Ladies and gentlemen, thank you for standing by. Welcome to Coalesce's third quarter 2026 investor call. At this time, all participants are in a listen-only mode. After the speaker's presentation, there will be a question and answer session. To ask a question during the session, you will need to press star 11 on your telephone. You will then hear an automated message of ads and your hand is raised. To withdraw your question, please press star 11 again. Please be advised that today's conference is being recorded. I would like now to turn the conference over to Blair King, Investor Relations. Please go ahead.

Thanks, Michelle, and good afternoon and welcome to Qualys' third quarter 2026 earnings call. Joining me today to discuss our results are Sumedh Thakar, the President and CEO, and Joo Mi Kim, our CFO. Before we get started, I would like to remind you that our remarks today will include forward-looking statements that generally relate to product capabilities, future events, or future financial or operating performance. Actual results may differ materially from these statements. Factors that could cause results to differ materially are set forth in today's press release and our filings with the SEC. including our latest Form 10-Q and 10-K. Any forward-looking statements that we make on this call are based on assumptions as of today, and we undertake no obligation to update these statements as a result of new information or future events. During this call, we will present both GAAP and non-GAAP financial measures. A reconciliation of GAAP to non-GAAP measures is included in today's earnings press release and as a reminder, the press release, prepared remarks and investor presentation are all available on the investor relations section of our website. So with that, I'd like to now turn the call over to Sumedh.

Thank you, Blair, and welcome to our third quarter earnings call. AI has fundamentally transformed the advisory's playbook, graduating from accelerating existing attack techniques to autonomously operating inside live production environments. To put the scale of this shift in perspective, Microsoft's recent Patch Tuesday disclosed 1,414 new vulnerabilities in a single release compared to 93 before the advent of Frontier AI. That's a 15-fold increase in exposure volume within the last seven months alone that every enterprise must now absorb in real time. Within 10 minutes of Microsoft publishing this advisory, Agent Insta, powered by Instascan, posted scanless detections in a customer's environment, giving them immediate view of their exposure. No scan cycle, no agent disruption, no days-long wait. The detection at AI speed. But detection alone changes nothing if what follows still takes weeks, still relies on manual handoffs, and still can't prove the exposure is closed. Events like the PHP to shell disclosure and others are just a warning of what lies ahead and the need for speed from disclosure to remediation is clear. Durable pre-breach risk management requires a vendor-neutral agentic AR risk fabric that can autonomously transform detections into proven remediation of actual exploitable risk at the speed of modern attacks. Against this backdrop, we delivered another strong quarter of revenue growth and profitability alongside one of our most meaningful quarters of platform innovation to date. The execution reflects a clear shift in how customers evaluate and select their security platforms. The traditional CTEMP model wasn't built for this moment and it shows. More findings, more theoretical risk scores, more dashboards, and more handoffs, each one a gift of time to an adversary that now operates at machine speed. When customers can't patch fast enough to outrun autonomous exploitation, the last thing they need is another tool that tells them what's wrong and passes the problem to someone else to fix. CISOs are looking to update their boards with their plan of action against autonomous exploitation with a roadmap of autonomous remediation. and sort of more manual tools and processes. That architecture was already losing before the frontier AI era. Today, against an AI-powered adversary, it's indefensible. We developed the vision and built the AI native rock powered by our ETM solution over three years ago to end that cycle entirely. Today, Agent Insta powered by Instascan is detecting newly exposed vulnerabilities at customer systems in less than 60 minutes of disclosure on an average. Agent Val powered by TrueConfirm has already performed approximately 9 million exploit validation across customer environments and still 11% of those confirmed exploitable, eliminating 89% of that noise would have been otherwise consuming security and IT resources. And TrueRisk Eliminate with Agent Serra has helped customers deploy over 180 million patches in the last 12 months alone, with 60% of those running autonomously doubling from 30% a year ago at a rollback rate of fewer than one in 8,000. Together, they operate natively in a continuous closed loop that proves autonomous closure within hours, not weeks. The AI-native rock isn't a roadmap. It's not a vision slide. It's operational, measurable, and provable, and that's nearly all enterprise and federal customer conversations are centered. Carrying this momentum forward We are further evolving our ETM and True Risk Eliminate capabilities through an expanded ecosystem of remediation solutions. Over the last two quarters, we introduced our AI-powered patch reliability score, Agent Serra's wave-based remediation, peer-to-peer patching, and AI-guided rollbacks. The cumulative effect of our True Risk Eliminate agenda gives organizations confidence to deploy in a production environment with rollback rates below 1.1% across well over half a billion patches delivered to date, including more than 200 million executed autonomously. That customer confidence is translating into accelerating adoption with patch deployments up 47% from the advent of frontier models in early April of this year and autonomous deployments growing even faster. The biggest blocker to faster patching is lack of confidence in operational outcome. At our recent ROCCON conference in Austin, we built on this foundation by announcing what we call autonomous remops brought to life through True Risk Eliminate 2.0 with True Confidence. True Confidence is a remediation orchestration intelligence engine delivered on a straightforward operating principle. Fix the minimum, credit existing controls, choose the right remediation path, control the rollout, and prove that it held. Three new capabilities represent meaningful new ground for performance. First, before a corrective action is raised, TrueConfidence assesses the protection already provided by third-party security controls so customers don't duplicate their efforts. Second, it extends coverage beyond endpoints to cloud applications, perimeter, and Azure assets, including routers, switches, firewalls, and air-gapped infrastructure that historically sat outside response workflows because they cannot run an agent. and third, built on the rollback capabilities we introduced last year, post-deployment operational resiliency monitoring through partners like Dynatrace now track system health to confirm that environment remains stable post-patch. When a patch doesn't hold, AI-powered patch failure analysis explains the root cause in plain English and recommends corrective action. The result is an AI native rock that serves at both the system of record and the system of action for cyber risk reduction. Other vendors entering the mitigation conversation are orchestrating a handoff or agent-based endpoints and passing a patching recommendation to a third party tool without giving the operational confidence and no verification that the fix was successful, be applied, or that the environment remains stable afterwards. The Qualys platform was purpose-built to eliminate that handoff entirely and delivers natively integrated autonomous rem ops with true confidence at scale, rapidly proving closure across every domain and asset type. With Qualys, no asset, whether it runs an agent or not, and no exposure, whether a patch exists or not, will be left without an immediate path to closure. Our continuous innovation and industry leading capabilities are now garnering significant recognition from customers, partners, and independent analysts. In the 2026 Forrester Way for Proactive Security Platforms, Qualys received the highest rating among all evaluated vendors on the key criteria, including network visibility, exposure, business driven prioritization, and remediation. Additionally, Kuppinger Kolding, Qualys, the highest rated leader in the 2026 leadership compass for ad hoc service management, earning the top position in both product and market leadership. both underscore our customer-driven engineering and growing competitive differentiation across the platform. Moving to our business update, the number of customers spending $500,000 or more with us grew 15% from a year ago to 243. Let me now share a couple of recent wins, which illustrate why organizations are turning to Qualys to help unify their security stacks, operationalizing the rock, and put autonomous remediation to work. First, we closed a new low seven-figure annual booking deal with a large government agency. This agency had been running on an on-prem vulnerability management program for years, scanning with one vendor, manually triaging across disconnected dashboards, and handing path cycles off to yet another vendor. As the detection volume surged, the model was breaking down, response backlogs were growing, and the agency kept falling further behind. Seeking to streamline operations, the agency ran a highly competitive process and selected Qualys to help activate its ROC on a single FedRAMP high authorized platform. In doing so, it landed with seven Qualys modules right out of the gate, including ETM, ETM Identity, VMDR, True Risk Eliminate, Policy Audit, Total Cloud, and Total AppSec. The net result is that this agency has now consolidated a fragmented multi-vendor workflow into a unified AI-powered risk fabric. A fabric that detects exposure within minutes of disclosure, validates actual exploitability so teams can act on real risk rather than theoretical scores, and automates response by natively applying patches and other compensating controls when patches are too risky to deploy or unavailable. What used to take weeks from detection to confirmed fix now takes hours, and a patch backlog that has been compounding security debt for years is now under control. Given the success of this deployment, the customer is now actively evaluating total AI and planning to deploy agentic AI workflows across its operations. The second was an existing large federal agency which has struggled to manage its cloud and infrastructure security using siloed tools while manually consolidating findings with no unified view of risk. Prioritization relied on CVSS security scores rather than validated exploitability. and their security and IT teams are making critical decisions on incomplete data. Threat response had historically followed a pattern we hear too often. Security operations identified a vulnerability, opened a ticket and handed to an IT team running a third-party passion tool, a cycle that average weeks from identifying threats to assume fix. With the advent of the CISA Board 2604, which requires agencies to operationalize risk-based remediation and address AI-accelerated threats, that compress expert timelines to ours, that cycle was no longer sustainable. Our own Threats Research Unit's five-year analysis of more than 1.5 billion critical vulnerability instances shows that Qualys customers had already remediated approximately 173 million exposure before they were entered in CISA's KEV catalog, which is exactly the kind of proactive posture this directive now demands. In response, this customer evaluated several solutions and chose Qualys to operationalize its ROC automation. Where competing solutions aggregated data and continued to generate theoretical risk insights, Qualys was the only platform in the evaluation that could detect AI speed across hybrid environments, hyper-prioritize millions of findings to the exposure that genuinely required immediate action, and autonomously fix them. That translated into bringing third-party sources into the platform while consolidating several siloed tools in a seven-figure annual booking sub-cell, adding ETM and True Risk Eliminate while expanding the existing Qualys footprint. This customer is now aligning with the agency's risk tolerance across nine separate bureaus, unifying detection with Agent Insta, exploitability-based prioritization with Agent Val, and recognizing the operational efficiencies and speed of automation, wave-based zero-day remediation with Agent Serra. These wins alongside several other six and seven figure federal and state wins in Q3 underscore the growing demand we see in our federal, state, and local government business, driven in part by agencies moving to meet these new operational requirements. They also reflect a consistent pattern we see across the business as more and more customers move from evaluating the AI native rock to operationalizing. Complementing this momentum, QFlex is emerging as a effective lever for platform adoption and ATM expansion. In the first full quarter following GA, QFlex customers increasing their average annual bookings by over 20% compared to their prior year annual bookings, while many added new modules to their subscription. Both wins I had just described with direct examples of QFLEX in action. The new federal agency customer consolidated into a QFLEX commitment spanning all seven modules from day one while the existing agency added ETM and True Risk Eliminate while expanding deployments at a footprint that already included seven Qualys modules. In both cases, QFLEX gave them the flexibility to commit more extensively across the platform while preserving the ability to shift investment as their risk priorities evolve. That's the commercial pattern QFlex was designed to create. Customers commit at a higher level because the model removes the friction of predicting exactly what modules they might need four months from now, which in turn drives higher utilization across the platform and positions us for larger upsells over them. Turning to strategic alliances, I'm pleased to announce that we recently delivered several new technology integrations spanning mobile and entity IoT and OT systems. As more organizations adopt the AI-native ROC as their autonomous risk fabric for pre-breach risk management, the value of that fabric grows with every new source of risk intelligence it can ingest, normalize, prioritize, and act on. These partnerships strengthen our multi-vendor architecture, extend the ROC's coverage, and serve as a key differentiator for Qualys. In summary, over three years ago, we set out to transform Qualys from a company seat in vulnerability management, detection, and response to a holistic, vendor-neutral, pre-breach risk management platform defined by measurable, proactive, and automated risk reduction at scale. This quarter, with the AI-native operational and gaining customer momentum, TrueRisk eliminated with true confidence, extending our reach to every type of asset, a growing federal customer business, strong product roadmap, and early QFLIX adoption broadening now customers' commitment to the platform. We are seeing the clearest evidence yet that organizations are choosing Qualys because we don't stop at just telling them what is wrong. We prove it's fixed. That's now driving larger commitments, deeper adoption, and stronger competitive differentiation while reinforcing our confidence in durable long-term growth. With that, I'll turn the call over to Joo Mi to further discuss our third quarter results and outlook for fourth quarter and full year 2026.

Thanks, Sumedh, and good afternoon. Before I start, I'd like to note that except for revenues, all financial figures are non-GAAP and growth rates are based on comparisons to the prior year period, unless stated otherwise. Turning to third quarter results. Revenues grew 11% to $188 million. As a result of our strategic emphasis on leveraging our partner ecosystem to drive growth, the channel continued to increase its contribution, making up 55% of total revenues compared to 50% a year ago. Revenues from channel partners grew 24%, offsetting a 2% decline in direct. By GEO, 50% growth outside the US was ahead of our domestic business, which grew 7%. U.S. and international revenue mix was 54% and 46% respectively. In Q3, our overall net dollar expansion rate remained unchanged from last quarter's 105%. The net dollar expansion rate of customers with prior year purchase of ATM or CSAM subscriptions improved to 108%, up from 107% last quarter. Moving on to product mix. ETM CSAM combined made up 12% of total bookings and 14% of new bookings on an LTN basis in Q3, up from last year's 10% and 11% respectively. Next, Hatch Management made up 9% of total bookings and 18% of new bookings on an LTN basis in Q3. This compares to 8% and 16% respectively in Q3 of last year. Lastly, Total Cloud made up 5% of total LTN bookings in Q3, unchanged from a year. AGM and JSM, combined with patch management, are driving a meaningful shift in our bookings composition toward higher value solutions. We expect that trajectory to continue as customers deepen their engagement with the platform. Total Cloud remains an important growth lever for the business. We are focused on improving adoption within our customer base. Reflecting on the scalable and sustainable business model, adjusted EBITDA through the third quarter of 2026 was $89.9 million, representing a 48% margin compared to 49% last year. Operating expenses in Q3 increased by 11% to $72.2 million, driven by investments in sales and marketing, which grew 17%. With this strong performance, EPS for the third quarter of 2026 was $2.12 per diluted share, The free cash flow was $100 million, representing a 53.2% margin compared to 52.7% in the third quarter of last year. In Q3, we continued to invest the cash we generated from operations back into Qualys, including $1.8 million in capital expenditures and $53.6 million to repurchase $330,000 of our outstanding shares. As of the end of the quarter, we had $176.1 million remaining in our share repurchase program. With that, let us turn to guidance, starting with revenue. For the full year 2026, we now expect revenues to be in the range of $736.9 to $738.9 million, which represents a growth rate of 10%. This compares to prior guidance of $732 to $738 million. For the fourth quarter of 2026, we expect revenues to be in the range of $191 to $193 million, representing a growth rate of 9% to 10%. Shifting to profitability guidance, for the full year 2026, we expect 46% EBITDA margin, the low double-digit increase in operating expenses, and free cash flow margin in the low 40s. We expect full-year EPS to be in the range of 8.07 to 8.14, up from the prior range of 7.74 to 7.88. For the fourth quarter of 2026, we expect EPS to be in the range of 2.05 to 2.12. Our planned capital expenditures in 2026 are expected to be in the range of $9.5 to $11.5 million. For the fourth quarter of 2026, in the range of $2.3 to $4.3 million. With that, Sumedh and I would be happy to answer any of your questions.

Thank you. As a reminder, to ask a question, please press star 1-1 on your telephone and wait for your name to be announced. To withdraw your question, please press star 1-1 again. and our first question will come from Jonathan Ho with William Blair. Your line is now open.

Hi, good afternoon and congratulations on another set of strong results. Sumedh, I wanted to start with sort of your comments around getting customers past some of their concerns around automated patch management and shifting that mindset away from the human in the loop towards full remediation. Can you talk a little bit about how that pathway works and ultimately what that can mean from a revenue or net retention standpoint?

Yeah, that's a great question, and I think nothing reflects better the mood in terms of what people are looking for than the CISSA BOT 2604 that essentially requires within 72 hour remediation of critical vulnerabilities. And so if you look at vulnerability management, the three core components really are how quickly, if you can detect it, then you have to prioritize the ones that need to be fixed and then you have to actually get it fixed. And so if you're talking about three days to do that and your existing approach on scanning is taking anywhere from two to five days to just get the information first, then you are applying manual prioritization on top of that and then if the remediation is taking you weeks to get that within IT tickets or it's always an emergency people are struggling with that and so what we are hearing in terms of conversations to our customers is really at the end of the day to achieve that 72 hour or 24 hour remediation cycle that people are looking for everybody has to sort of look at some sort of a roadmap that takes you into fast detection which we're doing with Instascan in less than 60 minutes Quick prioritization with agent value where you are able to reduce significantly the number of things that need to be fixed because we are testing existing controls and saying we don't need to fix it. And then the last piece, which is, as I mentioned in the earnings call, the only reason people don't patch everything is because they don't have enough confidence that it will not cause an outage. So with the advent or with the release of our Eliminate 2.0 with true confidence, what we have done is focused on remediation and collisions to be able to provide customers with AI powered reliability scores, additional comfort in knowing that certain things when they are deployed, we can actually tell them if the patch is going to be safe or not and monitoring with somebody like Dynatrace that if there are any issues. So the more we are providing in terms of having them see the value of that they can actually do this in an automated way with the confidence, with something like true confidence and the intelligence built in, that's really the only meaningful direction you can go now. People are looking to say, how do I go back to my board and give them that roadmap on how we are going to go from 0% automation and remediation when we are fighting AI-based autonomous exploits? put ourselves on a roadmap that over the next couple of years, we can actually get to the point where more and more automation can happen in a much quicker period of time. And so if you look at the way we have aligned ETM and eliminate, that's sort of how it is where ETM is helping you either pull data from VMDR or from other third party scanning solutions and very quickly figure out which of those exposures are exploitable. And then additionally, if you want to look at getting it remediated as well, then ETM or other True Risk Eliminate 2.0 with True Confidence is the additional thing that they can purchase to get to that point. And so that's really how we're seeing customer conversations as they're looking to say, how do I go back to provide confidence back to my organization that we can actually meet these requirements that are coming up more and more where you have to remediate within three days or 24 hours given how many vulnerabilities and exploit paths we're seeing coming out of these AI models that are being used by attackers.

That's very helpful. Just in terms of the pipeline, Joo Mi, can you maybe help us understand sort of the sustainability of You know, Qualys' booking strength, I mean, I think the CCB number was a little bit down from last quarter, but still very healthy here in the mid-teens. You know, how should we be thinking about sort of the shape of the pipeline and maybe the sustainability of that over time? Thank you.

Yeah, if you take a look at our bookings trajectory, what we see in the business today is really a healthy 8% is approximately what we're expecting for Q4 for Calculator Current Billings. And that stems from the fact that if you take a look at our BID in Q3, it was a really strong quarter. Another double digit current billings quarter at 14%, albeit, like you mentioned, slightly down from 16% last quarter. Part of it was due to, we had a really strong federal quarter. I think that the examples that we gave in the script kind of demonstrates our strength. We executed well, and this is something that we hope to continue. But with that said, it can be lumpy. We do have some of the pipeline for Q4, but right now, from non-federal business perspective, we kind of expect the 8% as a base case for calculated current billings. Ending the full year, calculated current billings grows of 11%. Thank you.

Thank you. And our next question will come from Roger Boyd with UBS. Your line's open.

Great. Thanks for the questions and congrats on the results. I want to double-click on Jonathan's question, Sumedh. We all hear from CISOs that operational confidence is the biggest barrier to automated patching. I guess, how is that product suite resonating with non-security buyers within enterprises? And is that at all changing your selling motion around the product? Are you bringing those non-security Thank you for your time.

those buyers the value of Qualys and our ability you know from a cybersecurity batch management perspective and what we're seeing now post the frontier AI model era we are seeing that IT teams and security teams are actually coming together we have been on calls where we have more conversations with the CIO teams as well now because they are all looking for some way for solutions that are focused on cybersecurity risk management. And now with true confidence, we do get into conversations with our IT teams to say, well, how are we giving higher confidence that we can separate patches that can be low impact but high value? How do we help them understand which ones will not cause an outage? How do we help you mitigate instead of patching? So that level of intelligence and information is definitely giving higher confidence to the IT teams. So what we do see is CIOs, CISOs are in certain conversations coming to the table. In some cases, right off the bat, they are going into autonomous remediation for 20, 30% of their estate. In some cases, they are saying, let's start consuming your intelligence first so that our IT teams can still fix things faster by leveraging the intelligence you're providing. And over time, we will move into a model where maybe We start by taking 15, 20, 30% of those stuff we can automate as we build the confidence. But like I said, the whole point of releasing that true confidence was it was very clear that the biggest blocker to patching is the lack of confidence it will not cause in our vision. If we can provide AI-powered intelligence to make that and so on. And so conversations are very much driven by our ability to remediate and that's the starting point for many conversations is how can you help me remediate so I can go back to the board and give them a story about how we are going to do autonomous remediation against AI-based autonomous exploitation. And then that leads into conversations around ETM, how ETM can further reduce what you are remediating. And by using ETM and eliminate together, you're reducing your operational risk while at the time increasing the speed at which you're able to actually get the things that are important fixed quickly. So we're pretty excited about the conversations that we're having right now. and like I said, things like the sub-border in trying to ask people to do immediate things in three days is definitely a driving force to say, what's an architecture that does not have siloed solutions that can really focus on getting that 1% fixed really quickly so I can meet these guidelines.

Gotcha. And then, Joo Mi, nice to see the strength in federal wins. We've been hearing you talk about the opportunity there for a couple of quarters. Nice to see that manifest. Can you just talk about the relative strength relative to what you typically see in that vertical? And it sounded like that was an area of outperformance. Any commentary on how the rest of the commercial business kind of trended relative to your expectations? Thanks.

Yeah, I think that primarily the beat was driven by the federal business. We haven't seen this type of outperformance when it comes to this vertical. We have been focused on making sure that we're building this pipe all throughout the year. And we were very pleased to see that the deals that we were working on actually ended up closing in Q3. And so that's really reflected in the current building. So if you take a look at our net dollar expansion rate, Staying the course at 105%, that has been picked up. And I think it kind of indicates that rest of the growth really came from the new local acquisition, which was primarily federal.

Got it. Thank you.

Thank you. And our next question is going to come from Rudy Kessinger with DA Davidson. Your line's open.

Hey, guys. Great. Thanks for taking my questions, and congrats on the strong quarter. You know, look, I think the question on a lot of investors' minds is, you know, really strong current calculated billions growth the last two quarters, 16% to 14%. Your guidance is only 8% for Q4. I guess, should we take the, you know, mid-teens growth the last two quarters to be an indication that we might see an acceleration in revenue growth at some point near term? Or should we look more towards that, you know, trailing 12-month figure that has improved a little bit but been relatively more stable I think that's just what everybody's asking here is, should we expect acceleration in revenue growth near term or not?

I think it's more of the latter. Based on what we were able to deliver, a lot of the discussions that we were having with a small cohort of customers that we have in place, and then in Q3 the primary the beat was from the federal albeit it would love that to continue or continue to work on that but it could be lumpy and so from our perspective the base case remains of course where we don't see a significant change in the net dollar expansion rate to our key KPI so that 105 percent is healthy it stayed the same from Q2, right now we don't see that materially changing. We are hoping that we continue to outperform the new local acquisition, but this is based on the pipeline that we see for Q4 and kind of seeing the course in terms of no material change in the sales cycle, the close rate. What we see right now is ending the year strong with current billings, closing the year at 11% for the full year, and then the revenue closing the year at 10%.

Okay, super helpful. And then secondly, just could you talk about the competitive environment, just who you're seeing there and how things have maybe changed versus a couple quarters ago or maybe even a year ago? Are you seeing more of the larger platforms in there that, you know, post-mythos have really amped up how much you're talking about patching and vulnerability scanning, things of that nature?

We, you know, we have been talking about vulnerability management evolving for a few years now before this whole thing came about, and that's why we started really focusing on Thank you very much. that is detecting you know tons and tons of new vulnerabilities which as you saw with the patch Tuesday you're just going to get more and more findings so what we are seeing is the vulnerability management is evolving where it's about not just about finding and detecting CVEs because it's just unmanageable at this point the number of CVEs being detected it's really about being able to do validation of those exploits like a hacker would and then actually running into and doing remediation with high confidence at a much faster speed. And so that's where for us, even if a customer has some other detection capability for CVEs with ETM, what we are seeing is those customers when they come and build a rock and they work with QALYS, they are pulling either using QALYS for fast detection or they're pulling data from maybe some other solution they might have and leveraging the QALYS ETM license to then figure out if that thing is exploitable and then the eliminate license to then go and run remediation so that they can actually get rid of that particular exposure in the three days, as the suborder said. So I think for us, we see that continuing less conversations about how many are you detecting more about, are you able to detect them fast than computing solutions, which are taking two to three days for scanning? And then the last piece is, well, ultimately, how can I build an automated workflow? The issue is that if you have a separate scanning solution, a separate prioritization capability, and a separate remediation capability, that makes it a lot harder to really get to that three-day remediation or 24-hour remediation that people are looking for. So the conversations are less about can somebody detect more CVs, really our conversations we're seeing are more about how do you help me build a story that I can take back to the board that shows a roadmap for autonomous remediation as a response to autonomous exploitation.

Thank you. And our next question. will come from Brian Essek with JP Morgan. Your line's open.

Hi, good afternoon. Thank you for taking the question. I'll echo my congrats on a second quarter of pretty healthy billings growth. I guess, Sumedh, a couple things stand out more from a trend perspective that I wanted to ask you about. One is the really nice growth in international business, sustainably in the mid-teens. particularly when you compare it to domestic which kind of had the tail on the Fed as you noted this quarter. And then also the partner contributions also seem to be ramping nicely. Is there a correlation between those two and how do we think about each of those in terms of your ability to win new logos outside of the Fed business which I know that you had a strong new logo traction with this quarter? Thank you.

Yeah, that's a great question. And we have been doubling down on working with our partners for the last few years. And so we're pretty happy with the way that contribution from partners has increased over time while maintaining our margins as well. So we do continue to see that as a way that we are going to see long-term impact. I think what we are also, our non-US business always tends to be more partner-driven, of course. But in general, I think what we are seeing is that right now, and typically we don't see that knee jerk reaction from our customers who are larger customers, enterprise customers. Everybody's sort of going through a cycle right now of This is a fundamental shift in the way vulnerability management has been done in the past and to be able to do the exploit validation that's now specifically required in the system as an example or to do autonomous remediation. Structurally, they have to figure out within their organizations how they can bring IT teams along, what kind of changes they need to make in terms of the team, the structure, the processes, et cetera. So a lot of the conversations that people are engaged in right now with us are about how do we continue over the next few quarters and next few years on changing out how vulnerability management is done. And our partners are a key part of that. So they are turning to the trusted partners to say, help me go back with a plan for autonomous remediation. And we are continuing to work with those partners. And so for us, we do see that the more and more we work with our partners, and you see the MROC partners program as well, our partners will be working with these customers to help them plan out their autonomous remediation capabilities and Hollis obviously is going to be a key part of that. So we do see this more as a continued long-term area of investment and we're excited about building out these capabilities with our partners.

Got it. Is there anything to infer about the profile of the international customers and what might make them a little bit more, I guess, right for better growth than domestically? Or how do we think about what you're seeing in OneGeo versus the United States?

Nothing really to call out that's different from what we have seen in the past.

Got it. Thank you very much. I appreciate it.

Thank you. And our next question will come from Joseph Gallo with Jefferies. Your line's open.

Hi, this is Grant Darling on for Joe Gallo. Thanks for taking the questions. You know, I wanted to start, the billings beat was really strong, revenue beat a little bit narrower than usual. Just to start, anything to call out with large deals or linearity and maybe how we should think about that going forward?

Yeah, current billing tends to be not exactly a great proxy when you're looking at how to recognize revenue relatively. But to call out the Q3 revenue, the linearity was worse than what we typically see in the quarter. So that did impact that came in slightly lower at 10.7% versus the 11% growth rate in Q2.

Got it. And then maybe just to unpack the expectations around that 8% billings in 4Q, just to As we're hearing about PHP pipeline opportunity patching, is there something from a renewal-based size or anything in 4Q that's maybe making you more optimistic on the 2027 trajectory versus 4Q?

I would say, like I said in what I mentioned earlier, we do see customers engage when these kind of things happen. But even in the past, when lock forgery and stuff came, we don't see that knee-jerk reaction immediately. That's like immediately in the quarter, of course. those cohort of customers that are up for renewal that already are having conversations about ETM and eliminating that quarter. Those conversations can be more fruitful at times, but overall when you look at the customer base and the opportunity that we have, we see this as a continued conversation with these customers who are very engaged with us to figure out what's the right way for them to make the changes internally within their teams, their processes, to be able to roll out and give their management a confidence in a new way of doing vulnerability management that is truly AI driven and is able to do autonomous remediation with the confidence of not having operational outages. And so those conversations are going to continue. We're seeing good pipeline of conversations happening there, and we're excited to see how and when these conversations will end up closing once these guys are able to go back and make the changes and put the proposals in front of their management. That's going to take some time. So I think right now we're focusing on those conversations rather than some sort of a knee-jerk reaction immediately happening this quarter.

Great. Thank you.

Thank you. And the next question will come from Mike Sikos with Needham. Your line's open.

Hey, great. Thanks for taking the questions here, guys. I just wanted to come back to the QFlex customers that we're adopting. The average annual bookings increase of over 20% versus prior year was an impressive stat. I know it's early here, but Was that 20% plus similar to what you guys had seen in the prior quarter? Or is the prior quarter just too small to even start comparing and contrasting? I'd just love to get a sense of how that 20% plus track versus precedent as well as how we're looking here in a Q4. Thank you.

Yeah, it was really too small. So we just went GA with QFlex last quarter. So what we wanted to do is just give you an indication, an anecdotal example of us, even though it was a small cohort of customers that started with QFlex last year, to give you a sense of what we're kind of expecting going forward. This is in line with our expectation as in if you purchase QFlex. What will enable our customers to do is try out other products, which makes it much easier when it comes to the annual renewal. When they come, they'll be able to convince themselves or better justify the increase in spend with QALYT. So it was a great kind of a testament or validation of the whole point of QFLAGS, why it could be a win-win for both parties.

Terrific. I'll keep it to one. Thank you so much.

Thank you. And our next question will come from Meta Marshall with Morgan Stanley. Your line's open.

Great, thanks.

As you've expanded the budget or the audience of budgets and interested buyers and that brings much more of our resiliency audience, has that changed kind of what partner channel you think will be the most successful or the ones that you're making investments in?

I'm not sure I understood the question. This was hard to hear you, sorry.

This is, sorry, as we were kind of focused on more, getting more CIOs and kind of resiliency budgets involved, is that changing kind of the overall, like, what channel partners you think are going to be more successful, the ones that you're making more money from?

Yeah, that's a good question. I mean, I think we're seeing more conversations that are with our managed service partners, our MROC partners, because the CISOs are looking at less about like, you know, how can I more efficiently buy this particular tool and more about guidance on how they can have a risk-based conversation with their boards and management. And so when those kind of conversations come up, we tend to see our large MSSP partners or MROC partners that are, you know, authorized MROC partners are the ones that work with us closely because they're able to go in and have conversations more around business risk rather than, you know, just because the number of CVEs and patches they went up 15 times doesn't mean that the budget's going to go 15 times, right? So how are you going to work with that particular customer to be able to work with them and put a plan in place that allows them to find the right investment, optimize across the platform, and have a risk-based conversation with the board. So I don't know that it's really changing the partner conversation, but it does end up becoming more strategic when it's the conversations with the MSSP partners and the MROC partners.

That's great.

Thanks. So helpful.

Thank you. And our next question will come from Joshua Tilton with Wolf Research. Your line's open.

Hey guys, thanks for taking my questions. Can you hear me? Yeah. Awesome. I just have two kind of clarification questions. My first one is, I think a lot of us on the call are seeing two really solid quarters of current buildings growth. And there are, you know, a million different things, I would call it in like the in the in the cyber narrative that, you know, we can all want to and try to and hope to point that those, you know, two quarters of billions are coming from, whether it's mythos or AI or whatever other awesome narratives. that you want to point to today. But it sounds like on the call you're trying to tell us that these two quarters kind of seem to be pretty unrelated. Last quarter, the outperformance was driven by just some outsized mythos spending, and this quarter it seems to be driven by a good Fed A good Fed vertical quarter. I'm trying to just understand, like, is that how we're supposed to interpret it? And if that's the case, like, you know, I guess, how do you, I guess, how do you view your 8% base case for Q4 versus the last two quarters? And you kind of also pointed that to us to that same base case, and then now outperformed. Are there just less You know, opportunities for outperformance in Q4 versus the last two quarters because we don't have the said quarter closing and that mythos spending is behind us. Does that make sense?

Yes. So The reason why we called out the primary drivers of the outperformance or the beat that we hadn't necessarily expected was so that you understand how our business is performing. So I would say right now the base case is 8%, not to say that these outperformance will not continue going forward. It could be due to different reasons, but like, for example, Q4, what we see in the pipeline is 8% based on the historical close rate, historical sales cycles, but it could very well be the case that we have another strong federal quarter. right, which could explain the beat. So there is a scenario where you have the base case of 8%, there's room for outperformance. But with that said, we're not assuming that as a base case today. So what we talked about post-NISOs is at that point in time, we had a small cohort of customers that we were talking to already about upgrading to ETM and purchasing, patch management, eliminate at that point in time, and then they ended up executing. and since then of course we have other customers that we have continued to have discussions around and those set of customers could easily close in Q4 as well. So the reason why we called it out is so that you understand kind of what we expected and then the potential upside was greater in 2026 and I think it will be greater in Q4 based on the conversations that we have and the size of deals that we're seeing today.

Okay, super helpful and then maybe just One other point of clarification is you did say that that linearity was a little worse this quarter, which is what drove the lighter revenue beat. I think those mechanics totally make sense. Can you just help us understand, like, at least from your perspective, why was linearity worse? Like, is there a reason as to why linearity came in below expectation?

Yeah, it really has to do with at the timing of the closing of the deal. So, for example, Q3 was a strong new local acquisition quarter. and like it ended at the near the end of the quarter. So it impacted the revenue recognition. So it really depends on the percentage of the deals coming from you as well as UPSA versus the renewal and the timing of that close and how much we're able to recognize in the quarter that could have like a couple hundred thousand impact on the revenue.

Okay. Super helpful. Thanks, guys.

Thank you. And our next question will come from Srinik Kothari with Bayard. Your line's open.

Hey, guys. This is Zack Schneider on for Srinik. Thanks for taking our question. So maybe to follow up to that last one, actually, you know, previously you talked about how the change you were seeing with customers was starting with a larger deployment and not materially shorter sales cycles. Curious to hear it in Q3 if that remained the pattern or if you're now seeing evaluations convert faster or purchases happen outside normal renewal windows. Thank you.

Yeah, from a business that kind of closed sales cycle perspective, we don't really see a material change or an improvement. That's part of the reason why our base case in terms of what we're expecting for the growth rate remains the same. from a sales productivity perspective, win rate, from all those traditional metrics perspective, it remains a course as in we don't see significant changes one way or the other. What we are seeing is some of the larger deals that we don't necessarily are able to predict exactly when the deals will close are closing at different times, period of time. So, for example, in Q3, it was a really strong quarter. We hadn't needed all these deals in the federal space to close in Q3. Some of them could have easily slipped into Q4, especially because it's their new local acquisitions, but they ended up closing in Q3, which was great for us.

Got it. That's great. And then maybe among customers that renewed the core subscription while continuing to evaluate ETM or to risk eliminate, are the incremental purchases or some of those at least now closing and are they landing at the scope that you guys originally expected?

I think the conversations continue to be strong. I think we're excited about what we are hearing from them Elimination and deploying that like we talked a few times earlier right it just really depends on a little bit how internally their organizations are able to move to make it happen quicker or maybe taking a little bit more time because they would have to sometimes bring along their dev team sometimes they have to bring along their IT team so that when it comes to the eliminate capabilities etc that becomes a little bit of a I think where it might take a little bit longer at times, it might move a little bit quicker. So some of that really impacts on, yes, do they have the runway now to make it part of the renewal itself, or they want to add a little bit, but then they want to add more once they get the broader teams onboarded. That timing sometimes can be really figured out by their IT team. I mean, one of the federal examples we gave was a new logo for us, but they didn't have Qualys, They deployed Qualys within less than six weeks. They already had tens of thousands of agents deployed with no issues and the CISO went into the platform and said hey what's this button do and he said you know he could see a patch all buttons so he worked with his IT team to press the button and they have 300,000 patches deployed within you know going from no qualis at all to see within six weeks having deployed 300,000 patches with zero outages right so in their case they were able to bring along the IT team and move fast in some cases it takes a little bit longer so it just depends a little bit on how they're internally able to make it's not just adding The license of the same capability. So that's where we are also working with these customers where some of those deals might close a little bit sooner. Some of them might take a little bit longer as they go through work with their internal teams to get this to happen. It's great to hear. Thank you.

Thank you. And our next question is going to come from Luke Morrison with Canaccord. Your line's open.

Hey, guys. Thanks for taking the question here. So You know, we've had several high profile AI discovered vulnerability events this year, most recently, obviously, PHP to Shell in October. Maybe just stepping back from any one of those incidents, like what does an event like that do to your buying cycles and pipeline? Does it have a tendency to maybe pull decisions forward?

Yeah, so we've been consistent about this even all the way back to when SolarWinds and, you know, Lock Forge happened is, you know, what we see with our customer base is not a typical knee-jerk reaction where, you know, they're just somehow suddenly buying in the same quarter just to show that they're doing something. A lot of our conversations with customers tend to be, you know, when you take a step back, what are these celebrity vulnerabilities, as we like to call them, indicating. And by the way, on the same day as PHP2Shell, there was a Node4j vulnerability that was also pretty critical. But now when you have overlapping vulnerabilities like that, people don't even know how to track so many of these coming out. So like I said, the conversations with our customers are less sort of a knee-jerk, what can I do immediately, but more about the fact that overall approach towards vulnerability management cannot continue the way it has been where it takes a week to scan, another week to import the data into a C10 solution which then gives you a dashboard and then that dashboard is then reviewed by the IT team and then tickets are created and things are fixed in like three weeks or four weeks that has to fundamentally change across processes, across tools, across different teams. And so what we see is a pretty good increase in the number of conversations on how to do with when it comes to that. But that doesn't necessarily mean immediately that this quarter is something that we're gonna see them but just a bunch of things. I think it again goes back and depends on their ability a little bit to go and make that happen politically also within their own environment and those who are able to bring their IT teams to the table quicker. We see them move faster and others are still working through to say that they will need to work on making sure they get the right alignment because this is not just the security by one tool and it's going to be done, right? It's going to be a change in process. How do we go from one week detection to 60 minute detection? How do we go from a theoretical validation to actually running the exploits ourselves and not having those exploits go crazy on us. And then how do we actually do some form of autonomous remediation? So a lot of these are less about just buying more of the tool and more about fundamental change. But the encouraging thing for us is those conversations about changes and how they're going to do vulnerability management, exposure management moving forward are happening. And so that excites us that over the next few quarters and years, we are excited to see how that's going to build up into our business.

Yeah, makes sense. And maybe just for my follow-up, you know, if I look back over the last, call it decade plus, you know, I would think most incremental security budget has gone to detection and response, with response obviously being after an incident occurs. If I think about this new paradigm, you know, AI shortens the time from disclosure to exploit. Do you see budgets actually moving from that reactive side of the market to the proactive side where you guys are living?

There's no doubt that we are seeing those conversations in terms of how do we take a newer approach to pre-breach risk management because the number of things coming at us are so significant and The speed at which they are being exploited are so high that everybody needs to look at a new paradigm and you cannot wait for a breach to happen to then take response after that. I think I always talk about this is like when you're buying a car, you know, you kind of have your airbags that if you hit something, the airbag is going to protect you, but doesn't mean you're not going to buy a car with brakes. and that's the same thing that if you have a good break doesn't mean you're not going to get airbagged. So I think the way we look at it is ability to take proactive actions to prevent any issues from happening is becoming more and more part of the conversation now. But like I said, it does take them a bit of effort to change organizationally and tool-wise internally. So I have no doubt that over a period of time, we're going to see the shift where more and more proactive risk management is a focus. It is just now a question of when that timing is and how we're going to get there. But we are seeing definitely a more focused approach on pre-reach risk management to complement. And that's why we have the concept of a ROC, which complements the SOC. So the SOC is after the fact. The ROC is more proactive risk management.

Thank you.

Thank you. And our last question will come from Rob Owens with Piper. Your line is open.

Great. Thank you guys for squeezing me in. I was hoping to touch a little bit on large transactions. Looked like one of your better quarters in terms of over 500K deals to date. Just What's driving that execution at this point, and are you actually seeing lands that large, or is that mainly within the install base?

Like I said, I think the desire to kind of have the end-to-end workflows, which is more complex in larger customers, and so they, Qualys, in the way our platform is always trying to solve the more complex problems for the more complex customers, and so The adoption of those capabilities is sort of what is driving that increase in that 500K plus. And so again, it depends quarter to quarter, but I think we're happy with that direction. And we're looking forward to continuing that momentum by working with those customers and finding a way. When new customers also come, they're not looking just to replace a scanning solution with another scanning solution. So they are looking to add a remediation. They're looking to add ATM. And so you see that in the numbers as well where new bookings, ATM bookings, percentage of some of these capabilities is also higher. So we're seeing that on both sides. in terms of the interest in evolving their overall risk management program and not just adding another scanner or replacing a scanner with another scanner.

And Joo Mi, with retention rates remaining at 105, have we flattened out here or could you still see some volatility moving forward in terms of that number potentially going down a bit?

We're not expecting that right now based on the momentum of the business. I think that it's more likely that it moves up rather than down or like most likely scenario of course is right now kind of recording 105% last quarter, 105% this quarter. With that said, ETM CSAM customer cohort did go up from 107 to 108%. So based on that, I would say that for now we're not expecting a tick down in Q4.

All right, thank you very much.

Thank you. This does conclude today's conference call. Thank you for participating and you may now disconnect.