strong growth again this quarter from FIM and we continue to build a healthy pipeline in patch management and container security. At Black Hat this quarter, we launched our Global IT Asset Discovery and Inventory app as a free service. We receive very positive feedback, as I think most of you know already, from our customers and industry luminaries because global IT asset inventory is one of the biggest challenges, if not the biggest challenge, for organizations.

Visibility is the cornerstone of security, as you simply cannot secure what you do not know or see. With our free service, companies of all sizes can automatically build their global IT asset inventory across on-premise, end points, cloud, containers and now mobile environment; as well as identified in real time everything that connects to their networks. Only 2.5 months ago after the launch, we have approximately -- we had approximately 3,650 companies signed up, with over 500 new customers using the service. We have also been rolling out the free service to existing customers since last month and now have almost 300 existing customers using it.

As a result, our goal to make our Cloud Agents ubiquitous is now well on its way and allows us to make the subscription to our paid apps frictionless because no additional infrastructure is required. Distributing such a free solution from our platform to generate meaningful demand of our paid apps is one of the key elements of our profitable growth, driving value for both our customers and shareholders. Furthermore, this multiproduct adoption naturally increases the stickiness of our platform and helps make us impenetrable to our competitor who do not offer the same breadth of solutions. This is underscored by the fact that the gross dollar retention rates of customers who have adopted four solution or more stands at 99%.

We continue to invest in expanding the capabilities of our cloud platform and developing additional solutions, and we will showcase significant new offerings at our upcoming QSC or the -- or user conference in Las Vegas on November 20 and 21. At the conference, our attendees will have the opportunity to listen to industry experts such as Richard Clarke, author of The Fifth Domain and formerly a czar in the White House; Scott Crawford from the 451 Research, 4-5-1; as well as Ramesh Chinta from Microsoft Azure, who will discuss how Microsoft is building security into Azure and, of course, of the role that Qualys plays in it; and Charles Henderson, from IBM X-Force Red, who will talk about their efforts to automate pen testing and more quickly respond to eliminating vulnerabilities. And they are a very big user of Qualys as well. You will also hear fascinating presentation from our customers, who will share their experiences and best practices, also their views on how their security needs are evolving and how mission critical Qualys is becoming for them.

Our President and Chief Product Officer, Sumedh, which we promoted recently, and I will discuss that later, will unveil our next generation of vulnerability management offering that brings it to its next level and showcase our forthcoming EDR and data lake/SIEM initiatives. In addition, among other innovative solutions, we will discuss the forthcoming updates to our container security and the capabilities we have now of threat hunting with Qualys. And you can click, you can go to our website and look at the agenda as well. I would like to personally invite you to both our user conference and a dedicated institutional investors and analysts session that will occur during the conference on November 20.

This event will focus on how Qualys is driving sustainable growth and profitable growth and will include a demonstration of our newest application as well and with a Q&A session from select Qualys customers. Finally, in -- the expansion of cloud platform, which now deliver an impressive suite of security and compliance solution; as well as our buildup of operation in Pune where we have now more than 750 employees, was led by our chief product officer, Sumedh Thakar. And I'm delighted to announce his promotion to president and chief product officer. Sumedh started at Qualys in 2003 and, through outstanding performances, now runs R&D, QA, ops, product marketing and customer support.

And with this promotion, he will also run worldwide field sales operation. And as we continue to lay the foundation for our future growth, we also promoted Laurie MacCarthy to EVP, worldwide field operation. Laurie joined Qualys in 2012 and was most recently VP, field operations for the Americas. And Laurie came from one of our customers, where she was running one of the absolutely extremely good program, the vulnerability program -- vulnerability management program, at CVS which was really second to none.

In addition, we promoted Dilip Bachwani to SVP, cloud platform, ops and DevOps. Dilip joined Qualys in 2016 and was our VP of DevOps. And finally, we welcome the addition of Mustafa Mahudhawala, and I'm not so sure if I know how to pronounce it correctly, as our VP of global customer service. And Mustafa is coming from Red Hat.

Our product and platform achievement and expansion of our management team lays the foundation for our continued progress to enable customers to consolidate their security, IT and compliance stack while drastically reducing their spend. As importantly, it is core to the highly profitable recurring and growing revenue model we have built. And with that, I will turn the call over to Melissa to discuss our financial results.

Melissa Fisher -- Chief Financial Officer

Thanks, Philippe. And good afternoon. Before I start, I'd like to note that, except for revenue, all financial figures are non-GAAP and growth rates are based on comparisons to the prior year period, unless stated otherwise. We're delighted with our increasing Cloud Agent subscriptions and multiproduct adoption which lays the foundation for future revenue growth and industry-leading profitability.

Our Q3 financial and operational highlights include: Revenues for the third quarter of 2019 grew 15% to $82.7 million. Platform adoption continued to increase, as the percentage of enterprise customers with three or more Qualys solutions rose to 46% from 39% and the percentage of enterprise customers with four or more Qualys solutions increased to 26% from 20%. Paid Cloud Agent subscriptions increased to 27.9 million over these last 12 months, up from 23.6 million for the 12 months ended in Q2 2019. Two million additional Cloud Agents were purchased this quarter by a single cloud platform customer.

New products released since 2015 contributed approximately 33% of total bookings in the quarter, up from 23%. And our average deal size continues to increase, growing 8%. Our scalable platform model continues to drive superior margins and generate significant cash flow. Adjusted EBITDA for the third quarter of 2019 was $39.2 million, representing a 47% margin versus 45%.

We continued to increase our head count sequentially, and we benefited from attracting great talent in Pune as well as lower nonsalary head count costs and lower third-party expenses this quarter as compared to Q2 2019. Q3 EPS grew 34%. And we generated strong free cash flow for the third quarter of 2019 of $39.9 million. And year to date, our free cash flow has increased 36% versus the same period last year.

In Q3, we continued to invest the cash we generate from operations back into Qualys, including $5.8 million on capital expenditures, including principal payments under capital lease obligations; and $49.8 million to repurchase 603,417 of our outstanding shares. Our Board has authorized an additional two-year $100 million open-market share repurchase program, resulting in approximately $141 million in current share repurchase capacity. We remain confident in our model driven by our foundation of recurring revenues and expanding suite of applications. Our current fiscal year 2019 revenue guidance is now a range of $321.2 million to $321.8 million.

We are raising fiscal year 2019 non-GAAP EPS from a range of $2.03 to $2.07 to a range of $2.28 to $2.30. We now expect to expand EBITDA margins this year, and we expect our fiscal year of 2019 EBITDA margin to be between 42.5% and 43%. And for the fourth quarter, we expect capital expenditures to be in the range of $9 million to $10 million, which includes approximately $3.5 million for the first phase of the buildout of a new Qualys office in Pune. We are very excited by the robust early adoption of our free global asset discovery and inventory application which makes it frictionless to enable many of our paid subscriptions.

This provides us the opportunity to accelerate revenue growth as well as expand margins in the future. As Philippe mentioned, we look forward to seeing many of you at the analyst and investor session at our upcoming QSC user conference in Las Vegas. With that, I'll turn the call back to Philippe for final remarks.

Philippe Courtot -- Chairman and Chief Executive Officer

Thanks, Melissa. And in summary and as Melissa says, we are really happy with the progress made in expanding our cloud platform and increased adoption of our solutions by our existing customers enterprise -- both large Enterprise and SME and SMB as well as new customers. And in addition again, just Melissa did, let me reiterate the invitation we are extending for you to attend both our user conference and the investor session. The investor session will also be webcasted for those who cannot attend in person so they could listen it at their own leisure.

And please register on our website and peruse the agenda for one or both events. Melissa, Sumedh, Laurie and I all hope you will attend. With that, Melissa and I are happy to answer any of your questions.

Questions & Answers:

Operator

[Operator instructions] And our first question will come from the line of Howard Smith, First -- from First Analysis.

Howard Smith -- First Analysis -- Analyst

Yes. Thank you for taking my question. Congratulations on the continued very profitable growth. First question has to do with the share buyback authorization and activity seemed a little bit stepped up in Q3, and I'm just wondering.

Is there any kind of policy shift in terms of how you and the Board are thinking about using the cash returned to shareholders this way?

Melissa Fisher -- Chief Financial Officer

Thanks, Howard. I'll take that one. So as a framework, our share repurchase program is -- the objective is to minimize the dilution from grants given to employees, and that has not changed. That continues to be the same.

We -- as you see, if you look at how we've repurchased over the last couple years, we end up being backloaded in the second half of the year because our window for repurchasing in the first half, especially the quarter where we announce year-end earnings, end up being the shortest. So think of it a little bit more as a catch-up.

Howard Smith -- First Analysis -- Analyst

OK. Great. That's helpful. And then Philippe, you spoke of the success of the kind of the asset inventory rollout.

I -- previous to that, you had CertView, I think, as kind of a free offering. Just in general, as you've rolled out a couple of these and see the results, how are you thinking about using free versions to spur upsell and any tweaks you might be thinking of making going forward with those types of programs?

Philippe Courtot -- Chairman and Chief Executive Officer

Yes. As opposed to CertView, which has more limited upsell, the global IT asset inventory is very strategic on many fronts. It is very strategic, as we discussed in fact previously, because it gives that visibility that companies do not have. And that's absolutely something absolutely crucial, and it's becoming very obvious that everybody needs to go that way.

And what is very unique with our global IT inventory is that it spans across your entire environment. It just doesn't look at your Windows servers or end points or cloud. It goes across everything that you have in your environment. And so -- and then from there, there is significant, significant upsells opportunities.

So you have the one which really are directly related to the global IT asset inventory, which is for example the ability now to look at your end-of-life systems. So there is additional features about the kind of information that you can get that you do not get from the free assets inventory. You can -- and discovery, by the way. And you can also now synchronize with ServiceNow CMDB, yes.

So we become naturally the source of truth. And these, we receive today very strong interest. And we today probably have around 100 customers which are doing that already. And then there is also all the other upside which are related to the agent because what -- once you deploy the global IT asset inventory, you want to absolutely use the capabilities of our Cloud Agent because they give you real-time, which means, anything that suddenly changes on one device where you have put the agent, or one asset, immediately you know what that is.

And that's exactly what you want. Security has become an issue of both scale and always been an issue of accuracy and now is becoming absolutely an issue essentially of scale as well and real time, which is obviously things that requires a significant platform to be able to do that. So there's many, many, many upsell opportunity around that Cloud Agent. And that's what we believe is very strategic.

And we see already that, yes, it is very well received. As you know, we have only rolling out to our existing customers about a month ago. The reason why we did that, because we didn't want to have suddenly all of our customers adopting it. So we are trickling.

And then having too much load too quickly on our platform. But the reception is fantastic and this is -- will continue.

Howard Smith -- First Analysis -- Analyst

Great. Thank you.

Operator

Thank you. And our next question comes from the line of Dan Ives from Wedbush. You may begin.

Dan Ives -- Wedbush Securities -- Analyst

Thank you. So can you maybe just talk about in the market -- well, you have some competitors that are starting to significantly expand their product portfolio on REST and some of the broader sort of approaches. Maybe kind of talk about that in terms of what you're seeing in the market and, from a cloud perspective, any changes.

Philippe Courtot -- Chairman and Chief Executive Officer

Yes. So in term of the -- again, of the competition, yes. Everybody today realizes that they've got to build a platform, and that platform cannot be an enterprise software platform. It has to be a cloud platform because the cloud platform gives you the scalability that you need.

So in that sense, we're so well ahead of the market because, I'm sure as you recall, we started that journey back in 1999. So -- and we went through all the different variations of the cloud technology. And we have been absolutely, thanks to the big investment we made in Pune, able to inject the most -- the newest technology. We have ElasticSearch.

We have Kafka, Cassandra. And we are building that at scale that today we don't know anybody doing anything close to the scale that we do. We have today 28 million agents, but in reality we also have architecture to hundreds of millions of agents, even billions of agents. So it's all about scale and, yes, so the company now moving to that direction, but we believe that we are far ahead essentially of everybody else.

Dan Ives -- Wedbush Securities -- Analyst

Thanks. Could you maybe just talk about, especially in cloud with the Azure channel, obviously gaining more and more success with your JEDI win; and just how you feel, think about those market dynamics playing out; and how that potentially bodes well for how you guys are positioned, especially when it comes from the Microsoft deals? Thanks. 

Philippe Courtot -- Chairman and Chief Executive Officer

Yes. So that's another great question effectively. We always -- I believe, if you recall some of the comments that I made in fact in 2009, I was already making that comment publicly. We always say that we need to build security into the cloud.

We cannot continue bolting security on. In order to do that, you need to have the right architecture, and this is exactly what our Cloud Agent are all about. We have all the major players all using our Cloud Agent today, and millions of them, to essentially ensure they have the visibility and ensure the security of their own platform. As I mentioned, I think, either on last earning call or the one before, we have done something remarkable with Microsoft whereby we have totally integrated our agent with the Security Center, whereby an Azure customer -- the Security Center of Azure, whereby an Azure customers can essentially click on a link -- go to the Security Center, click on a link and then to a view of all of the assets they have on Azure; click on the second link and have the view of the security and compliance posture.

This is thanks to the Qualys, if you prefer, embedded agent there. And then third, click on the third link which has nothing to do with us but only 100% with Microsoft, create a playbook and then remediate. So security in this new environment have become click, click, click; nothing to install; nothing to update. It's all done for you, quite a big change.

And then the only thing you do then is that you bring your policies because you are the one, the customers, who decide your policies. Do you want to have a strict [indiscernible] or not? Do you want this? Do you want that? So -- and then of course, security is build in. And that's where we see the futures. Of course, we are extremely well positioned now that we have totally integrated, of course, our agent with Microsoft.

Then of course, we are very happy to have heard that they have, they won the JEDI contract because, of course, we'll naturally go. And by the way, as you know, our solution is FedRAMP authorized. So this is for us the way we saw the future happen, and now we are so happy to see that the future is now.

Dan Ives -- Wedbush Securities -- Analyst

Thank you. 

Operator

And our next question will come from the line of Chris Eberle from Nomura Instinet. You may begin.

Chris Eberle -- Nomura Instinet -- Analyst

Thanks. Hey, guys. Nice job on the quarter. Can you guys give us an indication of just -- now that you have the free download of the Asset inventory in the market, just some early adoption, what some of the attach rates look like for paying applications to that?

Philippe Courtot -- Chairman and Chief Executive Officer

Yes. So that's yes. So in fact, today, let me remind you the adoption of all of our customers, the way they adopt. They always do a first proof of concept, and then they start to do the deployment.

And so that takes some time. And as you know, with our model, we take the revenue as we deliver the service. So we don't do like some of -- most of our competitors which have a big chunk of perpetual license that they can -- of course, that inflates, if you prefer, [ their work ]. But this being said, today, we see today that even with these customers which have adopted we are already starting to discuss with them about all the upsell capabilities that they have.

And so we have seen already customers trying now all these additional capabilities, all that are very good initial signs about what we have done. And when you really look back, everything is integrated. So that means you don't have to install another application. You don't have to have another person managing it.

All of that can be done by the same team which is currently managing the Qualys solutions. So the answer is yes. We are very happy with it.

Chris Eberle -- Nomura Instinet -- Analyst

Thank you.

Operator

And our next question comes from the line of Nick Yako from Cowen and Company. You may begin.

Nick Yako -- Cowen and Company -- Analyst

Great taking my questions. You saw a nice jump in the percent of bookings from your products in the quarter. Any one or two products that you would highlight that were key drivers?

Melissa Fisher -- Chief Financial Officer

Nick, yes, we were delighted with that jump, which was 33% of new solutions as a percent of bookings from 25% last quarter. It still remains mostly Cloud Agent, DM and Policy Compliance. And remember, as we've discussed, it's not a perfect metric because it does include the renewal portion of DM and Policy Compliance when someone renews from the original solution into a Cloud Agent-enabled solution. And so we did see a higher -- a high amount of renewal in that metric this quarter.

Philippe Courtot -- Chairman and Chief Executive Officer

Yes. And like we said, some good traction now from the FIM as well, file integrity monitoring -- which is the file integrity monitoring.

Nick Yako -- Cowen and Company -- Analyst

OK. Great. And then maybe building on an earlier question around cloud. Earlier this week, you announced the global IT asset discovery app for the federal market.

Just curious what percent -- for the federal market. And curious what percent of revenue the federal government represent today. And now that the government is embracing cloud, how do you think about that opportunity moving forward?

Philippe Courtot -- Chairman and Chief Executive Officer

Yes. So effectively that has been our journey, trying to convince the government to apply the cloud -- our cloud solution. Whilst although you heard a lot of people saying about this, there is not much appetite. Finally, it's changing.

So today, we have a very small percentage. I think today, if you include states, 3%, around, of our revenues are federal and state. And if you peel them down to federal, it's probably about half of it. And so we have very good customers, very solid customers.

They rave about what we have, and now finally we are starting to essentially see the government and ready to take. So we are going to make some investments now because, again, we have always been balancing. It's not worth starting to invest ahead of the game, but you don't want also to invest too late either, so you have to time that as best as you can. So now we see an opportunity really with federal to really grow that market, but again with federal it takes time.

And -- but I think -- and that JEDI contract is really I think this is going to be very interesting for us, but again, it needs to be deployed and on and on. So it takes some time in the federal government. And today, we're not seeing any significant revenues early next year, but I think we'll have a bit now, with the fiscal year being at the end of the year, so maybe we could get some nice additional thing. But today, we are not really counting that much, but we will make the investment in essentially beefing up our federal team.

Nick Yako -- Cowen and Company -- Analyst

Thank you.

Operator

And our next question will come from the line of Matt Hedberg from RBC Capital Markets.

Dan Bergstrom -- RBC Capital Markets -- Analyst

It's Dan Bergstrom for Matt Hedberg. thanks for taking our questions. Actually, on the go to market, traditionally you adopt new products through the platform, but at Black Hat and around the event around the Global IT Asset Discovery and Inventory launch, there was a significant awareness and marketing campaign very noticeable to us that attended. I think more of a start to market to and engage CIOs.

Could you talk a little bit about that strategy? And then any early engagements from that?

Philippe Courtot -- Chairman and Chief Executive Officer

Yes. So that's in fact absolutely because that's in fact the opportunity that we have today. So now what you are going to see is the second leg of our campaign. The first campaign, as you rightly characterized it, was an awareness campaign.

"This is what we have for you guys, and OK, so come and see it." But now we have enough adopters that we are now going to have our adopters speak, and they are going -- and that's the second campaign we are preparing. And they are the one who are going to describe the benefits and what they have done and achieved. And you are going to see some of that at our user conference or where we will -- we are going to have some of our users talking about it. And you will also see an interesting panel, to answer your question about the CIO.

So we have -- we'll have an very interesting panel that now President and Chief Product Officer Sumedh will moderate where we have in fact Wendy Pfeiffer, which is the CIO of Nutanix which is on our Board now, which is also part of creating awareness to the CIO. In fact, this is going to be on the panel [indiscernible] in which she's going to view -- give her view as a CIO of how do they see the evolution of security. And we have also some other very good representatives of the company. So I think we're just at the beginning of that, but that's definitely the direction that we are take -- that we are continuing to take.

And you will see acceleration of our awareness effort toward the CIO and the CTO conference because, one other thing I want to mention, the game in security is changing. The theme of our user conference is security at a crossroad, part 2. Why did I say part 2 is because part 1 is what I said last year about telling this is where we see the market, where it's going. And part 2 will be the market is now there.

What are the implications for the security industry? So we will go into more details. And one of the implication is that -- and we see that very clearly in large companies, which is -- which goes very well for us, is that now it's DevOps who is taking over the security component as well as, of course, additional transformation. And so it's a very different mentality. These are engineers.

They don't do these big enterprise purchase. They want to make sure that your solution fits their need. And the big change is that you cannot go to them and describe your road map. They don't care about your road map.

They want to discuss -- you to discuss with them about their road map, so it's a totally different game which is really happening today in industry. And again, this is what I predicted in 2009, but of course, it took significantly longer than I thought. I know why now, but that's where they're now. Big change is happening.

And having the technical sales force and a very strong engineering group that we have is really puts us very, very in -- absolutely in -- very well positioned for this new, that new era to come.

Dan Bergstrom -- RBC Capital Markets -- Analyst

Very prophetic nonetheless. Maybe one for Melissa: Melissa, you indicated an FX headwind about 100 basis points each quarter here in the second half previously. Any changes to that or any incremental FX pressures to call out?

Melissa Fisher -- Chief Financial Officer

Yes. So it's roughly still the same, but we are expecting a little bit more in Q4 than we originally projected. But on the margin it's still going to be roughly a little less than a 100 basis points headwind to the growth rate.

Dan Bergstrom -- RBC Capital Markets -- Analyst

Thank you.

Operator

And our next question will come from the line of Gur Talpaz from Stifel. You may begin.

Gur Talpaz -- Stifel Financial Corp. -- Analyst

Philippe, over the past few months, you've talked about a pretty broad push in the first half of next year into some pretty significant markets, SAM, EDR and broader end point solutions. Can we talk about the development path for these products, how -- your comfort levels of pushing into some of these pretty significant markets, how you think you'll differentiate versus other solutions out there?

Philippe Courtot -- Chairman and Chief Executive Officer

Yes. So of course, the -- so if you look at what Qualys is all about. So we are absolutely using Internet technology for scale, accuracy and everything. And one of the reason why I realized it took longer, because I figured out finally -- and I said, oh my god, I should have figured that out quite a few years ago, but -- is that what is today fueling this digital transformation is the fact that -- the Googles, the Facebook, etc.

have very similar to what IBM did one day, invested $1.5 billion in Linux many, many years ago so they could essentially rearchitect their entire mainframe business, that these companies, they didn't want to depend on enterprise software. So they have to build search at a huge scale. That's where ElasticSearch came. Now you have Kubernetes and so forth.

I will have thought that all these -- and they're totally in open source. Why? Because -- I had the opportunity to discuss many, many years ago with Steve Mills and say, "Why you need to acquire Linux," which was a 50-people company at the time. "And you invested $1.5 billion." His answer was, "Because I didn't want to kill them." And that's exactly the same thing and it took me a long time to realize that, that the Googles and company have thought about it. However, they didn't want to put their significant technology enhancements too early because then they will have essentially enabled competition.

So it took them a certain time to bring that into open source, but now today, oh my god, they are coming right and left. Who would have thought that containers will be there like even three years ago? Today, they are taking the world by storm. We have, we are using containers in our platform. And we have already replaced 70% of our dependency on the VMware virtualization layer.

So we are builders of technology of scale like the Google, like the Amazon, like the -- we are all the same. We are of the same breed. So for us essentially, when we move into that space, this new space like EDR, and anything that we do, whether it's the SIEM, that's what is in our mind: scale, accuracy and elimination of false positive and false negative. So when I look at how are we going to compete with the -- in the SIEM market, we are going to compete because we'll have a better scale.

We'll have, of course, significant, bigger elimination of false positive, which is a problem today that every SIEM has; and then of course, a better price because we are using newer technology, which of course allows you to do more with less. And same thing on the EDR market. And so -- and of course, we have, you have the benefits, very unique benefits. Everything we do weighs through a certain logic whereby, because we capture the data that nobody does, then of course it puts us in a significant position to, of course, now create that next generation, if you prefer, of SIEM and even of EDR.

And of course, one of the interesting strategy that -- is that, if we can put our agent everywhere, realize the telemetry that we are going to get. And already, again, we have 28 million of that. They go everywhere and that's puts us in a very unique position. So the rest, it's all about scale.

That's what I mentioned earlier, that we have architected our back end not to handle a few millions or tens of millions of agent but hundreds of millions, if not billions, of agents. I hope that answers your question...

Gur Talpaz -- Stifel Financial Corp. -- Analyst

Yes. That's very -- that does. And maybe one follow-up for Melissa building on that. You've been very capital efficient.

When you look at your current level of spend, do you think you have enough right now to support the development and the go to market and the ramp of these new initiatives?

Melissa Fisher -- Chief Financial Officer

Yes. Thanks, Gur. We're very proud of our industry-leading margins and as well as our strong growth in cash flow of this quarter as well as year to date. As you can see from the implied guide for Q4, we do plan to continue to invest, and these projects are part of that.

Philippe Courtot -- Chairman and Chief Executive Officer

And I would like to add. Melissa said the two -- if you look from a cost or profitability standpoint. On the engineering side, the decisions we made essentially in 2007 to go to India, now today -- which is, oh my god, that was the right decision because not only we can get the talent, huge group of talent, but we also have a significant cost advantage. That's by an order of magnitude.

So that's for the engineering. So we have the engineering power to really continue doing what we do and maintain, of course, that margin that we have been in fact seeing as a percentage. Our percentage of expense in engineering should certainly not grow, but you could see after some part -- you have the scale as well. Now on the go to market, the big advantage we have here is the model itself.

The cost of distributing free of charge our global IT assets inventory is very -- it's equal to nothing. We have two latest reports that marketing efforts -- we have built what we call the TARs, the technical account representative, in India, which are people which we -- young people we hired from the technical schools. And then they are the ones essentially onboarding people in these free services to make sure that there is a good experience from the get-go. And then after that, of course now at certain fee, we can upsell these customers and again in a very, very nonaggressive way but essentially informing them of all the services they can have and get more value from it and which is our model.

So this is very efficient from a sales point. And that's the nature of our model. And for the customers, it's fantastic because everything is already in the platform. They don't have to install anything.

They just have to be educated. So another investment we are starting to make is really to try to get more -- and this is something, for example, Frank has done very well, is all the libraries of training, of use cases. So it's become -- it's even easier and easier for our customers to essentially implement, if you prefer, or deploy, it's pretty easy, but then to configure and take advantage of our solution for their needs.

Gur Talpaz -- Stifel Financial Corp. -- Analyst

That's very helpful. Thank you both.

Operator

And our next question will come from the line of Melissa Franchi from Morgan Stanley. You may begin.

Melissa Franchi -- Morgan Stanley -- Analyst

Thank you for taking my question. Melissa, I wanted to ask you about the guidance for Q4. You modestly lowered the high end of the FY '19 guidance, although it seems like things are going pretty well for you all. So I'm just wondering if you can talk about what's driving that and the puts and takes that's embedded in that outlook.

Melissa Fisher -- Chief Financial Officer

Yes, sure. Thanks, Melissa. We had a very good quarter. We were delighted with the acceleration in Cloud Agent apps and the increase in multiproduct adoption.

We did take down the high end, and it's driven by a couple of factors. One is, as I earlier mentioned, the incremental FX headwind we expect to see; as well as the fact that, as we've discussed, we're leveraging our leadership position to match competitor pricing where it makes sense because we have so much upsell opportunity in front of us.

Melissa Franchi -- Morgan Stanley -- Analyst

OK. Got it. And then just another follow-up for you, looking at billings growth. We did see a slowdown modestly, but current billings was better, so can you maybe talk about what you saw for durations this quarter?

Melissa Fisher -- Chief Financial Officer

Yes. So if you're referring to the total billings, remember that includes the multiyear prepaid which we don't manage here because we don't incent our sales force for that. We really let that be driven by our customers. So for -- in that specifically, the multiyear prepaid, which affects the long-term deferred revenue, we had a bigger dollar value increase in the quarter a year ago than in this quarter.

In terms of the current billings, as we've talked about, we don't manage to it because there's multiple scenarios in which a renewal doesn't happen at the same time of the initial signing of the deal. And so we point to the trajectory of our annual revenue guidance as the best proxy for business momentum because certainly our current bookings inform our guidance there.

Melissa Franchi -- Morgan Stanley -- Analyst

Thank you very much, and thank you, Melissa.

Operator

And the next question will come from the line of Alex Henderson from Needham & Company. You may begin.

Roger Boyd -- Needham and Company -- Analyst

Hi. This is Roger Boyd on for Alex. Thanks for taking my questions. I was wondering if you could comment on what percent of the customer base is in the Cloud Agent.

I think, last quarter, you said it was 20%. And then have you seen any incremental maturation from customers who started off late deployment? Or is most of the growth coming from new customers trying out the Cloud Agent?

Melissa Fisher -- Chief Financial Officer

Yes. So it's now in 22% of the customer base. There's still significant opportunity not only in the customers that don't have it, but also as we discussed, we know that our customers who are using Cloud Agent are not fully deployed in their environments. In terms of this quarter, where the buying was from, it kind of varies quarter to quarter, but actually this quarter the percent of bookings from new products, which as I said this is mostly Cloud Agent, is actually a bit higher in new than existing customers.

Roger Boyd -- Needham and Company -- Analyst

Got it. Makes sense. And then is it -- just maybe really quickly. Is it fair to assume that the customers you're seeing pick up the free version of Asset Inventory tend to be the SME, SMB customers? Or have you seen enterprise customers try that out as well?

Philippe Courtot -- Chairman and Chief Executive Officer

No. It's all walks of life. I mean because that's a universal problem. So for the -- it's all of them, the enterprise in fact.

The enterprise, in fact, today have a bigger need than the low end of the market because in the low end of the marketplace or especially of the SMB you got one guy and maybe 50 PCs or 20 PCs and some coming out. So they can do that obviously manually on spreadsheets. The enterprise cannot. The problem that the enterprise have is that they need -- the enterprise is -- the large enterprise is fundamentally changing.

The silos are crumbling. That's the message, finally. Again, that's what I thought that it will have happened 10 years ago. That is happening now.

So the silos were very, very jealous of their tools. So the Windows team having their tools to do their own inventory under these, under that. And now today, again, the silos are crumbling. You need -- everybody needs to accelerate their transformation, so today we find that, that visibility is starting to become very high on the mind of the CIOs and the CISOs who do not really, really wants to speak with this then continue with their own tools that they have and they are familiar with.

They are getting more and more replaced. When you look at the tenure, the average tenure of CISOs today in the large enterprise, it's about 1.2 years. So a huge movement. And of course, DevOps is the one behind changing things.

On the mid-market, I think, this, we'll see a very good adoption because then they have bigger networks, more complexity. Even if I look at Qualys today, you will be amazed. I give the demo real time of our own inventory. Then we are using, of course, our own agent and discovery.

I could not believe the complexity of the environment that we have for a company of 1,300 people. And so that -- so for the SMEs, it's much more something they want to do now, when on the enterprise they know they've got to do it but they really got to go. And you need to have the momentum a little bit from the top because the silos are resisting.

Melissa Fisher -- Chief Financial Officer

And just to add onto that and just close on it. Philippe said we're seeing more of the enterprise customers using an existing. So about 40% of those using it has just been a couple months and so on, so it's sort of an early -- still early data. It's from the enterprise.

And it's closer to 10% in the new. And that's because many of these existing enterprise customers already have Cloud Agent solutions, which we see is a very positive sign because, once they then deploy the agent globally for the purpose of free asset discovery and inventory, it's very easy for them to add onto these additional paid solutions, some of which they may be using in small amounts. Now they can turn it on for their full environments, like we talked about with the opportunity to extend VM and Policy Compliance on the end points.

Philippe Courtot -- Chairman and Chief Executive Officer

Yes, absolutely.

Roger Boyd -- Needham and Company -- Analyst

Great. Thank you I appreciate it, guys.

Operator

And our next question will come from the line of Sterling Auty from JP Morgan. You may begin.

Sahil Sharma -- J.P. Morgan -- Analyst

This is Sahil on for Sterling. Thank you for taking my question. So how was the EMEA business in the quarter given the macro backdrop?

Philippe Courtot -- Chairman and Chief Executive Officer

So very similar, very good, nothing really to report. Still we have a very good penetration in Europe, as you know. And what we see conversely, we have seen a little bit of pickup in Asia. I think today the cloud now is starting to be a little more appealing to Asia, when in the past it's all about there I want my on premise.

Europe is doing very well. So -- and so is the U.S. So is -- we see a kind of a slowdown in the -- in Brazil and in the Latin America. And that's about the only place where we'll see today a real slowdown.

Sahil Sharma -- J.P. Morgan -- Analyst

And I apologize if I missed this in the prepared remarks, but do you give the split for vulnerability management in the quarter?

Melissa Fisher -- Chief Financial Officer

Sebastian, the vulnerability management family still continues to be about 73% of the revenues.

Sahil Sharma -- J.P. Morgan -- Analyst

Thank you. That's all from my side.

Operator

And our next question will come from the line Yun Kim from Rosenblatt Securities. You may begin.

Yun Kim -- Rosenblatt Securities -- Analyst

Thank you. Congrats on another solid quarter. Just going back to the Cloud Agent adoption. It seems like that's going pretty well consistently for some time.

Can you just describe to us what kind of pricing uplift that you may be seeing for customers with Cloud Agents versus those who do not? And if there is a meaningful pricing uplift, what is driving that?

Melissa Fisher -- Chief Financial Officer

Yes. So it really depends on the nature of application that people use the Cloud Agents for because people don't purchase the Cloud Agent stand-alone. So what we've talked about is, if someone was a previous VM or Policy Compliance customer and then renewed or added on, let's say, Cloud Agent for the purpose of doing those applications, they would pay in about an additional 20%. Or for example, if they were subscribing to file integrity monitoring, which is a solution enabled by the Cloud Agents, that's a much higher-price solution.

So it really depends on the nature of the solution that they're using.

Yun Kim -- Rosenblatt Securities -- Analyst

OK. Just the new -- I'm trying to better understand how -- the new Asset Inventory product. It seems like it should help drive the incremental Cloud Agent adoption, right...

Philippe Courtot -- Chairman and Chief Executive Officer

That's -- yes, that's the second purpose. The first purpose is to give the much-needed visibility that the company must have. And of course, the advantage for us is that, of course, we now see the market with the Cloud Agent and where then you can upsell to all of these other services that we have, all these other functionalities, yes.

Yun Kim -- Rosenblatt Securities -- Analyst

Got it. Great. Thank you so much.

Operator

And our next question will come from the line of Patrick Colville Arete Research. You may begin. 

Patrick Colville -- Arete Research -- Analyst

Thank you for taking my question and congrats on a solid set of results, especially on the profitability. I mean just incredible profitability, to be honest, really market leading. Can you just talk through the puts and takes, if possible, on the gross margin side and then the operating margin side? Just what happened in the quarter to kind of show a strong performance?

Melissa Fisher -- Chief Financial Officer

Yes, happy to do so. I'll repeat that we're very proud of our industry-leading profitability. On the gross margin, we did have additional expenses related to data center capacity and software and maintenance, but they're offset by an increased mix in Pune, which we talked about is really we're getting a lot of our great engineering talent. With regard to the other areas, we've really benefited from a number of factors.

It was hiring in Pune was lower net hiring than expected; lower nonsalary head count costs, things like vacation accrual, payroll taxes; as well as lower third-party spend such as legal services, consulting and travel.

Patrick Colville -- Arete Research -- Analyst

OK. Nice one. And can I ask about the buybacks? Because that was something that's -- you briefly touched on earlier but a pretty major change versus prior quarters. So if I do my maths right, it's $50 million bought back in the third quarter, which is double the amounts bought back in the whole of first half this year.

I mean, is that something we should expect going forwards, qualitatively more aggressive on buybacks and to use the cash on the balance sheet to lower that share count?

Melissa Fisher -- Chief Financial Officer

Yes. So great question. And we're delighted that we have such strong cash flow that we can do this for our shareholders. Again, the objective is to minimize our dilution, and so that's really our primary what we're trying to achieve because we are preserving capacity for M&A.

We continue to be active looking in the market. So I would not suggest that $50 million is indicative of what we're going to do every quarter. If you look at sort of the average of what we've been doing a year, our board has been authorizing $100 million. And so I think that's really more of the way to think of it.

As I said, again depending on the timing of when we're buying and the amount we can do in each quarter, it -- just it ends up varying.

Philippe Courtot -- Chairman and Chief Executive Officer

Yes. Let me repeat two thing I was saying. One thing is that, that quarter was a little bit not normal because we had a very small window than previous quarter. So in a way, it was a kind of a catch-up.

Because the goal, in fact, we have -- and this is -- came from discussion we have from our long-term investors when we discuss about capital allocation. So essentially, firstly, in the beginning, they say, "What is your strategy?" I say, first of all, let me get the cash. And then when we'll have the cash, we'll discuss about cash allocation and capital allocation. And then of course, their No.

1 requirement, they say, look, Philippe -- it's this is exactly what they told us. "Look, for us, if you could minimize the dilution," because, of course, we continue looking for talent. And that talent, you need to incentivize them. I personally prefer the option to the RSUs, but that's another discussions.

And then essentially, OK. So we -- I said, let me think about. And then Melissa and I, we ran, we discussed with the Board. And we said, OK, we are going to essentially answer the what -- our long-term investors.

And we committed we will do that. So it's not about pumping of the stock, no. It's just about the goal is to essentially minimize the dilution that we do through the SBC, and we are truthful to that. Now today we're gaining some additional flexibility because, in the past, we're limited also, which limited of -- the windows.

And now today we have expanded the capabilities to buy on the open market essentially that the Board authorize. And that's about the only change that we made but no change whatsoever in the underlining philosophy.

Patrick Colville -- Arete Research -- Analyst

Thank you very much.

Operator

Thank you. And I'm not showing any further questions at this time. I'd like to turn the call back over to Vinayak for closing remarks.

Vinayak Rao -- Vice President, Corporate Development, and Investor Relations

Thank you all for attending our third-quarter 2019 earnings call. We look forward to seeing you at Stifel's Midwest One-on-One Growth Conference in Chicago and Needham's Security, Networking and Communications conference in New York in November. We'll also be at Nasdaq's investor conference in London, Wells Fargo's TMT summit in Las Vegas and Cowen's annual Networking & Cybersecurity Summit in New York in December. Thank you.

Operator

[Operator signoff]

Duration: 55 minutes

Call participants:

Vinayak Rao -- Vice President, Corporate Development, and Investor Relations

Philippe Courtot -- Chairman and Chief Executive Officer

Melissa Fisher -- Chief Financial Officer

Howard Smith -- First Analysis -- Analyst

Dan Ives -- Wedbush Securities -- Analyst

Chris Eberle -- Nomura Instinet -- Analyst

Nick Yako -- Cowen and Company -- Analyst

Dan Bergstrom -- RBC Capital Markets -- Analyst

Gur Talpaz -- Stifel Financial Corp. -- Analyst

Melissa Franchi -- Morgan Stanley -- Analyst

Roger Boyd -- Needham and Company -- Analyst

Sahil Sharma -- J.P. Morgan -- Analyst

Yun Kim -- Rosenblatt Securities -- Analyst

Patrick Colville -- Arete Research -- Analyst

More QLYS analysis

All earnings call transcripts