Qualys, Inc. · NASDAQ:QLYS
Qualys — Investor Day (March 2019)
72 slides from Qualys's investor day presentation, Mar 6, 2019
Slide 1: Security at a Crossroads
MAKING THE WORLD SAFER – ONE APP AT A TIME Security at a Crossroads Our New Journey in the Cloud Philippe Courtot, Chairman & CEO Sumedh Thakar, Chief Product Officer Melissa Fisher, CFO QLYS Investors & Analysts Day – Four Seasons San Francisco, March 6th 2019
Slide 2: Safe Harbor
Safe Harbor This presentation includes forward-looking statements within the meaning of the federal securities laws. Forward-looking statements generally relate to future events or our future financial or operating performance. Forward-looking statements in this presentation include, but are not lim
Slide 3: Going Back to our Origins – 1999
Going Back to our Origins – 1999 Our Original Mission DAIMLER and Vision Apply nascent Internet Technologies to automate Vulnerability Assessment making it accurate, continuous and scalable. 11,000+ customers in 160 countries 3
Slide 4: Where are we now?
Where are we now? Today’s Mission and Vision Unifying IT, Security and Compliance in a single pane of glass with 2 second visibility across on-premise, endpoints, cloud(s), containers, web apps, API, mobile and OT/IoT environments 4
Slide 5: 5
5
Slide 6: Qualys Enterprise AssetView dashboard
@ Qualys. Enterprise AssetView v Help ~ Philippe Courtot ~ Log out Dashboard Assets Templates Connectors Asset Overview ~ Actions ~ Add Widget Filter by Asset Tags (o) (Cy ASSET DISTRIBUTION BY OPERATING SYSTEM (Cy WINDOWS DISTRIBUTION sssional 6.1.7601 Service Pack 1 Build 7601 Mac OS X 10.14.3 se
Slide 7: QLYS a Company Built to Last
QLYS a Company Built to Last 2018 EBITDA margin vs. select Security and SaaS peers Security QLYS SaaS 40% Peer Median: 12% Source: Morgan Stanley 7
Slide 8: Go to Market
Go to Market The Platform is the Distribution Channel 8
Slide 9: The Inconvenient Truth we all must Acknowledge
The Inconvenient The digital transformation has Truth we all must created an explosion of new technology and opportunities. Acknowledge It has left chaos and many gaping security holes in its wake. Data Breaches continue to be on the rise Today’s plethora of current IT, security and compliance tools
Slide 10: We must Adopt a new Mindset to Cybersecurity
We must Adopt a In our hyper connected new new Mindset to world where everything connects with everything, Cybersecurity we simply cannot secure what we do not know. Building Security in We need to know what connects to our networks - Stop Bolting it on and changes that are Continuously Assess, Dete
Slide 11: Mindset Change
Mindset Change Embracing the Digital Transformation Holistic Transformation of Business to Digital Cloud, Containers, IaaS, PaaS, OT, IIoT, IoT, Mobility, Web apps, APIs, Mobile Apps 11
Slide 12: DevOps and Security the new Frontier
DevOps and Security the new Frontier This is real and highly contagious Developers decide how infrastructure runs in production Speeds up significantly how fast code goes to production 12
Slide 13: Moving Toward the Future of Security
Moving Toward the Future of Security Transparent Orchestration Built-in Automation is the only real solution - Starts in DevOps Our continuing mission Building-in Security into DevOps Building-in Secure Access Control Building the next generation of Security Analytics platform 13
Slide 14: Next-Gen Analytics Platform (Blue Print)
Next-Gen Analytics Platform (Blue Print) 14
Slide 15: Summary
Summary Bringing a Unique Value Proposition to our Customers and Investors Global IT Asset Inventory Stack Consolidation Building Security into their Digital Transformation A Company Highly Profitable and Built to Last 15
Slide 16: Thank You
MAKING THE WORLD SAFER – ONE APP AT A TIME Thank You pcourtot@qualys.com
Slide 17: Security at a Crossroads: Regaining our lost visibility
MAKING THE WORLD SAFER – ONE APP AT A TIME Security at a Crossroads Regaining our lost visibility Sumedh Thakar, Chief Product Officer QLYS Investors & Analysts Day – Four Seasons San Francisco, March 6th 2019
Slide 18: IT Transformation
IT Transformation Infrastructure & Applications
Slide 19: Digital Transformation
Digital Transformation Holistic Transformation of Business to Digital Cloud, Containers, IaaS, PaaS, OT, IIoT, IoT, Mobility, Web apps, APIs, Mobile Apps 19 QSC Conference, 2019 06 March 2019
Slide 20: Hybrid Cloud Overview Architecture
Hybrid Cloud Overview Architecture Mobile Workforce Clouds Work Stations NETWORKS NETWORKS VMs BARE METAL VMs BARE METAL DB West Coast East Coast DB Datacenter Datacenter STORAGE STORAGE On-Premises
Slide 21: Containers
Containers Real game-changer Hypervisor disappearing, bare metal is back Kubernetes Infrastructure-as-code 21 QSC Conference, 2019 06 March 2019
Slide 22: Containers – no servers?
Containers – no servers? Container-as-a-Service AWS Fargate AWS Lambda Function-as-a-Service, serverless! Kubefed? “Priceline” for Containers? 22 QSC Conference, 2019 06 March 2019
Slide 23: DevOps
DevOps This is real and highly contagious Developer decides how infrastructure runs in production Significantly speeds up how fast code goes to production 23 QSC Conference, 2019 06 March 2019
Slide 24: On-Prem
On-Prem Shrinking Datacenter Footprint Increasing OT & IIoT Corp IT – more distributed & mobile More IoT! 24 QSC Conference, 2019 06 March 2019
Slide 25: Enterprise Mobility != BYoD
Enterprise Mobility != BYoD Enterprise owned handheld devices Indispensable to modern business Running apps handling sensitive business & consumer data Mobile! 25 QSC Conference, 2019 06 March 2019
Slide 26: Web Apps & APIs
Web Apps & APIs Web Apps for the humans APIs for the non-humans Wide window into all customer data 26 QSC Conference, 2019 06 March 2019
Slide 27: SaaS
SaaS More aaS everywhere No infrastructure to manage No applications to code or manage 27 QSC Conference, 2019 06 March 2019
Slide 28: SaaS
SaaS 28 QSC Conference, 2019 06 March 2019
Slide 29: Security
Security
Slide 30: Security Transformation
Security Transformation Transparent Orchestration Built-in automation the only real solution 30 QSC Conference, 2019 06 March 2019
Slide 31: Starts in DevOps
Starts in DevOps DevSecOps Strict CI/CD pipeline controls CI: Eliminate majority issues before prod CD: Embed security artifacts in Image 31 QSC Conference, 2019 06 March 2019
Slide 32: Agile SecOps
Agile SecOps SecOps focus on monitoring & response Drastically reduce security solutions deployed after the fact New generation of Security Analytics platforms – Data Lake 32 QSC Conference, 2019 06 March 2019
Slide 33: Qualys
Qualys
Slide 34: Qualys Platform Approach
Qualys Platform Approach Embracing our own Digital Transformation Massive expansion of backend for visibility – 2+ Trillion security data points indexed Comprehensive coverage of sensors – scanners, agents, cloud connectors, container sensors, passive sniffers and mobile agents 34 QSC Conference, 20
Slide 35: Cloud Platform Environment
Cloud Platform Environment Security at scale on hybrid clouds 19+ apps providing comprehensive suite of security & compliance solutions 12,000+ customers and active users 7 shared cloud platforms across North America, Europe & Asia 70+ private clouds platforms deployed globally... on-prem, AWS, Azur
Slide 36: Cloud Platform Highlights
Cloud Platform Highlights 2+ trillion security events annually 3+ billion scans annually 2.5+ billion messages daily across Kafka clusters 2+ trillion data points indexed in our Elasticsearch clusters Unprecedented 2-second visibility 36 QSC Conference, 2019 06 March 2019
Slide 37: Qualys Cloud Platform
Qualys Cloud Platform Sensors, Data Platform, Microservices, DevOps UI API Portal Application Services / Shared Services / Stream & Batch Processing / Reporting / Analytics Service Service Service Service Service ... Qualys Streaming Data Backbone Cloud Agents Passive Scanners Scanners Appliances Vi
Slide 38: Qualys Sensor Platform
Qualys Sensor Platform Scalable, self-updating & centrally managed Physical Virtual Cloud/Container Cloud Agents Passive API Passively sniff on network Integration with Threat Legacy data centers Private cloud infrastructure Commercial IaaS & PaaS Light weight, multi- clouds platform Intel feeds Rea
Slide 39: Physical & Virtual scanners
Physical & Virtual scanners Large scale active scanning across on-prem & cloud 50,000 + Appliances globally deployed Network Asset mapping, discovery & inventory Vulnerability Assessment Configuration Assessment Web Application Vulnerability Assessment Digital Certificate discovery, inventory & Asse
Slide 40: Cloud Agents
Cloud Agents Large scale continuous assessment on-prem, multi-cloud & laptops 16+ Million Agents Hardware & Software Asset Inventory Vulnerability Assessment Configuration Assessment File Integrity Monitoring Threat Hunting (Malware IOC detection) Patch Management (GA March 2019) 40 QSC Conference,
Slide 41: Cloud Agents - Mobility
Cloud Agents - Mobility H1 2019 beta Extend Agents to Enterprise Mobile Devices Android, IOS and Windows Mobile Device & Application Inventory Vulnerability & Configuration Assessment Security Policy enforcement (pin, password, geo-fencing, etc.) App white/black listing & Kiosk mode 41 QSC Conferenc
Slide 42: Cloud Connectors
Cloud Connectors Continuous assessment of Multi-Cloud data centers AWS, Azure & GCP (more coming 2019) IaaS & PaaS discovery & inventory Cloud Config & Threat assessment Remediation of cloud threats like S3 buckets (H2 2019) SaaS security & compliance (H2 2019) 42 QSC Conference, 2019 06 March 2019
Slide 43: Container Sensors
Container Sensors Continuous assessment of Docker Containers Vulnerability & Configuration assessment DevOps : CI/CD build pipeline integration Jenkins, Bamboo, Kubernetes etc. DevSecOps: Runtime container monitoring Container instrumentation runtime protection (H2 2019) 43 QSC Conference, 2019 06 M
Slide 44: Passive Network Sensor
Passive Network Sensor Continuous Network Traffic Analysis Tap port mirroring Complete visibility of ALL devices on network Device Identification : Fingerprinting & ML Discovery of OT, IOT & IIoT and web applications Threat monitoring for malicious traffic Secure Access Control : Enforce policy base
Slide 45: Qualys Platform Approach
Qualys Platform Approach 19 solutions on single platform .. and counting – reduce agent/vendor fatigue DevOps-friendly capabilities Solutions for CI/CD Extending solutions into remediation & response 45 QSC Conference, 2019 06 March 2019
Slide 46: Qualys Platform Approach
Qualys Platform Approach Rapid expansion of R&D org Building dedicated Data Lake & Data Science team Key technology acquisitions & investments 46 QSC Conference, 2019 06 March 2019
Slide 47: Acquisitions & Investments
Acquisitions & Investments Nevis Passive Scanning & Secure Access Control Netwatcher Event Correlation Platform 1Mobility Enterprise Mobility Layered Insight Built-in Runtime Container Security 42Crunch Investment API Security Adya SaaS Security & Compliance Frog 1 47 QSC Conference, 2019 06 March 2
Slide 48: Qualys Cloud Apps
Qualys Cloud Apps ASSET MANAGEMENT Asset Inventory CMDB Sync Cloud Inventory Certificate Inventory Maintain full, instant visibility of all your Synchronize asset information from Inventory of all your cloud assets across Inventory of TLS/SSL digital certificates on global IT assets Qualys into Serv
Slide 49: Q4 2018 releases
Q4 2018 releases 2018 2019 Patch Management – beta Global IT Asset Management (managed assets) – GA Passive Network Sensor (unmanaged assets) – beta 49 QSC Conference, 2019 06 March 2019
Slide 50: 2019 – Even more apps to come!
2019 – Even more apps to come! Patch Management - GA Secure Enterprise Mobility Secure Access Control API Security Software Composition Analysis Breach and Attack Simulation Security Data Lake & Correlation Platform Run-Time Container Security Certificate Management Cloud Security 50 QSC Conference,
Slide 51: DEMO
DEMO
Slide 52: Unified Dashboards
Unified Dashboards 52 QSC Conference, 2019 06 March 2019
Slide 53: Advanced Correlation & Analytics
Advanced Correlation & Analytics ML/AI Service Orchestration & Automation UEBA Patterns | Outlier | Predictive SoC Integration | Playbooks | Response User & Entity Behavior Analytics Threat Hunting Security Analytics Advanced Correlation Search | Exploration | Behavior Graph Anomaly | Visualization
Slide 54: Thank You
MAKING THE WORLD SAFER – ONE APP AT A TIME Thank You sthakar@qualys.com
Slide 55: Qualys' Business Model For the Digital Age
MAKING THE WORLD SAFER – ONE APP AT A TIME Qualys’ Business Model For the Digital Age Melissa Fisher, CFO QLYS Investors & Analysts Day – Four Seasons San Francisco, March 6th 2019
Slide 56: Qualys Business Model
Qualys Business Model Leveraging Cloud Based Delivery The Platform is the distribution channel Key Elements of a disruptive model delivering high profitability 56
Slide 57: Qualys Cloud Platform Scalability
Qualys Cloud Platform Scalability 57
Slide 58: Maintaining Low Cost of Revenue while Launching New Products
Maintaining Low Cost of Revenue while Launching New Products 19 19 450 apps 25% 400 21% 21% 22% 350 20% 4% 4% 4% 300 13 250 15% 10 13 apps 22% 200 apps 10% 10 150 100 5% 5 17% 17% 18% apps 50 0% 0 2016 2017 2018 Peer Median 2018 Operations as % of Revenue COGS % of Revenue Operations % Support % # o
Slide 59: Maintaining R&D Efficiency while Increasing Product Deployment
Maintaining R&D Efficiency while Increasing Product Deployment 19 apps 20% 13 15% apps 10 apps 10% 17% 16% 16% 16% 5% 5 apps 0% 2016 2017 2018 Peer Median 2018 R&D as % of Revenue# of Products# of Products R&D as % of Revenue Source: Morgan Stanley excluding OneSpan 59
Slide 60: Attracting Top R&D Talent while Leveraging a Low Cost Geography
Attracting Top R&D Talent while Leveraging a Low Cost Geography % of R&D Headcount in R&D as % of Revenue R&D as % of Revenue: PF India for all US Team 72% 35% 63% 29% 16% 16% 16% 47% 23% 2016 2017 2018 2016 2017 2018 2016 2017 2018 Attracting Top & Loyal Talent High R&D Leverage Note: ‘PF for all U
Slide 61: Built-In Sales Productivity as Farmers Support Customer Growth
Built-In Sales Productivity as “Farmers” Support Customer Growth ($ in millions) $300 $267 150.0 $250 $219 130.0 $200 $185 110.0 $150 90.0 $100 $50 70.0 $- 50.0 2016 2017 2018 Renewal and Upsell Revenue Sales HC of "Farmers" 61
Slide 62: … through Multi-Product Adoption
… through Multi-Product Adoption 70% 41% 21% 10% 70% 66% 61% 41% 58% 32% 20 26% % 21% 15% 8% 10% 6% 3% 0% 3% Q4 Q4 Q4 Q4 Q4 Q4 Q4 Q4 Q4 Q4 Q4 Q4 Q4 Q4 Q4 Q4 FY15 FY16 FY17 FY18 FY15 FY16 FY17 FY18 FY15 FY16 FY17 FY18 FY15 FY16 FY17 FY18 2+ solutions 3+ solutions 4+ solutions 5+ solutions % of Enterp
Slide 63: …Generating Higher ARPU per customer
…Generating Higher ARPU Enterprise customers with 4+ solutions spend over 5x that of 1-solution customers ($ in thousands) $300 $273 $266 4+ = 5x apps spend $207 $212 $200 3+ $200 apps Avg. LTM revenues $164 $142 per customer $140 $100 $52 $49 $52 $49 1 app $0 2015 2016 2017 2018 63
Slide 64: Qualys Cloud Platform Enables Top Tier LTV/CAC
Qualys Cloud Platform Enables Top Tier LTV/CAC Security SaaS QLYS 9.0 Peer Median: 8.4 2018 LTV/CAC vs. Source: Morgan Stanley select Security and SaaS peers Note: Calculated using Barclay’s Research methodology using GAAP financials: CAC = 80% of PY S&M; LTV = Net New Revenue multiplied by Gross Ma
Slide 65: Delivering a Best-In-Class Operating Model
Delivering a Best-In-Class Operating Model Expense as a % of revenue # of Products 25 9% G&A 11% 20 23% S&M 15 40% 10 16% 19 R&D 17% 5 22% 5 COGS 22% 0 Qualys Peer Median Note: 2018 Expenses as % of revenue (Non-GAAP); Source: Morgan Stanley excluding OneSpan 65
Slide 66: Resulting in Industry-leading Margins
Resulting in Industry-leading Margins 2018 EBITDA margin vs. select Security and SaaS peers Security QLYS SaaS 40% Peer Median: 12% Source: Morgan Stanley 66
Slide 67: Summary
Summary Bringing a Unique Value Proposition to our Customers and Investors Global IT Asset Inventory Stack Consolidation Building Security into their Digital Transformation A Company Highly Profitable and Built to Last 67
Slide 68: Thank You
MAKING THE WORLD SAFER – ONE APP AT A TIME Thank You mfisher@qualys.com
Slide 69: Q&A
MAKING THE WORLD SAFER – ONE APP AT A TIME Q&A
Slide 70: Appendix
Appendix 70
Slide 71: Reconciliation of Adjusted EBITDA
Reconciliation of Adjusted EBITDA ($ in millions) 2016 2017 2018 Net income $19.2 $40.4 $57.3 Depreciation and amortization of property 16.6 19.8 25.1 and equipment Amortization of intangible assets 0.4 0.8 3.8 Interest expense 0.0 0.0 0.2 Provision for (benefit from) income taxes 11.2 (1.1) (1.8) S
Slide 72: Reconciliation of Non-GAAP Expenses
Reconciliation of Non-GAAP Expenses ($ in millions, except per diluted share metric) 2016 2017 2018 GAAP Cost of revenues $43.1 $51.6 $66.2 Less: Stock-based compensation (1.9) (2.2) (2.5) Less: Intangible asset amortization - (0.5) (3.6) Non-GAAP Cost of revenues $41.3 $49.0 $60.1 GAAP Research and