Qualys, Inc. — Q2 2017 Form 10-Q Summary
Business and period: Qualys provides cloud-based security and compliance subscriptions. This unaudited report covers the quarter and six months ended June 30, 2017, compared with the same periods in 2016. Subscription revenue is generally invoiced upfront and recognized over the subscription term; Vulnerability Management represented about 75% of first-half revenue.
Financial performance
| Metric | Q2 2017 | Q2 2016 | First half 2017 | First half 2016 |
|---|---|---|---|---|
| Revenue | $55.3 million | $48.5 million | $108.4 million | $94.7 million |
| Gross profit / margin | $43.1 million / 78% | $38.2 million / 79% | $84.0 million / 77% | $74.9 million / 79% |
| Operating income / margin | $9.0 million / 16% | $5.7 million / 12% | $16.7 million / 15% | $13.3 million / 14% |
| Net income | $7.2 million | $3.5 million | $29.1 million | $8.3 million |
| Diluted earnings per share | $0.18 | $0.09 | $0.74 | $0.22 |
| Adjusted EBITDA (non-GAAP) | $20.4 million | $15.7 million | $37.2 million | $31.9 million |
Revenue increased 14% year over year in both Q2 and the first half, driven by additional subscriptions from existing customers and new customers. First-half growth was $13.7 million, including $9.6 million from U.S. customers and $4.1 million from foreign customers. Gross margin declined two percentage points for the first half, as cost of revenue grew 23%, faster than revenue; the company cited higher personnel costs, data-center-related depreciation, overhead, and software expenses. Operating margin improved as operating expenses grew more slowly than revenue.
Cash flow and liquidity: First-half operating cash flow was $48.9 million, versus $34.5 million; free cash flow (non-GAAP) was $35.8 million, versus $25.5 million. Capital expenditures were $13.2 million. Cash and cash equivalents were $130.6 million at June 30; short- and long-term investments were $193.3 million, for total cash and investments of approximately $323.9 million. The company reported no debt in the presented balance sheet. Deferred revenue totaled $141.4 million, including current and noncurrent amounts. Management said existing liquidity and operating cash flows should fund operations for at least 12 months.
Material changes and unusual items
- First-half net income included a $11.7 million income tax benefit, versus a $5.2 million tax provision a year earlier. Adoption of ASU 2016-09 produced $18.2 million of excess stock-compensation tax benefits in the first half and an $8.4 million cumulative adjustment to opening retained earnings. Management cautioned that the standard increases effective-tax-rate volatility.
- First-half cash from operations benefited from $10.9 million of deferred-revenue growth and noncash expenses, and was partly offset by $20.9 million of deferred income taxes. Stock-based compensation was $10.8 million in the first half.
- Cash increased $43.8 million during the first half. Financing cash flow was a $0.6 million use, including $15.2 million of taxes paid on net share settlement of equity awards, largely offset by $14.6 million of option-exercise proceeds.
- At June 30, the company had $49.2 million in operating lease commitments. Its new headquarters lease accounts for $38.6 million of commitments; lease payments begin in May 2018 and extend through April 2028. An $8.1 million tenant improvement allowance was recorded.
Outlook, commentary, and risks
No numerical financial guidance is provided in the supplied filing text. Management expects continued investment in research and development, sales and marketing, data-center capacity, and international expansion; these investments may increase expenses. Future capital needs depend on growth and spending plans, and the company may pursue complementary acquisitions.
On August 1, 2017, Qualys announced its acquisition of Pune-based Nevis Networks, intended to add passive scanning and deep packet inspection expertise and advance entry into mitigation and response. The company expected closing in the quarter ending September 30, 2017; the transaction was subsequent to quarter-end.
Key disclosed risks include dependence on Vulnerability Management subscriptions, renewals and channel partners; competitive and pricing pressure; execution in new solutions and international markets; service availability and cybersecurity incidents; foreign-exchange exposure; and the ability to scale operations. About 40% of first-half revenue came through channel partners. The company reported no material legal proceeding or material contingency liability at June 30. Disclosure controls were assessed as effective, with no material change in internal control over financial reporting reported for the quarter.
The company planned to adopt the new revenue-recognition standard on January 1, 2018 using the modified retrospective approach. It had not determined whether the effect would be material, but expected potential impacts around sales commissions and contract costs and financing components in certain long-term contracts.
Investor verification points
- Assess the sustainability of 14% revenue growth and the high concentration in Vulnerability Management, including renewal trends and expansion into other solutions.
- Separate underlying earnings performance from the unusually large first-half tax benefit; evaluate expected tax-rate volatility and the effect of equity compensation.
- Track gross-margin pressure, data-center investment, hiring, and whether increased operating costs translate into continued operating leverage.
- Review cash conversion and deferred-revenue growth, and distinguish operating cash generation from noncash tax and stock-compensation accounting effects.
- Confirm Nevis Networks’ closing, consideration, integration plans, and any resulting financial impact; also monitor the new headquarters lease obligations.
- Monitor execution risks around channel partners, service reliability, cybersecurity, competition, foreign exchange, and the 2018 revenue-standard transition.