QLYS › analyze
QLYS · Analyze
Date: 2026-04-16 | Price: ~$84 | Market Cap: $3.015B | Sector: Cybersecurity
Executive Summary
Qualys is a pioneer in cloud-delivered vulnerability and compliance management with 10,000+ enterprise customers, 82.8% gross margins, 45% FCF margins, and zero financial debt. The stock has been annihilated — down ~59% from its late-2023 ATH — for a combination of reasons: soft 2026 guidance (7-8% growth decelerating from 10%), insider selling, and a fresh AI disruption narrative tied to Anthropic's Mythos model. At ~$84, the market is pricing this business at 7.8x EV/FCF and 10.5x forward earnings — distressed multiples for what remains a highly profitable, deeply moated enterprise security platform. The debate is whether the deceleration is a temporary pause or the beginning of structural decline. This is a close call that lands at 6.5/10 conviction — a compelling asymmetric value opportunity with a real (though likely overpriced) narrative risk attached.
A portfolio-specific passage was removed from the public build.
Phase 1 — Fundamentals Analyst
Income Statement Trends
| Metric | 2022 | 2023 | 2024 | 2025 | 3yr CAGR |
|---|---|---|---|---|---|
| Revenue | $489.7M | $554.5M | $607.6M | $669.1M | +11.0% |
| Gross Profit | $386.9M | $447.0M | $496.1M | $554.4M | +12.7% |
| Gross Margin | 79.0% | 80.6% | 81.6% | 82.8% | expanding ↑ |
| Operating Income | $130.5M | $163.1M | $187.2M | $222.0M | +19.4% |
| Operating Margin | 26.6% | 29.4% | 30.8% | 33.2% | expanding ↑ |
| Net Income | $108.0M | $151.6M | $173.7M | $198.3M | +22.5% |
| Net Margin | 22.1% | 27.3% | 28.6% | 29.6% | expanding ↑ |
| Diluted EPS | $2.74 | $4.03 | $4.65 | $5.44 | +25.7% |
All four margin lines expanding consistently over three years — a textbook quality compounder.
Cash Flow
| Metric | 2022 | 2023 | 2024 | 2025 | 3yr CAGR |
|---|---|---|---|---|---|
| Operating Cash Flow | $198.9M | $244.6M | $244.1M | $309.4M | +15.8% |
| CapEx | -$24.0M | -$8.8M | -$12.3M | -$5.0M | — |
| Free Cash Flow | $174.9M | $235.8M | $231.8M | $304.4M | +20.3% |
| FCF Margin | 35.7% | 42.5% | 38.1% | 45.5% | — |
| SBC | $53.4M | $69.1M | $77.1M | $77.0M | +13.1% |
| SBC % of Revenue | 10.9% | 12.5% | 12.7% | 11.5% | improving ↑ |
| SBC % of FCF | 30.5% | 29.3% | 33.3% | 25.3% | improving ↑ |
| Buybacks | $317.3M | $170.8M | $139.9M | $183.4M | — |
CapEx near-zero in 2025 ($5M) is exceptional — pure software economics. SBC is elevated but trending down as a % of FCF. 2024 FCF dip was investment-related, not operational.
Per-Share Metrics
| Metric | 2022 | 2025 | 3yr CAGR |
|---|---|---|---|
| Diluted Shares | 39.34M | 36.45M | -2.5%/yr |
| Revenue / Share | $13.11 | $18.73 | +12.7% |
| FCF / Share (diluted) | $4.44 | $8.35 | +23.4% |
| Net Cash / Share | — | $18.04 | — |
Shares declining ~1.5-2.5%/yr. FCF/share CAGR of 23.4% is exceptional — buybacks amplifying per-share growth beyond already-strong operating results.
Balance Sheet Health
| Metric | 2022 | 2025 |
|---|---|---|
| Total Assets | $700.9M | $1,095.1M |
| Financial Debt | $0 | $0 |
| Capital Leases | $42.2M | $52.3M |
| Cash + ST Investments | $321.3M | $445.9M |
| LT Investments | $59.2M | $250.9M |
| Net Cash (total) | — | $644.5M |
| Debt-to-Assets | 6.0% | 4.8% (leases only) |
| Stockholders Equity | $289.1M | $561.2M |
Net cash of $644.5M = 21% of market cap. Zero financial debt. The deferred revenue buildup ($401M current) is a quality indicator — customers paying upfront.
Capital Allocation (2025)
- FCF generated: $304.4M
- Buybacks: $183.4M (60% of FCF)
- CapEx: $5.0M (2% of FCF — near zero)
- Dividends: $0
- M&A: $0 (no acquisitions)
- Net investment purchases: $101M (deploying excess cash into securities)
100% of capital return to shareholders via buybacks. No M&A is a double-edged sword — capital discipline, but also potential signal that organic TAM expansion is limited.
ROIC
- NOPAT (2025): $221.95M × (1 − 0.197) = $178.2M
- Invested Capital: $561.2M
- ROIC: 31.8% — excellent; well above any reasonable cost of capital
Phase 1 — Moat Analyst (Qualitative)
Business Overview
Qualys invented the SaaS vulnerability management model in 1999 and remains the most focused pure-play in the space. Their TruRisk Platform integrates: 1. VMDR — Vulnerability Management, Detection & Response (core scanning product) 2. CSAM — Cybersecurity Asset Management 3. TotalCloud — cloud security posture management 4. EASM — External Attack Surface Management 5. Enterprise TruRisk Management — board-level risk quantification and prioritization
The platform approach creates a stickiness loop: deploying cloud agents across infrastructure generates proprietary telemetry, which feeds TruRisk scoring, which drives remediation workflows — each layer increasing switching costs.
Moat Sources
1. Data moat (25+ years): Qualys has one of the world's largest vulnerability knowledge bases, built over 25 years. This threat intelligence database underpins TruRisk scoring and is a genuine data advantage competitors cannot replicate quickly.
2. Platform stickiness / switching costs: Qualys agents are deployed deeply across customer infrastructure. Ripping out VM tooling means re-auditing thousands of endpoints, rebuilding compliance reports, retraining teams, and accepting compliance coverage gaps during transition. NDR of 103% is soft but positive — customers are expanding, not churning.
3. Compliance workflow lock-in: For regulated industries (PCI-DSS, SOC2, HIPAA, FedRAMP), Qualys generates audit-ready evidence reports. These workflows are deeply integrated with GRC (governance, risk, compliance) systems. This compliance moat is structurally different from the vulnerability-scanning moat — it's harder to disrupt with AI.
4. Enterprise customer concentration: Majority of Forbes Global 500 are customers. Enterprise security purchases involve procurement cycles, vendor security reviews, and multi-year contracts. This is not a market where AI overnight displaces incumbent relationships.
Adversarial Stress-Test: How Would a Rival Attack?
Competitor approach: "Bundle and destroy" — CrowdStrike's Falcon and Palo Alto's Cortex XDR are adding VM features to their larger EDR/XDR platform plays. The threat: enterprise security buyers consolidate vendors, and CRWD/PANW offer "good enough" VM within a broader $20M+ platform deal, making standalone QLYS hard to justify.
Qualys' defense: Specialization. QLYS has 25 years of VM depth; CRWD/PANW VM is newer and less comprehensive. But "good enough" in security often wins budget battles. This is the most credible long-term threat — not AI.
AI Disruption Vector (Anthropic Mythos)
In April 2026, Anthropic's Mythos AI model became the primary narrative driving QLYS selloff. Mythos can discover and characterize vulnerabilities at unprecedented speed — "finding more high-severity bugs in two weeks than the rest of the world reports in two months."
Bearish read: If AI commoditizes vulnerability discovery, traditional scanning tools lose their core value prop.
Bullish read (Moat Analyst's view): Qualys' value is NOT primarily in finding vulnerabilities — it's in: - Prioritization (TruRisk scoring across 10,000+ assets) - Remediation workflow (assigning tickets, tracking remediation, reporting to CISOs) - Compliance attestation (regulatory reporting is process-dependent, not AI-replaceable) - Integrated risk posture (correlating vulns with asset criticality and business context)
More discoverable vulnerabilities = more overwhelmed security teams = MORE need for prioritization and workflow tools. The "Vulnpocalypse" could increase Qualys' relevance.
Counter-counter (honest risk): If Mythos and successors create AI-native CNAPP platforms that do discovery + prioritization + remediation end-to-end, Qualys' platform advantage erodes. This is a 3-7 year risk horizon, not 12-18 months. And Qualys' Agent Val (launched March 2026) shows they're integrating AI-driven automated remediation — they're not standing still.
Disruption Forecast & Evergreen Rating
| Dimension | Assessment |
|---|---|
| Platform consolidation risk | High — CRWD/PANW bundling is the primary near-term threat |
| AI disruption risk | Medium — overstated in stock price; Qualys can adapt and benefits from AI-era attack surface expansion |
| Compliance/regulatory moat | Very Durable — 5-10yr horizon; not AI-replaceable |
| Customer switching risk | Low — high switching costs, compliance workflows, enterprise contracts |
| Evergreen rating | Moderate-High — core VM market secular growth; platform evolution path exists |
Phase 2 — Moat Analyst (Quantitative)
| Metric | 2022 | 2023 | 2024 | 2025 | Trend |
|---|---|---|---|---|---|
| Gross Margin | 79.0% | 80.6% | 81.6% | 82.8% | ↑ strong |
| Operating Margin | 26.6% | 29.4% | 30.8% | 33.2% | ↑ strong |
| ROIC | ~22% | ~26% | ~28% | 31.8% | ↑ strong |
| FCF Margin | 35.7% | 42.5% | 38.1% | 45.5% | ↑ strong |
All key moat-quality metrics trending strongly upward. A 31.8% ROIC in software infrastructure is exceptional and confirms durable competitive advantage — companies with widening margins and rising ROIC have structural advantages, not cyclical luck.
Phase 2 — Valuation Analyst
Current Metrics
| Metric | Value |
|---|---|
| Stock Price | ~$84 |
| Market Cap | $3.015B |
| Net Cash | $644.5M (21% of mkt cap) |
| Enterprise Value | $2,370M |
| EV/FCF | 7.8x |
| EV/Revenue | 3.5x |
| P/FCF | 9.9x |
| Trailing P/E | 15.7x |
| Forward P/E | 10.5x |
| 52wk Range | $74.51 – $155.47 |
| Off ATH (~$206) | -59% |
Model 1: EV/FCF Fair Value Range
FCF (2025): $304.4M. Net cash: $644.5M. Shares: ~35.7M.
| Scenario | EV/FCF Multiple | Rationale | Fair Value |
|---|---|---|---|
| Stressed/AI disruption | 10x | FCF stagnates, platform erodes | ~$103 |
| Bear | 12x | Growth slows to ~5%, margin pressure | ~$119 |
| Base | 15x | Growth normalizes ~8-10%, moat intact | ~$145 |
| Bull | 20x | AI concerns prove overblown, growth reaccelerates | ~$188 |
| Historical fair | 18x | Peer average for quality VM software | ~$170 |
Current price of $84 implies ~7.8x EV/FCF — pricing this as if FCF will DECLINE ~20-25% and never recover. That is not what the operating data shows.
Model 2: Bogle's Expected Return
- Dividend yield: 0%
- EPS growth rate: ~11% (2026 non-GAAP guidance $7.31 midpoint vs ~$6.50 implied FY2025 non-GAAP)
- P/E reversion: Forward P/E 10.5x → 15x over 5 years = +7.4% annualized
- Expected 5yr annual return: ~18.4% (even at flat P/E: ~11%)
Model 3: Graham's Number
√(22.5 × $5.44 × $15.71) = $43.85
Not meaningful here. Graham's formula was designed for capital-intensive industrial businesses with book value reflecting real assets. Qualys has negative retained earnings from aggressive buybacks ($183M/yr), artificially deflating BVPS to $15.71 despite being a highly profitable business. Asset-light SaaS with 32% ROIC does not fit this model. Skipping.
Model 4: DDM / DYT
Not applicable — no dividend.
Fair Value Verdict
Base fair value: $140–$160 (15-17x EV/FCF). Current $84 represents a 40-45% discount to base fair value. Even the stressed scenario ($103) implies meaningful upside from current levels. The valuation is asymmetric: the bear case offers ~22% upside; the base case offers ~70-90% upside.
Phase 1/3 — Sentiment & Intelligence Analyst
Recent News & Catalysts
Q4 2025 Earnings (Feb 5, 2026): - Revenue: $175.3M (+10.1% YoY), beat estimates by 1.2% - Non-GAAP EPS: $1.87, beat by 4.9% - Billings: $204.9M, +5.6% YoY ← key yellow flag (billings growing slower than revenue) - Adjusted op margin: 45.7% in Q4 — strong - 2026 guidance: $717-725M revenue (7-8% growth) with non-GAAP EPS $7.17-7.45 (midpoint $7.31) - Stock fell 13-18% on guidance disappointment
The guidance disappointment: Market expected continuation of ~10% growth; 7-8% guidance + slightly missed EPS estimate midpoint triggered selloff. Management also guided for "mid-40s" EBITDA margins, a step back from 47% in 2025.
Anthropic Mythos (April 2026): Second wave of selling triggered by concerns about Mythos AI model. QLYS fell ~13% on reports that Mythos could disrupt vulnerability discovery workflows. Qualys responded with Agent Val integration (automated remediation AI). Concern is legitimate in long term; near-term impact overstated.
Insider Activity: - CFO Joo Mi Kim: Sold 3,414 shares (Feb 2, ~$135/sh) then 6,799 shares (Feb 4, ~$128/sh) = $1.34M sold just before further decline - CEO Sumedh Thakar: Sold 5,000 shares (Jan 14, ~$134/sh) = $668K - Pattern: Insiders sold near $128-136 range, stock now at $84 — either lucky/planned selling or they had visibility into the guidance weakness
Short Interest: Reports of "significant increase" in short interest (April 2026). Short sellers are piling in on the AI disruption + growth deceleration narrative.
Institutional Holders: 99.3% institutionally owned. Vanguard, Legal & General holding steady. Some institutional exodus reported on blogs; not clearly confirmed by known major holders.
Net Dollar Retention
- Current: 103% (down from 104% prior quarter)
- Directional concern: Heading toward 100% (neutral) would indicate customers not expanding. Any slip below 100% would be a critical signal.
Analyst Consensus
| Period | Strong Buy | Buy | Hold | Sell | Strong Sell |
|---|---|---|---|---|---|
| Current | 1 | 5 | 16 | 1 | 1 |
| -1mo | 1 | 6 | 15 | 1 | 1 |
| -2mo | 1 | 6 | 15 | 1 | 1 |
Predominantly Hold (67%). Truist lowered PT to $120 (from $130), maintaining Hold. No strong consensus either way — analysts are stranded on the AI uncertainty.
Sector Tailwinds
- Vulnerability management market: $17.6B (2025) → $24.1B (2030), ~6.5% CAGR
- Cloud security spending growing at 22% CAGR (Gartner)
- Expanding attack surface from AI adoption creates MORE need for VM, not less
- Geopolitical tensions (tariff uncertainty, state-sponsored attacks) increasing enterprise security budgets
Phase 3 — Debate Round
Tension identified: Valuation Analyst says "buy aggressively — 7.8x EV/FCF is insane for this quality." Moat/Sentiment says "billings deceleration and AI disruption are real headwinds — growth may slow further."
Moat Analyst rebuttal to Valuation: The 5.6% billings growth is a serious lead indicator problem. If billings are growing at 5.6% now, 2027 revenue could easily come in at 5-6%. The market may not be wrong to apply distressed multiples if the trajectory is toward flat/declining billings. Platform consolidation by CRWD and PANW is HAPPENING — we've seen it across other point-solution vendors.
Valuation Analyst rebuttal to Moat: Even in the stress scenario — 0% FCF growth in perpetuity — intrinsic value at 10% discount rate is: $304M / 0.10 + $644M cash = $3,688M / 35.7M shares = $103/share, still 23% above current price. The "permanently declining" scenario requires FCF to actually FALL, not just grow slowly. Nothing in the fundamental data supports that conclusion from today's operating metrics. Qualys generated $304M FCF on $669M revenue with margins expanding every year. They are not in distress.
Manager synthesis: Both sides have merit. The deceleration and billings weakness are genuine warning signals worth watching. The valuation is genuinely compelling. The resolution is position sizing: this is a hold/cautious-add situation, not a conviction-high "size up." Hold the current position and watch Q1 2026 earnings (due ~May 2026) for confirmation of either recovery in billings OR further deceleration.
Phase 4 — Manager Verdict
Weighted Verdict
Qualys is one of the highest-quality businesses in the cybersecurity space trading at the worst valuation it has seen in years. The selloff has been driven by a combination of genuine (soft guidance, billings deceleration) and arguably overstated (AI disruption) concerns. The business fundamentals — 82.8% gross margins, 45% FCF margins, 32% ROIC, zero debt, $644M net cash — are exceptional and improving. The market is valuing this at 7.8x EV/FCF, which implies permanent stagnation or decline. That conclusion is not yet supported by the actual operating data.
The key risks are: 1. Billings growth at 5.6% — the most credible fundamental concern. If billings continue to soften, 2026 revenue misses guidance and 2027 looks worse. 2. NDR trending toward 100% — watch this metric closely. 3. Platform consolidation (CRWD, PANW) — a multi-year pressure, already priced in to some degree. 4. AI disruption — directionally real but likely a 3-7 year risk, and Qualys can adapt. Agent Val is evidence they are. 5. Insider selling — CFO/CEO selling before further stock decline is a yellow flag, but could be planned 10b5-1 sales.
Conviction Score: 6.5 / 10
Verdict: HOLD current position / Cautious Add on further weakness
- Current holders (like this portfolio at $95.69): Hold. The stock at $84 is already a deep discount to any reasonable fundamental valuation. Adding here is reasonable but size modestly — the growth deceleration story could get worse before it gets better.
- Entry zone for adds: $78–$85 (near the 52-week low of $74.51)
- Watch closely: Q1 2026 earnings (~May 2026) for billings trend, NDR, and any guidance revision
- Exit signal: If billings growth falls below 3-4% for two consecutive quarters or NDR drops below 100%, the business model is breaking. Reassess conviction.
- Catalyst for upgrade: Billings reacceleration, AI disruption narrative fades, or M&A/partnership that expands TAM
Fair Value Summary
| Scenario | Fair Value | Upside from $84 |
|---|---|---|
| Stressed (AI disruption, 10x EV/FCF) | ~$103 | +23% |
| Bear (12x EV/FCF) | ~$119 | +42% |
| Base (15x EV/FCF) | ~$145 | +73% |
| Bull (20x EV/FCF) | ~$188 | +124% |
The asymmetry here is meaningful. Even the stressed scenario implies 23% upside; the base case is nearly double. If AI disruption turns out to be directionally real but slow-moving — the most likely outcome — Qualys has 3+ years to adapt while generating $300M+ FCF annually.
Type-Specific Overlay
No dividend grower, REIT, or BDC overlay applicable. SaaS cybersecurity — standard Fundamentals + Moat + Valuation framework applies.
Watchlist Action
Recommend adding to Watchlist under Cybersecurity (Value) at conviction 6.5, alongside CHKP. Both are cybersecurity names trading at deep value. QLYS has superior FCF growth but real near-term headwinds; CHKP is more stable but lower growth.
Sources: Qualys Q4 2025 Earnings Release, Simply Wall St — QLYS selloff analysis, Sahmcapital — AI disruption valuation, NBC News — Vulnpocalypse / Mythos, CSO Online — Mythos structural shift, Defense World — Insider buying Burney