Qualys

Qualys reported second-quarter earnings, with sales growing 11% to $182 million and GAAP operating margins expanding by 3 points to 34%. Management also raised its full-year sales outlook to $735 million, up from $724 million in the prior guidance.

Why it matters: Qualys' move beyond vulnerability management, or VM, is progressing better than we expected. ETM, or the firm's risk operations platform, is steadily increasing its share of total bookings (12% versus 9% a year ago). Non-VM products' contribution to the total bookings mix increased to 51%, up from 46% a year ago. We see this as a clear sign of progress, especially considering that ETM net retention, a measure of upselling within existing accounts, was 107%, above the company-wide 105%. Also, in a security market where buyers want to consolidate spending, we are encouraged to see Qualys follow Zscaler and CrowdStrike by introducing a flex program that allows enterprises to make platform-level commitments and then use a variety of its products.

The bottom line: Based on this quarter's results and the traction the firm is seeing with its multiproduct strategy, we are raising our fair value estimate for narrow-moat Qualys to $170 from $139. With shares up sharply, we see them as fairly valued. While we still expect more incremental vendor consolidation and artificial intelligence defense spending to go to platform players such as Palo Alto, CrowdStrike, and Fortinet, we see Qualys jostling to create room for its own platform, a move we consider strategically sound. With a broader platform to sell, Qualys is also showing success in the channel partner segment, with channel partner sales increasing 22% and now constituting 54% of total sales, up from 49% a year ago.

Coming up: We see the guidance raised by management as a testament to the strong demand cyber vendors are currently seeing, and we expect the landscape to improve going into the fourth quarter.

Our fair value estimate is $170 per share, implying a 2026 enterprise value/sales multiple of 7 times.

Over the next five years, we forecast Qualys’ revenue growing at an 8% compound annual rate. We expect the firm to continue landing new clients and expanding revenue from existing ones at a moderate pace. We believe these expansion opportunities will stem from Qualys' platform-based sales motion, which centers on its breadth of offerings as a key selling point for clients looking to expand their use of Qualys’ solutions. We expect retention metrics to remain stable.

We think that Qualys’ primary appeal to investors is not its growth profile but rather the mix of decent growth with impressive profitability. The firm’s gross margins have hovered around 80% over the last few years. We expect Qualys’s gross margins to expand marginally to around 84% by 2030.

Qualys’ operating margins have been in the black for its entire history as a publicly traded firm. We expect operating margins to remain in the mid-to-high-30s over the next five years, supported by gradual decreases in research and sales expenditures as a percentage of sales. We also see Qualys improving its free cash flow margins over our explicit forecast.

We assign Qualys a narrow economic moat rating owing primarily to strong switching costs associated with its security and compliance solutions. We believe these switching costs are evidenced by Qualys’ strong gross and net revenue retention metrics. While competitive threats are on the horizon as Qualys’ platform goes into competition with larger competitors such as CrowdStrike and Palo Alto Networks, we believe the firm is more likely than not to generate excess returns over invested capital over the next decade.

Qualys offers a wide array of cybersecurity solutions, but the core business is built around its expertise in vulnerability management. VM involves regularly scanning systems and applications for vulnerabilities, assessing the severity of those vulnerabilities, and developing and implementing strategies to mitigate them. We view this space as conducive to economic moats as customers exhibit loss aversion when it comes to IT security, as there is an operational risk when switching VM vendors, including loss of analytics during the changeover, project execution, and operational disruption.

Qualys also offers a range of non-VM security solutions. With capabilities ranging from threat detection to compliance-related security solutions, we believe that Qualys’ multi-solution approach also increases its customer switching costs. In particular, we’d highlight compliance-related solutions as having high switching costs. A compliance vendor is responsible for ensuring that a business’ IT activity is compliant with either internal or external controls. A period of noncompliance can bear a heavy cost on the customer in terms of reputation damage or customer distrust. As a result, we believe the risk/reward payoff of switching compliance vendors is asymmetric, as any issues in the handover from one vendor to another could lead the firm to be noncompliant.

Despite our confidence in Qualys’ ability to outearn its cost of capital over the next decade, we’d highlight one area of weakness in the firm’s competitive positioning. Qualys’ customer base skews more toward small and medium businesses. Generally, in the software space, we view SMB spending as more cyclical and prone to churn as SMBs either rein in spending during lean times or simply go out of business.

While Qualys’ gross retention of 90% is lower than other enterprise-heavy names in our coverage, it is by no means below par. A vendor with a 90% gross retention has an average customer lifetime of 10 years, quite high for a firm that derives the vast majority of its revenue from SMB customers. Additionally, by maintaining a net retention around 110% over time, Qualys has demonstrated its ability to expand sales from existing customers thereby entrenching itself more deeply in its customers’ IT infrastructure.

We also believe there are secular drivers that could aid Qualys in the adoption of its solutions. With the cost of cybersecurity failures only going up, we believe Qualys’ VM solutions offer value to customers by highlighting areas of weakness within their IT infrastructures before nefarious actors exploit them.

We believe Qualys’ business exhibits strong switching costs, as evidenced by its retention metrics. These high switching costs, in our opinion, have allowed the firm to consistently out-earn its cost of capital. We believe this trend will likely continue and Qualys’ returns on invested capital will likely exceed its cost of capital over the next decade.

Qualys remains a strong competitor in the cybersecurity space geared toward SMBs.

C-suites across geographies and industries are prioritizing cybersecurity spending, thereby providing vendors like Qualys a robust demand landscape for its solutions.

Qualys has an exceptional growth/profitability mix with its cash flow generation, allowing it to buy back shares.

Large cybersecurity vendors have competing solutions that could affect Qualys’ retention metrics.

Qualys may suffer if its customers choose to bundle their cybersecurity solutions and consolidate their spending toward larger vendors such as Palo Alto and CrowdStrike.

There always remains a risk that Qualys’ solutions can be rendered obsolete in an industry that moves at a rapid pace.