Qualys, Inc. (QLYS) Earnings Call Transcript

Ladies and gentlemen, thank you for standing by. Welcome to Qualys' Third Quarter 2026 Investor Call. [Operator Instructions]. Please be advised that today's conference is being recorded. I would like now to turn the conference over to Blair King, Investor Relations. Please go ahead.

Thanks, Michelle, and good afternoon, and welcome to Qualys' Third Quarter 2021 Earnings Call. Joining me today to discuss our results are Sumit Dakar, the President and CEO; and Jamie Kim, our CFO. Before we get started, I would like to remind you that our remarks today will include forward-looking statements that generally relate to product capabilities, future events or our future financial or operating performance. Actual results may differ materially from these statements. Factors that could cause results to differ materially are set forth in today's press release and our filings with the SEC, including our latest Form 10-Q and 10-K. Any forward-looking statements that we make on this call are based on assumptions as of today, and we undertake no obligation to update these results of new information or future events. During this call, we will present both GAAP and non-GAAP financial measures. A reconciliation of GAAP to non-GAAP measures is included in today's earnings press release, -- and as a reminder, the press release, prepared remarks and investor presentation are all available on the Investor Relations section of our website. So with that, I'd like to now turn the call over to Sumedh.

Thank you, Blair, and welcome to our third quarter earnings call. AI has fundamentally transformed the advisory's playbook, graduating from accelerating existing attack techniques to autonomously operating inside life production environments. To put the scale of this shift in perspective, Microsoft's recent Patch Tuesday, disclosed 1,414 new vulnerabilities in a single release compared to 93 before the advent of Frontier AI. That's a 15-fold increase in exposure volume within the last 7 months alone that every enterprise must now absorb in real time. Within 10 minutes of Microsoft publishing this advisory agent in star powered by Instaposted scanless detections in a customer's environment, giving them immediate view of their exposure, no scan cycle, no agent disruption, no days long wait, the detection at AI speed. But detection alone changes nothing if what follows still takes weeks. Still relies on manual handoffs and still can't prove the exposure is closed. Events like the PHP to Shell disclosure and others are just a warning of what lies ahead and the need for speed from disclosure to remediation is clear. Durable pre-breach risk management requires a vendor-neutral agentic-ARSk fabric that can autonomously transform detections into proven remediation of actual exploitable risk at the speed of modern attacks. Against this backdrop, we delivered another strong quarter of revenue growth and profitability alongside one of our most meaningful quarters of platform innovation to date. The execution reflects a clear shift in how customers evaluate and select their security platforms. The traditional CTEM model wasn't built for this moment and it shows more findings, more theoretical risk scores, more dashboards and more handoffs each one a gift of time to an advice adversary that now operates at machine speed. When customers can't patch fast enough to outrun autonomous expectation, the last thing they need is another tool that tells them what's wrong and passes the problem to someone else to fix. CSOs are looking to update their boards with their plan of action against autonomous exploitation with the road map of autonomous remediation instead of more manual tools and processes. That architecture was already losing before the frontier AI era. Today, against an AI-powered adversary, it's indefensible. We developed the vision and build the AI native rock powered by our ETM solution over 3 years ago to end that cycle entirely. Today, agent in star powered by InstarScan is detecting newly exposed vulnerabilities at customer systems in less than 60 minutes of disclosure on an average? Agent valve powered by TruConfirm has already performed approximately 9 million exploit validation across customer environments and still 11% of those confirmed exploitable, eliminating 89% of that noise would have been otherwise consuming security and IT resources. And risk eliminate with Agent Sara has helped customers deploy over 180 million patches in the last 12 months alone, with 60% of those running autonomously doubling from 30% a year ago at a rollback rate of fuel than 1 in 8,000. Together, they operate natively in a continuous closed loop that proves autonomous closure within hours, not weeks. The AI native rock isn't a road map. It's not a vision slide. It's operational, measurable and provable and that's nearly all enterprise and federal customer conversations are center. Carrying this momentum forward, we are further evolving our ETM and Truist eliminate capabilities through an expanded ecosystem of remediation solutions. Over the last 2 quarters, we introduced our AI-powered patch liability score agents are of wave-based remediation, peer-to-peer patching and AI-guided rollbacks. The cumulative effect of our TrueRisk eliminate agenda gives organizations confidence to deploy in production environment with rollback rates below 11% across well over 0.5 billion patches delivered to date, including more than 200 million executive autonomously. That customer confidence is translating into accelerating adoption with patch deployments up 47% from the advent of Frontier models in early April of this year and autonomous deployments growing even faster. The biggest blocker to faster patching is lack of confidence in operational outcome. At our recent Rokan conference in Austin, we built on this foundation by announcing what we call autonomous remap brought to life through risk eliminate 2.0 with true confidence. TruePoint Finance is a remediation and orchestration intelligence engine delivered on a straightforward operating principle, fixed the minimum, credit existing controls choose the right remediation path, control the rollout and prove that it held. The new capabilities represent meaningful new ground for balance. First, before a corrective action is raised true confidence assesses the protection already provided by third-party security controls. So customers don't duplicate their efforts. Second, it extends coverage beyond endpoints to cloud applications, perimeter and edge assets, including routers, switches, firewalls and airgap infrastructure that historically sat outside response workload because they cannot run an agent. And third, build on the rollback capabilities, we introduced last year, post deployment, operational resiliency monitoring through partners like Dynatrace now track system health to confirm the environment remains stable post patch. When a past doesn't hold AI power patch failure analysis explains root cause in Clean English and recommends corrective action. The result is an AI-native rock, which serves at both the system of record and the system of action for cyber risk reduction. Other vendors entering the mitigation conversation are orchestrating a handoff of agent-based endpoints and passing a patching recommendation to a third-party to without giving the operational confidence and no verification that the fix was successful we applied or that the environment remains stable afterwards. The Qualys platform was purpose-built to eliminate that hand off entirely and delivers natively integrated autonomous ramp ups with true confidence at scale, rapidly proving closure across every domain and asset type. With Qualys no asset, whether it runs an agent or not and no exposure, whether a patch exist or not will be left without an immediate path to closure. Our continuous innovation and industry-leading capabilities are now garnering significant recognition from customers, partners and independent analysts in the 2026 forest survey for proactive security platforms, Qualys received the highest rating among all evaluated vendors on the key criteria including network visibility exposure, business-driven prioritization and remediation. Additionally, Koping [indiscernible] Qualys all is the highest rated leader in the 2026 leadership compass for our back surface management earning the top position in both product and market leadership, both underscore our customer-driven engineering and growing competitive differentiation across the platform. Moving to our business update. The number of customers spending $50,000 or more with us grew 15% from a year ago to 243. Let me now share a couple of recent wins, which illustrate why organizations are turning to Qualys to help unify their security stacks, operationalizing the rock and put autonomous remediation to work. First, we closed a new low 7-figure annual booking deal with a large government agency. This agency had been running on an on-prem vulnerability management program for years, scanning with one vendor manually triaging across disconnected dashboards and handling patch cycles after yet another vendor. As the detection volumes surged, the model was breaking down. Response backlogs were growing and the agency kept falling further behind. Seeking to streamline operations, the agency run a highly competitive process and selected Qualys to help activate its rock on a single Fed ramp high authorized platform. In doing so, it landed with 7 Qualys modules right out of the gate, including ETM, ETM identity, VMDR, truesaluminate, policy audit, total cloud and total upside. The net result is that this agency has now consolidated a fragmented multi-vendor workflow into a unified AI-powered risk fabric. A fabric that detects exposure within minutes of disclosure validates actual exploitability, so teams can act on real risk rather than theoretical scores and automate response by natively applying patches and other compensating controls when patches are too risky to deploy or unavailable. What used to take weeks from detection to confirm fixed now takes hours and a patch backlog that has been compound executed that for years is now under control. Given the success of this deployment, the customer is now actively evaluating total AI and planning to deploy Asian TKI workflows across its operations. The second was an existing large federal agency, which has struggled to manage its cloud and infrastructure security using siloed tools while manually consolidating findings with no unified view of risk, prioritization relied on CVS' security scores rather than valid exploitability and their security IT teams are making critical decisions on incomplete data. Threat Response had historically followed a pattern here to often security operations identified a vulnerability open a ticket handed to an IT team running a third-party person to a cycle that average weeks from identifying threats to assume fixed. With the advent of the Seaport 264, which requires agencies to operationalize based remediation and address AI accelerated threats that compressed expert time lines to ours, that cycle was no longer sustainable. Our own threat research units 5-year analysis of more than 1.5 billion critical vulnerability instances shows that Qualys customers have already remediated approximately $173 million exposure before they were entered in SSAs catalog, which is exactly the kind of proactive posture this directive now demands. In response, this customer evaluates several solutions and chose Qualys to operationalize its Rock automation, where computing solutions aggregated data and continue to generate theoretical risk insights, Qualys was the only platform in their valuation that could detect AI speed across hybrid environments, hyperprioritized millions of findings to the exposure that genuinely required immediate action and autonomously fix them. That translated into bringing third-party sources into the platform with -- while consolidating several silo tools in a 7-figure annual bookings upsell, adding ETM and TruRisk aluminate while expanding the existing Qualys footprint. This customer is now aligning with the agency's risk tolerance across 9 separate bureaus unifying detection with agent in stock exploitability based prioritization with agent value and recognizing the operational efficiencies and speed of automation wave-based 0-day remediation with agents. These wins, alongside several other 6- and 7-figure federal and state wins in Q3 underscore the growing demand we see in our federal state and local government business, driven in part by agencies moving to meet these new operational requirements. They also reflect a consistent pattern we see across the business as more and more customers move from evaluating the AI native rock to operationalizing. Complementing this momentum, Q-Flex is emerging as an effective lever for platform adoption and ATM expansion. In the first full quarter following GA Q-Flex customers increasing their average annual bookings by over 20% compared to the prior year annual bookings, while many added new modules to their subscription. Both wins I had just described with direct examples of Cflex and action. The new federal agency customer consolidated into a Q-Flex commitment spanning also on modules from day 1, while the existing agency added ETM at TruRisk aluminate while expanding deployments at a footprint that already included 7 Qualys modules. In both cases, Q-Flex gave them the flexibility to commit more extensively across the platform while preserving the ability to shift investment as their risk priorities evolve. That's the commercial pattern flex was designed to create. Customers come in at a larger -- at a higher level because the model removes the friction of predicting exactly what modules they might need 4 months from now, which in turns drives higher utilization across the platform and positions us for larger upsells over them. Turning to strategic alliances, I'm pleased to announce that we recently delivered several new technology integration spanning mobile and entity, IoT and OT systems as more organizations adopt the AI native rock as their autonomous risk fabric for pre-breach risk management, the value of that fabric grows with every new source of risk intelligence, it can ingest normalize, prioritize and act on. These partnerships strengthen our multi-vendor architecture, extend the rock coverage and serve as a key differentiator for Qualys. In summary, over 3 years ago, we set out to transform Qualys from a company seat in vulnerability management, detection and response to a holistic vendor-neutral pre-breach risk management platform defined by a measurable proactive and automated risk reduction at scale. This quarter, with the AI native operational and gaining customer momentum, Trurisk eliminate with true confidence extending our reach to every type of asset, a growing federal customer business, strong product road map and early Flex adoption broadening now customers coming to the platform. We are seeing the clearest evidence that organizations are choosing Qualys because we don't stop at just telling them what is wrong, we prove it's fixed. That's now driving larger commitments, deeper adoption and stronger competitive differentiation while reinforcing our confidence in durable long-term growth. With that, I'll turn the call over to Joo Mi to further discuss our third quarter results and outlook for fourth quarter and full year 2026.

Thanks, Sumedh, and good afternoon. Before I start, I'd like to note that acceptable revenue, all financial figures are non-GAAP and growth rates are based on comparisons to the prior year period unless stated otherwise. Turning to third quarter results. Revenues grew 11% to $188 million. As a result of our strategic emphasis on leveraging our partner ecosystem to drive growth, the channel continued to increase its contribution, making up 55% of total revenues compared to 50% a year ago. Revenues from channel partners grew 24%, offsetting a 2% decline in direct. BGO, 50% growth outside the U.S. was ahead of our domestic business, which grew 7%. U.S. and international revenue mix was 54% and 46%, respectively. In Q3, our overall net dollar expansion rate remained unchanged from last quarter's 105%. And the net dollar expansion rate of customers with prior year purchase of ATM or CSM subscriptions improved to 108%, up from 107% last quarter. Moving on to product mix. TCM combined made up 12% of total bookings and 14% of new bookings on an LTM basis in Q3, up from last year's 10% and 11%, respectively. Next, Patch Management made up 9% of total bookings and 18% on new bookings on an LTM basis in Q3. This compares to 8% and 16%, respectively, in Q3 of last year. Lastly, total cloud made up 5% of total LTM bookings in Q3, unchanged from a year -- [indiscernible] tam, combined with touch management are driving a meaningful shift in our bookings composition towards higher-value solutions. We expect that trajectory to continue as customers deepen their engagement with the platform. Total cloud remains an important group level for the business, and we are focused on improving adoption within our customer base. Reflecting our scalable and sustainable business model. Adjusted EBITDA for the third quarter of 2026 was $89.9 million, representing a 48% margin compared to 49% last year. Operating expenses in Q3 increased by 11% to $72.2 million, driven by investments in sales and marketing, which grew 17%. With this strong performance, EPS for the third quarter of 2026 was $2.12 per diluted share and free cash flow was $100 million, representing a 53.2% margin compared to 52.7% in the third quarter of last year. In Q3, we continued to invest the cash we generated from operations back into Qualys, including $1.8 million in capital expenditures and $53.6 million to repurchase $330,000 of our outstanding shares. As of the end of the quarter, we had $176.1 million remaining in our share repurchase program. With that, let's turn to guidance, starting with revenue. For the full year 2026, we now expect revenues to be in the range of $736.9 million to $738.9 million, which represents a growth rate of 10%. This compares to prior guidance of $732 million to $738 million. For the fourth quarter of 2020, we expect revenues to be in the range of $191 million to $193 million, representing a growth rate of 9% to 10%. Shifting to profitability guidance. For the full year 2026, we expect 46% EBITDA margin, the low double-digit increase in operating expenses and free cash flow margin in the low 40s. We expect full year EPS to be in the range of $8.07 to $8.14, up from the prior range of 7.74 to $7.88. For the fourth quarter of 2026, we expect EPS to be in the range of $2.05 to $2.12. Our planned capital expenditures in 2026 are expected to be in the range of $9.5 million to $11.5 million. For the fourth quarter of 2026 in the range of $2.3 million to $4.3 million. With that, Sumedh, I would be happy to answer any of your questions.

[Operator Instructions] Our first question will come from Jonathan Ho with William Blair.

Congratulations on another set of strong results. Sumedh, wanted to start with sort of your comments around getting customers past some of their concerns around automated patch management and shifting that mindset away from the human in the loop towards full remediation. Can you talk a little bit about how that pathway works and ultimately, what that can mean from a revenue or net retention standpoint?

Yes, that's a great question. And I think nothing reflects better the mood in terms of what people are looking for, then the sub20 that essentially requires within 72-hour remediation of critical vulnerabilities. And so if you look at vulnerability management, the 3 core components really are how quickly if you can detect it, then you have to prioritize the ones that need to be fixed and then you have to actually get it fixed. And so if you're talking about 3 days to do that and your existing approach on scanning is taking anywhere from 2 to 5 days to just get the information for us. Then you are applying manual prioritization on top of that. And then if the remediation is taking weeks to get that within IT tickets or it's always an emergency, people are struggling with that. And so what we are hearing in terms of conversation to our customers is really, at the end of the day to achieve that 72-hour or 24-hour remediation cycle that people are looking for. Everybody has to sort of look at some sort of a road map that takes you into fast detection, which we're doing with Instascan less than 16 minutes. Quick prioritization with agent valve where we are able to reduce significantly the number of things that need to be fixed because we are testing existing controls and saying we don't need to fix it. And then the last piece, which is, as I mentioned in the earnings call, that the only reason people don't patch everything is because they don't have enough confidence that it will not cause an outage. So with the advent or with the release of our eliminate 2.0 with true confidence, what we have done is focused on remediation and collisions to be able to provide customers with AI-powered reliability scores, additional comfort in knowing that certain things when they are deployed, we can actually tell them as the patches going to be safe or not and monitoring with somebody like Dynatrace that if there are any issues. So the more we are providing in terms of having them see the value off that they can actually do this in an automated way with the confidence with something like true confidence and the intelligence built in. That's really the only meaningful direction can go now. People are looking to say, how do I go back to my board and give them that road map on how we are going to go from 0% automation and remediation when you are fighting AI-based autonomous exports, how do we put ourselves on a road map that over the next couple of years, we can actually get to the point where more and more automation can happen in a much quicker period of time. And so if you look at the way we have aligned EGM and eliminate that sort of how it is where ETM is helping you either pull data from the MDR or from other third-party scanning solutions and very quickly figure out which of those exposures are exploitable. And then additionally, if you want to look at getting it remediated as well then ATM or other trurisk eliminate 2.0 with true confidence is the additional thing that they can purchase to get to that point. And so that's really how we're seeing customer conversations as they're looking to say, how do we -- how do I go back to provide confidence back to my organization that we can actually meet these requirements are coming up more and more where you have to remediate within 3 days or 24 hours given how much -- how many vulnerabilities and expect path you're seeing coming out of these AI models that are being used by attackers.

That's very helpful. Just in terms of the pipeline, Joo Mi, can you maybe help us understand sort of the sustainability of Qualys' booking strength? I mean, I think the CCB number was a little bit down from last quarter, but still very healthy here in the mid-teens. How should we be thinking about sort of that -- the shape of the pipeline and maybe the sustainability of that over time?

Yes. If you take a look at our bookings trajectory, what we see in the business today is really a healthy 8% is approximately what we're expecting for Q4 calculated current billings. And that stems from the fact that if you take a look at our beat in Q3, it was a really strong quarter. Another double-digit current billings quarter at 14%, albeit like you mentioned, slightly down from 60% last quarter. Part of it was due to -- we had a really strong federal quarter. I think that the examples that we gave in the script kind of demonstrate our strength. We executed well, and this is something that we hope to continue with that said, it can be lumpy. We do have some of the pipeline for Q4. But right now from non-federal business perspective, we kind of expect the 8% as a base case for calculated current billings, ending the full year calculated current billings growth of 11%.

And our next question will come from Roger Boyd with UBS.

I wanted to double click on Jonathan's question, Sumedh. We all hear from CSOs that operational confidence is the biggest barrier to automated patching. I guess how is that product suite resonating with non-security buyers within enterprises. And is that at all changing your selling motion around the product? Are you bringing those nonsecurity buyers into the sales process? And is that at all giving you access to additional budget?

Yes, very good question. I think what we are seeing right now is when we started with patch management a few years ago, sort of the first ones in the industry. We learned a lot from that, and there's always has been a bit of that pushback from those IT teams because they might be using in scanning solution, et cetera. But we did pretty well over the years convincing those buyers, the value of Qualys and our ability from a cybersecurity patch management perspective. And what we're seeing now post the Frontier AI model era, we are seeing that IT teams and securities are actually coming together. We have been on calls where we have more conversations with the CIO teams as well now because they are all looking for some way for solutions that are focused on cybersecurity, risk management and with now with true confidence, we do get into conversations with their IT teams to say, well, how are we giving higher confidence that we can separate patches that can be low impact, but high value, how do we help them understand which ones will not cause an outage. How do we help you mitigate in sort of patching, so that level of intelligence and information is definitely giving higher confidence to the IT team. So what we do see is CIO, CSOs are in certain conversations coming to the table in some cases, right off the bat, they are going into autonomous remediation for 20%, 30% of the estate. In some cases, they're saying, let's start consuming your intelligence first so that our IT teams can still fix things faster by leveraging the intelligence you're providing. And over time, we will move into a model where maybe we start by taking 15%, 20%, 30% of the stuff we can automate as we build the confidence. But like I said, the whole point of releasing that true confidence was -- it was very clear that the biggest blocker to patching is the lack of confidence they will not cause on our base. And if we can provide AI powered intelligence to make that decision much smarter and quicker than we are going to see more and more adoption of this going forward. And so conversations are very much driven by our ability to remediate and that's the starting point for many conversations is how can you help me remediate so I can go back to the board and give them a story about how we are going to do autonomous remediation against AI-based autonomous exploitation. And then that leads into conversations around ETM, how ETM can further reduce what your remediating and by using ETM and eliminate together, you're reducing your operational risk while at the time increasing the speed at which you're able to actually get the things that are important fixed quickly. So we're pretty excited about the conversations that we're having right now. And like I said, things like the suborder in trying to ask people to remediate things in 3 days is definitely a driving force to say what's an architecture that does not have siloed solutions that can really focus on getting that 1% fixed really quickly, so I can meet these guidelines.

Got you. And then Joo Mi, the strength in federal wins. We've been hearing you talk about the opportunity there for a couple of quarters, made to see that manifest -- can you just talk about the relative strength relative to what you typically see in that vertical? And it sounded like that was an area of outperformance. Any commentary on how the rest of the commercial business kind of trended relative to your expectations?

Yes. I think that primarily the beat was driven by the federal business. We haven't seen this type of outperformance when it comes to this vertical. We have been focused on making sure that we're building the pipe all throughout the year, and we are very pleased to see that the deals that we were working on actually ended up closing in Q3 and so that's really reflected in the current billings. So if you take a look at our net dollar expansion rate, in the course of 105%, that has been picked up. And I think it kind of indicates that rest of the growth really came from the new local acquisition, which was primarily federal.

And our next question is going to come from Rudy Kessinger with D.A. Davidson.

Congratulations on the strong quarter, I think the question on a lot of investors' minds is really strong current calculated billings for the last 2 quarters, 16%, 14%. Your guidance going 8% for Q4. I guess should we take the mid-teens growth for the last 2 quarters to be an indication that we might see an acceleration in revenue growth at some point near term? Or should we look more towards that trailing 12-month figure that has improved a little bit, but been relatively more stable I think that's just what everybody is asking here is should we expect acceleration in revenue growth near term out.

I think it's more of the latter. Based on what we were able to deliver that up to do with Postmedia a lot of the discussions that we were having with a small cohort of customers that we have in place. And then in Q3, the primarily -- the beat was from the federal, albeit would love that to continue, we'll continue to work on that, but it could be lumpy. And so from our perspective, the base case remains, of course, where don't see a significant change in the net dollar expansion at our key KPIs. So that 105% is healthy. It stayed the same from Q2. Right now, we don't see that materially changing. We are hoping that we continue to outperform the new logo acquisition, but this is based on the pipeline that we see for Q4 and kind of seeing the course in terms of no material change in the sales cycle, the close rate. What we see right now is end of the year strong with current billings closing the year at 11% for the full year and then the revenue closing the year at 10%.

Okay. Super helpful. And then secondly, just could you talk about the competitive environment, at and just who you're seeing there and how things have maybe changed versus a couple of quarters ago or maybe even a year ago? Are you seeing more of the larger platforms in there that post method really amped up how much they're talking about patching and vulnerability scanning, things of that nature.

We have been talking about vulnerability management evolving for a few years now before this whole thing came about, and that's why we started really focusing on patch management and remediation capabilities. And today, we present a very compelling case for somebody who wants to actually do remediation in their production environment with the 0.5 billion batches deployed so far with extremely low rollback rates. We have established ourselves. It's not just a vendor that is detecting tons and tons of new vulnerabilities, which as you saw with the Pat Tuesday, you're going to get more and more findings. So -- what we are seeing is the vulnerability management is evolving where it's about not just about finding and detecting because it's just unmanageable at this point, the number of CVs been detected. It's really about being able to do validation of those exploits like a hacker and then actually running into remediation and doing remediation with high confidence at a much faster speed. And so that's where, for us, we even if a customer has some other detection capability for CVs with ATM. What we are seeing with those customers when they come and build a rock and they work with Qualys, they are pulling either using Qualys for fast detection or they're pulling data from maybe some other solutions they might have and leveraging the Qualys ATM license to then figure out if that thing is exploitable and then they eliminate license to then go and run remediation so that they can actually get rid of that particular exposure in the 3 minutes -- in the 3 days as sub order said. So I think for us, we see that continuing more less conversations about how many CVs are you detecting more about, are you able to detect them faster than competing solutions, which are taking 2 to 3 days for scanning. And then the last piece is, well, ultimately, how can I build an automated workflow -- the issue is that if you have a separate scanning solution, a separate prioritization capability and a separate regulation capability that makes it a lot harder to really get to that 3-day remediation or 24-hour remediation that people are looking for. So the conversations are less about can somebody detect more CVs really or conversations we're seeing are more about how do you help me build a story that I can take back to the Board that shows a road map for autonomous remediation as a response to autonomous exploration.

And our next question will come from Brian Essex with JPMorgan.

My congrats on a second quarter of pretty healthy billings growth. I guess, Sumedh, a couple of things stand out more from a trend perspective that I wanted to ask you about One is the really nice growth in international business sustainably in the mid-teens, particularly when you compare it to domestic, which kind of had the tailwind of Fed, as you noted this quarter, and then also the partner contributions also seem to be ramping nicely. Is there a correlation between those 2? And how do we think about each of those in terms of your ability to win new logos outside of the Fed business, which I know that you had a strong new logo traction with this quarter.

Yes, that's a great question. And we have been doubling down on working with our partners over the last few years, and so we're pretty happy with the way that contribution from partners has increased over time while maintaining our margins as well. So we do continue to see that as a way that we are going to see long-term impact. I think what we are also -- our non-U.S. business always tends to be more partner-driven, of course. But in general, I think what we are seeing is that right now -- and typically, we don't see that knee-jerk reaction from our customers who are larger customers, enterprise customers, everybody is sort of going through a cycle right now of -- this is a fundamental shift in the way vulnerability management has been done in the past and to be able to do the exploit validation that's now specifically required and this is subareas an example or to do autonomous remediation structurally, they have to figure out within their organizations, how they can bring IT teams along what kind of changes they need to make in terms of the team, the structure, the processes, et cetera. So a lot of the conversations that people are engaged in right now with us are about how do we continue over the next few quarters and next few years on changing out how vulnerability management is done. And our partners are a key part of that. So they are turning to the trusted partners to say, help me go back with a plan for autonomous remediation, and we are continuing to work with those partners. And so for us, we do see that the more and more we work with our partners, and you see the Mlog Partners program as well. Our partners will be working with these customers to help them plan out their autonomous remediation capabilities and Qualys obviously, is going to be a key part of that. So we do see this more as a continued long-term area of investment in we're excited about building out these capabilities with our partners.

Got it. And is there anything to infer about the profile of the international customers and what might make them a little bit more, I guess, right for better growth than domestically? Or how do we think about the -- what you're seeing in 1 geo versus United States?

Nothing really to call out that's different from what we have seen in the past.

And our next question will come from Joseph Gallo with Jefferies.

This is Grant Darling on for Joe Gallo. I wanted to start, the billings beat was really strong. Revenue would be a little bit narrower than usual, just to start anything to call out with large deals or linearity and maybe how we should think about that going forward?

Currently seems to be not exactly a great proxy when you're looking at how to recognize revenue ratably. But to call out the Q3 revenue, the linearity was worse than what we typically see in the quarter. So that did impact that came in slightly lower at 10.7% versus growth rate.

Got it. And then maybe just to unpack the expectations around that 8% billings in 4Q. Just as we're hearing about PHP pipeline opportunity patching, is there something from a renewal base size or anything in 4Q that's maybe making you more optimistic on the 2027 trajectory versus 4Q?

I mean I would say, like I said in the -- what I mentioned earlier, we do see customers engage when these kind of things happen, but even in the past, when lock forge and stuff came, we don't see that knee-jerk reaction immediately that's like immediate in the quarter. Of course, those cohort of customers that are up for renewal that already are having conversations about EPM and eliminate in that quarter. those conversations can be more fruitful at times. But overall, when you look at the customer base and the opportunity that we have -- we see this as a continued conversation with these customers who are very engaged with us to figure out what's the right way for them to make the changes internally within their teams, their processes to be able to roll out and give their management the confidence in a new way of doing vulnerability management that is truly AI-driven and is able to do autonomous remediation with the confidence of not having operational outages. And so those conversations are going to continue. We're seeing good pipeline of conversations happening there. And we're excited to see how and when these conversations will end up closing once these guys are able to go back and make the changes and put the proposals in front of their management. That's going to take some time. So I think right now, we're focusing on those conversations rather than some sort of a new jerk reaction immediately happening this quarter.

And the next question will come from Mike Cikos with Needham.