Good morning. I know we have an early session today, so appreciate you all joining us. I'm Fatima Boolani, jointly head of the U.S. Software Research Effort. If you haven't seen me or heard from me already, it's nice to see you. I'm very excited to kick off day two of Citi's Global TMT Conference with the management team at Qualys. To my left, we have CEO Sumedh Thakar, and to his left, CFO Joo Mi Kim. Thank you so much for being here. Thank you for having us. I'm looking forward to a very exciting discussion. I think just to kind of kick things off, and I think a good place to start is, you know, talking about the macro, right? I know you're not gonna go this entire day talking about macro, so we'll start there. I'd like to know, you know, between the two of you, what have been the biggest deviations or surprises to you from sort of a business performance standpoint year to date, and certainly versus your expectations? Yeah. I would say that, when we came up with the VMDR, as a really strategic move a couple years ago, the idea was that we kinda start to work to help our customers to consolidate their security stack, and that was pretty strategic for us. The idea there was, how do we help customers reduce the cost of their security program by combining multiple capabilities in a single workflow? As we hear, you know, what's happening in the macroeconomic conditions, you know, we're not immune to what's happening, but so far we haven't seen that in terms of longer sales cycles, et cetera. We continue to monitor the situation. However, the conversations with customers are happening more in terms of existing customers looking at their vendors as they are being careful about their budget to see what additional value they can get from their existing vendors. We are excited to have some of those conversations with existing customers who are then coming to Qualys and asking for adjacent capabilities to look at that to see if those are some of the things that they wanna go with. I think, for us, the additional Patch Management along with VMDR, CyberSecurity Asset Management as an adjacent capability, and the initial growth we're seeing with that is exciting for us and for us to see that there's 130 million patches being deployed with Qualys agents, where we sort of were pioneering in terms of bringing Vulnerability Management, Patch Management together as a single workflow. Because at the end of the day, when you find a vulnerability, the thing that you do is patch, right? Having that ability. For us last quarter to see that was 5% Patch Management, that's 5% of our bookings. I think some of those trends that we are seeing right now are positive, and we're excited about that. You know, Sumedh, you're sort of unpacking an area that I'm very, very eager to hear more on, is just sort of maybe zooming out this broader view on cybersecurity spending health, spending patterns. I mean, you talk to more CISOs than certainly I ever aspire to, but any nuanced views you can share on what really has evolved in the priority sequence of the cybersecurity budgetary wallets in the last, call it 12 months and even 24 months, because that would capture sort of pre, through, and hopefully now through COVID. Yeah. I think the thing that we hear consistently with the CISOs is that they really want simplification and reduction of complexity and cost from their security programs, right? Almost every CISO will tell you that they would love to have one or two platforms, not 50 solutions, you know, reduce the number of agents. I think so far we're seeing that the cybersecurity budgets have stayed resilient despite macroeconomic conditions. There is a much more of a thought process going in from the CISOs in terms of, do I need to go and get a bunch of other solutions? Can I look at my existing vendors to see if I can get some additional capabilities from them that is going to help simplify? I think Log4Shell was really eye-opening for a lot of CISOs in terms of realizing that. This is some of the information that we looked at, the data that we saw, that when you look at Log4Shell as an example, when everybody was all hands on deck, it still took 17 days on average to remediate Log4Shell, and the compromises were happening in 48 hours. How can they really prioritize vulnerability management, but look at it not just as how do I get a list of CVEs that I have to send to another team, but how do we bring risk prioritization, really focus what's causing risk, and find ways to remediate things much quicker. Essentially trying to stay ahead of the speed at which the attackers are able to compromise vulnerabilities. That's really been on the mind of the CISOs, because if you can get better at that, then you have much less issues to deal with because you're really reducing your attack surface by ensuring that you know what you have and ensuring that you're patching all those capabilities. Some of the recent compromises, like Log4Shell, really has got the conversation more towards not just do I do vulnerability management, but how do I actually fix things quicker and faster? You know, that's a great segue to, you know, my next question, just with respect to your core bread and butter market, which is vulnerability management and vulnerability assessment. You know, there's been a lot of variability in the overall market growth. There have been certain dynamics that have been accelerants to the market growth, and then certainly that have been factors that have detracted from some of that growth. Maybe if we can get a little bit more granular about what's exactly happening in the core VM/VA market that's sort of expanding the addressable market opportunity and what the competitive landscape shape-shifting has done, just to kind of better put our arms around, you know, behavior in that market. I think for us, we continue to see really good conversations, interactions, and demand from our customers for VMDR, especially given that VMDR consolidates multiple different capabilities together in one flow. As the CISO's conversation is sort of shifting from not just how do I find whole ton of vulnerabilities to how do I actually help prioritize and fix the most important ones that will reduce my actual risk, that's really where we see that when we go with VMDR. You know, you can see some of that in last quarter when we talked about how new customers coming to Qualys for vulnerability management then also end up purchasing Patch Management and Cybersecurity Asset Management. When they are looking to rearchitect their stack, they are not just saying, "Can I swap out my scanner one-to-one with another scanner?" They're looking at what is out there that is actually going to help them find their assets, that's actually going to help them, prioritize those vulnerabilities and also to a certain extent, fix those. The focus again is looking at more solutions, in my opinion, like VMDR, which are actually helping do these things in a single workflow, rather than just saying, "I'm gonna go get another scanner that's gonna give me a long list of CVEs that I then have to go figure out," because that takes time to figure out what needs to be done and actually do and actually patching it, which means that amount of time that you're exposed, and your attack surface is open for much longer. One of the things that we talked about last quarter as well was when customers who are Qualys customers who are using Qualys for scanning and another tool for patching versus those who are using Qualys for scanning and Qualys for patching, look at the CISA top 10 vulnerabilities that they have released most exploitable. Those customers who are using a combined solution were able to reduce their risk 60% faster because they were just able to cut out a lot of the process. If you are in a position where you could look at something that is going to be exposed for 60% less time, that ultimately is the goal of a CISO, is how do I reduce the risk, not how do I find and report on multiple vulnerabilities. Joo Mi, just to maybe put a more qualitative lens on this. Last quarter was a quarter in which you saw some of your best bookings performance in some time. On an LTM basis, your average deal size increased by 17%. You know, in the context of what Sumedh just shared, around the importance and the appetite for consolidation, maybe what are some of the other sort of factors contributing, you know, to this, the strong financial performance, and what seems like you're bucking the trend of elongating sales cycles that some of your peers have seen? To that point, I think that, you know, when we first launched VMDR, it was really a strategic decision for us. What we decided to do at that time was to prioritize a long-term gain versus a short-term potential return on the revenue. I think that's really paying off for us. 'Cause what we're seeing right now is even despite the headwinds that all the companies are seeing, we still remain very resilient, even within the cybersecurity space with the tailwinds coming. To Sumedh's point, we've always believed that everyone's going to lean more towards the consolidation. I think the criticality of the coverage, combined with the fact that everyone's looking into their budget, I don't think the security budget is being reduced, but everyone's looking for the additional justification to see what they can get more of. I think with VMDR, as we continue to lead with that product, it's been some time, and the timing of it actually is great for us because Patch Management has been out for a few years. VMDR has also been out for a few years. For us, it's always taken us a couple years, some time for newer products to take adoption. It's kind of all coming together at a time when our existing customers as well as prospects are looking for a way to get that cost efficiency with a volume discount going to one vendor to make it even easier. With the Patch Management and with the first quarter that we share, it was a milestone for us. With a newer product like Patch Management making up more than 5% of total bookings and 9% of new bookings coming from Patch Management, it's really indicative and testament to how we think about our business and how we're differentiating from a product perspective. I think that that's really helping us to see that upside when at a time that I think our, some of our peers are having some difficulties. What are you doing from a product perspective and maybe even a go-to-market sales incentive or compensation perspective to enhance increased module adoption and certainly for newer modules like VMDR, and then we'll get to attack surface management in a second? What are some of the sort of technological mechanisms and go-to-market mechanisms you have in place to make it a no-brainer agent consolidation outcome for your customers? Yeah. One thing that we actually did make a change to when we launched VMDR. Cloud Agent has always been a Trojan horse strategy. When we first came out with Cloud Agent years ago, we made it such that if you purchase our VM solution, you had a decision to make. You had to. That cost had to be justified. You purchase a VM, do you want to pay, let's say, 20%-25% uptick on that VM to purchase Cloud Agent? Then once Cloud Agent is deployed, you can try out other products, which is another step function. With VMDR, what we allow the customers to do is we eliminated that for them. We packaged it in a way that you're really not gonna see the value of Qualys unless you have VMDR, which includes Cloud Agent, which includes ThreatPROTECT. As a starting point, we made that smoother. We simplified the sales process because Cloud Agent is already included. There's no reason why you shouldn't deploy it. And once that's deployed, you can use and leverage other solutions more easily. I think that's really helped from a seamless kind of a sales cycle. Definitely allowed us to better position ourselves to our customers because it's easier for them to see it and then buy it, try it out first. Yeah. I would say that being a fully cloud-based and SaaS solution really because it's a single platform, whenever customers really need to adopt or try newer solutions, through the product itself, they are able to do that because once they have a single agent, that, you know, it's very quick for them to try and enable an additional capability. We talked a couple quarters ago about example of a large customer, 350,000 employees, everybody working remotely. Their laptops had Qualys VMDR agent. They wanted to look at Patch Management. It was just a flip of a switch in the back end, and all their 350,000 assets were immediately downloading and deploying patches. From the way that we also are able to show the value to our customers, it's much quicker because it's again, it's a single platform, single agent solution, which makes it much easier than, you know, having multiple different acquisitions and trying to make those work for the customer. As you think about sort of monetizing the portfolio, and I know you all have a very heavy modular portfolio. I think I've lost count just to how many modules you have, and I know you give some good metrics around that. Maybe you can remind us. As you sort of think about, you know, the most seamless and most accretive ways to drive wallet share expansion, how would you sort of prioritize it between more modules per customer versus more attack surface coverage per customer? How do those two factors weigh against one another? Yeah. I mean, we did launch our External Attack Surface Management capability recently, but the way we look at it is if you look at the last couple of years, Qualys has made a big focus on asset inventory as a core capability that is needed for cybersecurity programs. Our CyberSecurity Asset Management provides customers with an in-depth view of their internal asset inventory. Instead of coming out with attack surface as another paid add-on module that customers would have to purchase, we simplify the stack, which is what everybody's looking for. For us, this external attack surface is just another way of inventorying something that's visible from the outside versus what's visible from the inside, so we can prioritize that. We sort of added that as part of our CyberSecurity Asset Management capability, which gives us the opportunity for our customers and our salespeople to not just have a conversation about how can I find the 100 assets that are externally exposed to talking about a much broader capability of CyberSecurity Asset Management that is helping them see internal and external side of their asset inventory. It becomes a much more powerful capability for them because there are multiple other features that come with that. It simplifies because they don't have to go buy something for external separately, something for internal separately. That consolidation of recent capabilities in sort of groups of capabilities a customer can buy. There's a bunch of capabilities that come under cybersecurity asset management, a bunch of capabilities under VMDR. Our focus has really been how do we continue to make sure that the good growth that we're seeing with adoption of VMDR, where 43% of our customers have adopted VMDR, how does that continue? Because with VMDR, we are focusing more on combining capabilities so that they can see that rather than talking about individual, you know, modules. If you look at a very high level, there's really three main capabilities in cyber that everybody looks at. One is finding all your assets and knowing what you have. Second is how do you manage your risk by reducing the risk so nobody gets into your network. The third is how do you monitor that if somebody is in your network, so you can take action. Really, everything just comes down to one of those three things, right? CyberSecurity Asset Management, VMDR, and then our EDR capability really provide on a single platform that ability to get that more holistic view other than talking about individual modules. It's really aligning to the way the cyber experts are looking at things. Just from the standpoint of, excuse me, the net dollar expansion rate metrics that you share, I think at 110%, you know, clearly there's a lot of accretion that you're driving from the install base. But what needs to happen to, you know, continue to push this metric higher, you know, particularly as you absorb a lot of these independent, discrete modular capabilities in one of these three? What would be the catalyst to get that 110% to kind of 120%, 125%, 130%? I think that 110 is a really healthy kind of number for us just because one year ago, it was only 104%. I think that two things kind of high level drove that. VMDR, which is very strategic for us, helped with retention as well as upsell and cross-sell. A newer product like Patch Management, which really differentiates us in the market. With that making up over 5% of bookings, you can kind of see how that's impacted. The great thing about Qualys is we already have multiple products that are already out there, some of them not previously in the roadmap, even with CSAM being relatively new. EDR, XDR are also very new. Huge target addressable market. If you think of it that way, if once those products start taking adoption with our existing customers, I think that the potential upside could be much greater than what we're currently seeing with even Patch Management. How do you think about the pricing strategy? I know a lot of your peers have sort of taken on pricing increases just by way of a response to general cost inflation. Just inflationary environments, you know, take MSRPs up, right? I'm curious what approach you've taken in terms of rolling out pricing increases to the base. And to what extent, you know, within the confines of the very traditionally and narrowly defined vulnerability management market, you know, how have maybe those price increases are not impacted, you know, some of the pricing, or discounting dynamics in the market, if you can kind of pair those two together. Yeah. Historically, we've always had this sales philosophy where we've never really discounted heavily because we really truly believe in the value that we bring to the end customers. Given the market dynamics and the competition that we were facing a couple years ago, this is where before we launched VMDR, we had a healthy amount of discussions within our executive team as well as with our customers and prospects and looking at the market in general. How should we price VMDR? We had an opportunity, and this is where I said that we decided to focus on the long-term gain versus a short-term return. We could have priced VMDR much higher, and that would have resulted in a that uplift in revenue in that year. What we thought about was, because it's so strategic for us, we wanted to optimize and really drive adoption. Faster adoption will lead to higher retention rate, higher upsell, higher cross-sells. We priced it in a way that allowed our customers to see, okay, VMDR upgrade makes sense for us now, and I could see ourselves growing with Qualys in the future. Because what we've seen before was we had so many different solutions out there, and we've had feedback from customers saying, "Look, like I think that we can definitely buy VM with you for the coverage that we need right now, but in a few years, if I wanna buy ThreatPROTECT, if I wanna buy like some of your other products, it's just not gonna work for us, right?" Keeping that in mind, we really wanna price it based on value, based on what we think we can bring to the table. With VMDR, we were able to bring a great product that we think is game-changing at a price that's reasonable for the customer. They might be paying a little bit more if they only had one solution with us before, but they might be paying a little bit less. Right now, you're looking at couple years now that's really resulted in a higher spend overall with our LT average spend of 17%, and that's how we think about pricing at the end of the day. Because we're so highly profitable, it affords us to have that capability even in this inflationary market, right? We haven't increased prices for our products because, frankly, we haven't had the need to. With our newer products out there, how we're thinking about increasing the average spend per customer is them buying more with us, with which could be coming from the asset coverage or buying additional solutions. I would add to that in this environment, it helps really the conversations in, instead of discounting the conversations can become more about value because now we can talk about, okay, you know, cybersecurity asset management can be added in addition with VMDR, which will give you even better value for the similar spend that you have or with a small additional increase in the spend. Having these additional capabilities that are well adopted by customers, I think it helps in those conversations right now. Sumedh, I haven't forgotten you ran the product organization at Qualys for quite some time. You know, when you take a step back and sort of think about, maybe, excuse me, a natural bucketing of some of your solutions instead of, you know, creating a menu of so many modules for your customers that, you know, it can get overwhelming, right? As you think about sort of these natural bundles and buckets you've created on those three pillars that you talked about, you know, when you take a step back, are there any white spaces in the model that remain that you feel that you don't really have an answer from a technology or a product standpoint that, you're kind of thinking about? Yeah. I think that's a great question. When we look at, as I mentioned earlier, right, when I step back, look at what security professionals are looking at, they're really looking at those three areas, right? How do I know everything that I need to cover, which is that inventory capability, which is where kinda created the umbrella of CyberSecurity Asset Management as one workflow solution. The second is risk management. How do I Once I know the asset I have, how do I make sure that I'm doing everything to reduce the risk? That's where sort of VMDR, Patch Management, configuration management, our new custom remediation module fall into that. A lot of the things that you need, whether it's in the CI/CD pipeline or whether it's at runtime, can be taken care of under that umbrella. Then the third part is detection and response, right? This is where your EDR and your XDR sort of fall into place. Then you have to do that for your endpoints, for your on-prem assets, and then for cloud and containers. There's multiple different levels that we are doing these things at. Launch of External Attack Surface Management to me was really interesting because now with that, when you deploy Qualys platform, what the outcome that you get from that is risk reduction. With the External Attack Surface Management, you can know all your external assets. With CSAM, you know all of your internal assets. With VMDR, discover all the vulnerabilities, you prioritize them with the TruRisk capability. Then with Patch Management, you fix it. Relative to other competitors in the VM space, the outcome you get from their solution is a dashboard or a report. With Qualys, you can really get those fixed and reduced, right? We continue to look at capabilities just like we did with External Attack Surface, where, as customers give us feedback, really look to say, like, "Hey, this is something that we can pretty quickly add." The ability for us to do Custom Remediation was another capability we recently added because based on customer feedback, they said patching is great for majority, but there's always the 5% where we need to do something custom on the assets. Can Qualys help us with that? I think those three are the broader umbrellas, and within that, we are always looking at what are the additional capabilities that we can bring to the platform that are going to simplify their ability to discover devices, fix and manage the risk, and then monitor for threat and take response. Joo Mi, theoretically, you know, as a customer, through their cybersecurity maturation and journey with you know, as they add those incremental pillars of capabilities from you, what type of theoretical sort of ACV or wallet uplift can you potentially realize? If $1 is spent on, you know, your solutions that help find and discover assets in the environment, what does the risk mitigation set of capabilities, if added on, what type of ACV lift would that bring to the table? Yeah, great question. This is actually one of the reasons why when we did the total addressable market analysis, you know, the VM space is relatively small, and this is part of the reason why we decided to enter additional markets like EDR and XDR, which is huge. It's multiples of where we were previously playing in. You're looking at a huge opportunity there. As an example, VMDR, if you're paying $1 per asset for VMDR, you have a potential to pay another $1 for Patch Management, just based on pricing alone. You're looking at a customer spending $1 with us, that going to $2 with Patch Management. If you add CSAM, that could be another $0.50 uplift, so $1 to $2.5. There's a huge opportunity with even the existing product that we're starting to see the initial stages of ramping. EDR and XDR are a little bit further out, but where they could be more expensive. This is where I think that the upside for us is huge with the products that are already out there. From a customer perspective, though, this is very attractive because we're both winning if they come to us, because they'll naturally get that VDP pricing discount without us having to discount our existing products. For example, if a customer had VM with us and they decided to go to another vendor for Patch Management, they won't get the volume discount. If they come to us, it'll be cost efficient for them, it'll be easier for them to use using one platform, and they will benefit from having a customer where we really own from end to end, right? They have one vendor to go to when they see an issue. They don't have to say, "Well, I think it's a vulnerability identification problem. I'll go to Qualys." And, "Oh, I need to automate patching. I have to go to another vendor." We know that if they come to us, we'll take care of them. How have you at a very high level thought about the pricing strategy for, you know, non-traditional, ephemeral, transient sort of cloud services, like containers, as well that need to be protected, which by the way, could be very seasonal or very burst or may not be, you know, enduring, right? How has that contributed to how you think about volume discounts? 'Cause that changes the game if 50% of what you contract for is only gonna exist for six months, say. Yeah, I think this is a hot topic of conversation as everybody is looking to get into more cloud and more container and trying to figure out. It's the balance between, you know, trying to manage the bursts and the costs that come with it versus what traditional enterprises are used to is having a predictable model at the beginning of the year to know how much you're going to spend. I think currently what we see most customers are sort of looking to settle on is sort of an average usage rather than looking at peaks and valleys. Most of the times customers will sort of make an estimate on not what the peak is going to be, but on an average, on a monthly basis, how many containers or how many virtual machines do I see live that are actually running. We try to, with our pricing, we just essentially peg the value to what the value that the customer is getting from the number of assets that they have, rather than looking at the peaks and the valleys and trying to do much of a dynamic. Because customers then they don't have the predictability for their spend that they really would like. We continue to look at that. We also are well embedded in Azure as an example, where it's a different model where you know it's an embedded capability as a partner where customers go to Azure and they transact through Azure whenever they need vulnerability management directly. We're basically very flexible with being a cloud platform to really work with as customers' buying patterns are changing and they're trying to figure out themselves which direction that they want to go. We have that flexibility in our model to work with them. Before we kinda dive into the competition discussion and the competitive landscape discussion, I did wanna have a conversation with you about DevSecOps, AppSec, shifting left, security shifting left. I think at the outset you sort of alluded to you know, some of these dynamics in your commentary as it relates to sort of risk mitigation across you know, an IT landscape that looks so much different today than it did five years ago. Just specifically from the standpoint of you know, apps no longer being built in a monolithic fashion, where does Qualys' value proposition shine, and how does it maybe you know, compare to this sort of new age of DevSecOps company that are kind of bubbling up right now and sitting kind of in the workbench of the developer who's you know, code scanning? I guess ultimately what I'm asking you is, you know, this whole notion of supply chain security, how do you fit into that paradigm? Yeah. I think that a lot of companies as they're looking at cloud or shifting to the cloud. However, at the end of the day, you look at that. They're getting compromised because of misconfigurations and vulnerabilities, right? No matter what technology is changing, the basic mode of what you need to do hasn't really changed that much. Now what is happening is with the awareness, and you know, as I was a developer 20 years ago, awareness of security was really low at that time, right? Today with DevSecOps, the awareness of security practices is much better, the automation is much better. That allows us to make sure that we are shifting as left as possible to reduce the risk that you have by finding out what kind of applications, or libraries that you're including, trying to eliminate as many vulnerabilities as you can, in the CI/CD pipeline. However, that has not resulted in customers not looking at their runtime environment because you could have somebody go in, make some change, a new vulnerability can pop up on a running machine. We continue to provide ways with our scanning capabilities for customers to scan their images in their AMIs in the CI/CD pipeline well before they go into production. Also in the production environment with the agent, with the scanner, they can also monitor live to make sure that nothing is popping up that is newly released they need to care about. While we provide capabilities like looking at your software composition analysis, et cetera, on the far left, it's not really stopping people from also monitoring their production environment live. I think it's more like capabilities that we have are getting extended in the CI/CD pipeline and just providing newer and different ways to reduce the risk as early as possible. With reduced risk, you still have certain amount of risk and people wanna have a holistic approach. The capability like VMDR, we don't really differentiate in, okay, this is a CI/CD only or that's. We kinda give a much bigger play for them to leverage our Qualys capabilities wherever they seem fit in moving more shifting on the left or more shifting on the right. And so it's very fairly dynamic from our standpoint because it's the same technology that they're using no matter where they're using. You know, people don't talk about shifting right enough. We need to start talking more about that. It's always shifting left. Yeah, because, you know, it's like saying that if you're sure that you have no vulnerabilities, you would never need to patch, but that's not true, right? Just to, you know, I'd be remiss if we didn't talk about the competition and the competitive landscape, especially because as you've evolved the portfolio and grown it's sort of put you more in the crosshairs of some new competitors that you maybe didn't see before. At least in the core market, maybe you can share some observations on market share dynamics and how VMDR is sort of helping improve your competitive positioning. Then I'm very curious to kinda get your perspectives on the EDR/XDR landscape because there is a lot of discussion and a lot of conversation from, you know, endpoint security vendors there and network security vendors there who are sort of making their way. you know, core VM and space dynamics and then, you know, in some of these newer areas, who you expect to or who you run into and who you expect to run into more. Yeah, I see. You know, when you talk about market, it's a very subjective term, right? For investors it's different, for customers it's different, for vendors it's different. Look, for me, I think at the very basic, when you look at security, almost never would you deploy an EDR agent on an asset that you're not doing vulnerability management and patching on. Because if you're not trying to even reduce the risk by looking at vulnerabilities and patching them and knowing the inventory, which means from a customer perspective, when they look at securing an asset, they wanna know what's running on that asset, they want to know what are the risks associated with it and how do I mitigate those? Then they want to make sure that nothing is popping up on the device that is getting compromised, so you can monitor that. There is really no reason to have multiple different agents to do the same thing. If you really look at it from that perspective, the market, as I would say, would really like to see a single solution that is able to do all of these things together in one, because that is the more beneficial thing from a customer perspective. If I look at more the core VM market, I think what with VMDR, we've sort of upped the game by coming up with a game-changing solution that is consolidating many different aspects of vulnerability management, which is the four stages of discovering the asset, finding the inventory, discovering the vulnerability, prioritizing and fixing into one sort of a single solution which, you know, in our opinion is working well from a customer perspective as they look to speed up their remediation, as they look to get more value out of their vendor. VMDR in that sense is really looking at the risk mitigation side of it, right? CSAM, which is a CyberSecurity Asset Management, is a capability that we feel we don't see that much from anybody else out there. That's again creating something very interesting for them to really make their risk mitigation program better by knowing what they have. When we start to look at even though currently everybody looks at EDR and XDR as siloed solutions that are deployed by them, by themselves, ultimately, for us, our EDR solution can also patch. It's the same agent that can also patch. We don't see that right now, right? Where others are really focusing only on this side or only on that side. The opportunity remains to align with what customers would really like to see eventually is to do that consolidation and really have one agent that can do all of that. We see the opportunity there to instead of competing with vendors individually on one capability, EDR only or patching only or VM only, we feel with what we are putting together, we have the ability to go and say we can consolidate all of that and get better value and better speed in mitigating risk and speed in detecting and responding to threats that are on the device. Joo Mi, just with the last few minutes we have, you know, just talking about sort of the investment constructs and the investment philosophy from here. You're slated to reinvest pretty heavily in the back half of this year. Two quick parter there. You know, you all have been at the forefront of driving a lot of sort of headcount efficiencies with the big technology centers in India. The first part is have we more or less peaked in terms of driving the efficiencies from those moves in terms of technological and R&D center? Secondarily, as we think about the broader macro environment, your aspirations to invest in addressing your big new TAMs. Mm-hmm. How is that sort of influencing how much you're hiring, how responsive you're gonna be to pulling back hiring if things do start to change more materially in the environment? Just some finer points on sort of the investment philosophy from here. Yeah. Investment, we've said for multiple years that we will continue to increase investments just because of the opportunities are there. We're always looking at it from the ROI perspective. Is there a return? Are we investing enough to balance the growth with profitability? We're still in the, I would say, kind of the earlier innings. We do see more opportunities where we can increase in investment, not just on sales, marketing, product marketing, because the opportunity is so great. In terms of the cost efficiencies, I think that we'll continue to see that relative to our peers because one of the advantages that we have is we do have a great presence in Pune. Sumedh is from Pune, and we've been very successful. I think that with the larger team, that actually helps us with retention and attracting, great talent. We'll continue to see that as we focus on product development as well as go-to-market strategy. In terms of the newer product, what's great from that perspective is they're already out there. Selling additional products or cross-sells are obviously cost efficient than kind of new local acquisition per se. We are looking at all fronts, whether we're driving new local acquisition from direct sales force or partnering with partners. We talked about the new partnership programs that we launched earlier this year. We will continue to assess and take our same kind of approach, and we're being cautious about how we invest, how much we plan to continue to increase investment. I think that for us, it's always been true, though. All else being equal, we believe that we will continue to have the industry-leading margins relative to our peers. Putting aside, you know, macroeconomic and geopolitical conditions, that will continue to be true for Qualys. Great. I think with that, it's an excellent way to cap off our discussion. I wanted to thank you for being brave and early this morning. I appreciated our conversation. Thank you very much. Thank you. Thank you.