Financebotresearch desk研究台

QLYS › analyze

QLYS · Analyze

Cybersecurity

Date: 2026-07-23 | Price: $134.22 (−5.56% today) | Market Cap: $4.73B | EV: $4.05B Sector: Technology / Software–Infrastructure → filed under Cybersecurity CEO: Sumedh S. Thakar | Employees: 2,625 | IPO: Sept 2012 Prior analysis: 2026-04-16 — price $84, conviction 6.5, FV $140–160

⚠️ Data note: Yahoo Finance MCP was not connected this session. Quantitative base is roic.ai (2yr annual + 8 quarters — free-tier history cap), supplemented by stockanalysis.com for FY2021–2025 history and web research for qualitative work. Long-run (8yr) CAGRs could not be computed from primary MCP data; 4–5yr CAGRs are used instead and labeled as such.

Executive Summary

QLYS has fallen −20% in nine days ($167.86 high → $134.22), including −5.6% today. There is no company-specific bad news. The decline is a sector de-rating of the vulnerability-management cohort (QLYS, TENB, RPD, S, ZS) driven by a William Blair downgrade on "AI disruption" and Morgan Stanley's call that cyber got "too pricey, too fast" after a ~25% one-month run.

The April thesis worked: bought at a deep discount, the stock doubled to $167 and blew through the $145 trim zone. That discount is now gone. At $134 QLYS is a high-quality, cash-generative, net-cash business trading at roughly fair value with an unresolved terminal question. Conviction holds at 6.5 — but for the opposite reason it did in April.

Phase 1 — Fundamentals Analyst

Growth & Profitability (FY2021–FY2025)

Metric 2021 2022 2023 2024 2025 4yr CAGR
Revenue $411.2M $489.7M $554.5M $607.6M $669.1M +12.9%
Gross profit $321.7M $386.9M $447.0M $496.1M $554.4M +14.6%
Operating income $87.7M $130.6M $163.1M $187.2M $222.0M +26.2%
Net income $71.0M $108.0M $151.6M $173.7M $198.3M +29.3%
Diluted EPS $1.77 $2.74 $4.03 $4.65 $5.44 +32.4%
Free cash flow $176.2M $183.5M $235.8M $231.8M $304.4M +14.6%
Diluted shares 40M 39M 38M 37M 36M −2.6%/yr

The single most important line in this table is revenue growth by year, not the CAGR:

Period Revenue growth
FY2022 +19.1%
FY2023 +13.2%
FY2024 +9.6%
FY2025 +10.1%
Q1 2026 (actual) +9.8%
Q2 2026 (guide) +8–9%
FY2026 (guide) +7.8% to +8.6%
FY2027 (consensus) +7.1%

Four consecutive years of deceleration, unbroken. This is the whole bear case, and it long predates the AI narrative.

TTM Snapshot (Q2'25 → Q1'26)

Metric TTM Margin
Revenue $684.9M —
Gross profit $569.0M 83.1%
EBITDA $244.4M 35.7%
Net income $201.4M 29.4%
Free cash flow $290.5M 42.4%
SBC $77.5M 11.3% of rev
SBC-adjusted FCF $213.0M 31.1%
Diluted EPS (GAAP) $5.57 —

A 42% FCF margin on a 31% net margin with a 83% gross margin is genuinely elite. And it survives the SBC test: stripping 100% of stock comp still leaves a 31% FCF margin. For contrast, the Watchlist flags TEAM at SBC = 96% of FCF; QLYS is at 27%.

Capital Allocation — FY2025 ($304.4M FCF)

Use Amount % of FCF Comment
Buybacks $183.4M net / $208.5M gross 60–68% 2.4× SBC — share count genuinely falls
R&D (expensed) $117.3M 17.5% of revenue The growth investment. On the lean side — see risk
Capex $5.0M 0.7% of revenue Remarkably asset-light
M&A $0 — No empire-building. Clean.
Debt paydown n/a — No debt beyond $52M finance leases
Dividends $0 — None; not expected
Net into securities $100.9M 33% Cash pile still growing

Verdict: disciplined and shareholder-friendly. Zero M&A risk, buybacks meaningfully in excess of dilution, no leverage. Buyback authorization expanded $200M in Feb 2026 (total $1.6B); $306.6M remaining as of Q1. The one criticism: R&D at 17.5% of revenue alongside a 46% non-GAAP operating margin raises the question of whether management is harvesting margin at exactly the moment the technology stack is shifting. That is a real tension, not a nitpick.

Balance Sheet

Item FY2025
Cash + ST investments $445.9M
LT investments $250.9M
Total cash & investments $696.9M
Total debt (finance leases only) $52.2M
Net cash ~$645M–677M (14% of market cap)
Deferred revenue (current) $401.1M
Total assets $1,095.1M
Debt / assets 4.8%
Current ratio 1.41

Total liabilities/assets reads 48.8%, but $401M of that is deferred revenue — customer cash paid in advance. That is float, not leverage. True leverage is 4.8%. This balance sheet cannot kill the company under any scenario examined.

Per-Share (what I actually own)

Metric 2024 2025 TTM Δ
Revenue/share $16.51 $18.51 $19.22 +12.1%
FCF/share $6.30 $8.42 $8.05 +33.8% FY24→25
Diluted EPS $4.65 $5.44 $5.57 +17.0%
Cash+investments/share $10.37 $12.34 — +19.0%

Per-share metrics compound faster than the top line — buybacks are doing real work. Buyback yield 2.5%/yr.

Flagged data inconsistencies: roic.ai reports book_val_per_sh = −$4.61 and return_on_cap = −155%. Both are artifacts of buyback-driven negative retained earnings (−$166.7M), not economic reality. Actual equity is $561M (BVPS ~$15.71; tangible $15.20). stockanalysis.com shows ROIC 115.7% for the same distortion reason. The economically meaningful ROIC is roic.ai's 31.4% and that is what I use below.

Phase 1 — Sentiment & Intelligence Analyst

Why the stock fell 20% in nine days

Date Event Move
Jul 6 Scotiabank upgrades to Buy, PT $100 → $190 Rally continues
~Jul 14–16 Stock peaks ~$167.86 (52wk high); RBC raises PT $90 → $145 —
Jul 20 Truist raises PT $85 → $160 (Hold) —
Jul 21 Sector-wide selloff — QLYS −5.5% to $147.81; TENB −6.4%, GTLB −3.0% −5.5%
Jul 21 Q2 earnings date announced: Aug 4, 2026 —
Jul 22–23 Continued cohort de-rating; QLYS −5.6% to $134.22 −9.2%

Drivers, in order of importance: 1. William Blair downgraded QLYS, RPD and TENB to Market Perform on "AI disruption" — the thesis being that frontier models capable of finding and exploiting vulnerabilities commoditize the detection layer that these companies price on. 2. Morgan Stanley: cyber got expensive after a ~25% one-month move; prefers large platforms (PANW, CRWD, FTNT) over vulnerability-management specialists. 3. Pre-earnings de-risking ahead of Aug 4.

Critically — William Blair stopped short of bearish, citing sticky customer bases, low valuations, and the possibility AI enhances rather than replaces these platforms.

Analyst Positioning — and why the consensus number is misleading

Metric Value
Consensus rating Hold (21 analysts)
Average PT $123.30 — below spot
Range $85 – $190
FY2026E revenue / EPS $724.6M (+8.3%) / $7.58
FY2027E revenue / EPS $775.7M (+7.1%) / $8.27

The $123.30 average is a blend of stale May targets (Morgan Stanley $96 Underweight, Scotiabank $100) and July chase-raises (Scotiabank $190, Truist $160, RBC $145, TD Cowen $145, JPM $139). Note the sequence: analysts cut targets in May when the stock was $86, then raised them in July after it hit $167. The revisions are following the price, not leading it. Neither the average nor the recent raises should be given much weight.

Insider & Institutional

Signal Reading
Insider transactions (12mo) 49 sells, 0 buys
Recent sells Posey (CLO) 882sh Jul 20; Hank (Dir) 940sh Jun; Berquist (Dir) 939sh Jun
Institutional ownership 96.6% (BlackRock, Vanguard core)
Insider ownership <1%

Individual sales are small and look like planned 10b5-1 activity — not alarming in size. But the complete absence of insider buying is a notable non-signal: management had the stock at $86 in May, knew Q1 was going to beat, and nobody bought. Insiders own <1% of a company they run. Alignment is weak.

Management tone (Q1 2026 call, May 5–6)

Confident on strategy, cautious on numbers. Thakar: "The need for organizations to know their true risk to effectively prioritize and auto-remediate riskiest vulnerabilities in less than a day has never been greater." CFO Joo Mi Kim was deliberately unmoved by the Q1 beat: "We don't see any material kind of meaningful change for the full year today... the baseline still remains at 7% to 8% for the current billings."

That refusal to raise the underlying billings assumption after a beat is the honest tell. Management is not seeing acceleration. Guidance was raised on revenue/EPS mechanics, not on demand.

Phase 2 — Moat Analyst

Quantitative base

Metric 2024 2025 Q1 2026 Trend
ROIC 33.7% 31.4% — ↓ slightly
Gross margin 81.7% 82.8% 82.9% ↑
Operating margin (GAAP) 30.8% 33.2% 34.7% ↑
Non-GAAP op margin — — 46% ↑
Net dollar expansion 103% 104% 104% → flat
ETM/CSAM cohort NRR — — 107% ↑

The tell is the divergence: margins and ROIC are rising while revenue growth is falling. That is the signature of a business with pricing power over its installed base but a shrinking ability to win new ground. Moat erosion is not yet visible in unit economics — it is visible in the top line.

104% NRR is the number that matters most. Retention is doing all the work; upsell is doing almost none. Direct sales grew +3%.

Moat sources — named explicitly

Source Strength Assessment
Regulatory intangibles Strong (narrow) FedRAMP High for Government Cloud and TotalCloud (May 2026, DEA-sponsored); PCI ASV. Takes years and millions. Wiz and AI-native startups don't have it. The most durable piece.
Switching costs Moderate–strong Agents deployed across enterprise fleets, historical vulnerability data, compliance workflows keyed to Qualys reports. Multi-quarter rip-out.
Cost advantage Moderate Purpose-built single platform; $5M capex on $669M revenue; 83% gross margin.
Data / scale Moderate 150M+ patches deployed, 40M autonomously at Six Sigma accuracy. Best AI counter-asset they have.
Network effects Absent No meaningful cross-customer effect.
Brand Weak–moderate 10,000+ customers, 74% of Forbes Global 50 — but incumbency, not preference.

Adversarial stress-test: "I'm a well-funded rival. How do I kill Qualys?"

1. Bundle it away (this is the actual threat, and it is already happening). Microsoft Defender Vulnerability Management ships inside an E5 license the CISO already bought. PANW Cortex and CRWD Falcon Exposure Management fold VM into a platform the customer is already consolidating onto. You don't need a better scanner — you need a free enough one attached to a renewal the customer can't avoid. A CISO consolidating vendors does not renew a standalone VM point-product. This explains 19%→13%→10%→8% far better than any AI story does.

2. Redefine the category (Wiz, now inside Google). Wiz reframed "exposure management" as an agentless cloud-graph problem — deployed in minutes via API, surfacing toxic combinations and attack paths. Qualys's agent-based architecture is a structural liability in cloud-native shops. TotalCloud is a follower product. Google's ownership of Wiz supplies hyperscaler distribution Qualys cannot match.

3. AI-native entry. Frontier models finding vulnerabilities directly. Real, but see below — this cuts both ways.

How easy is entry? Building a scanner is now easy. Building FedRAMP-High, compliance-grade VM with autonomous remediation at Fortune-500 scale is still hard. The moat is real but narrowing — and it is narrowing from the top (bundlers), not the bottom (startups).

Disruption forecast (5–10 years) — where I disagree with the market

The William Blair thesis is that AI commoditizes vulnerability detection. That is probably right. But detection is the part of the stack Qualys is already trying to move away from.

The counter-argument, which I find partially persuasive: if AI makes discovery 10× faster, the bottleneck moves entirely to prioritization and remediation — which is precisely what ETM, Patch Management and Agent Vail (closed-loop exploit validation + autonomous remediation) do. More vulnerabilities found means more remediation work, and remediation is where the 40M-autonomous-patch dataset is genuinely hard to replicate. Industry evidence supports the augmentation view: 47% of security teams already report measurable AI impact in VM, and the consensus framing is AI-augmented, not AI-replaced, with agents complementing rather than displacing foundational discovery.

Where I land: the AI thesis is real but mis-specified as existential. The immediate danger is platform bundling by Microsoft/PANW/CRWD, which has been visible in the numbers for four years. AI is the narrative that finally made the market price a trend that was already there. That distinction matters: it means the de-rating is late, not wrong — and it means the business is not about to fall off a cliff.

Evergreen assessment — No. Durable-but-fading.

Vulnerability management as a category is permanent. Qualys's independent position in it is not obviously permanent. Realistic 10-year outcomes: - (a) Successful pivot to an exposure-management platform → re-rating - (b) Slow grind to 3–5% growth as a well-run cash cow → the base case - (c) Acquisition — QLYS appears on 2026 cyber M&A target lists. Sub-$5B cap, net cash, 42% FCF margins, no controlling shareholder, insiders own <1%. Textbook target, and a genuine floor under the stock.

Moat defense — is management's response working?

Evidence Reading
ETM/CSAM bookings: 7–8% → 11% of total, 14% of new (LTM) Real traction
ETM/CSAM NRR 107% vs company 104% The pivot works where it lands
Channel 52% of revenue (from 49%), +17% vs direct +3% Distribution leverage improving
Agentic AI marketplace + Q-Flex procurement (Feb 2026) Credible, cheap, no M&A risk

Risk/reward on the effort: good — but slow. 11% of bookings cannot move an 8% growth rate for another 2–3 years. The strategy is right; the arithmetic is unforgiving.

Moat rating: Narrow, slowly eroding, well-defended.

Phase 2 — Valuation Analyst

Current multiples @ $134.22

Multiple Value Read
P/E (TTM GAAP) 24.1× Fair for quality, rich for 8% growth
Forward P/E (2026E non-GAAP $7.58) 17.7× Reasonable
Forward P/E (2027E $8.27) 16.2× Reasonable
PEG 2.05 Elevated
EV/Sales 5.91× —
EV/EBITDA 16.6× —
EV/FCF 13.9× → 7.2% yield Attractive
EV/SBC-adj FCF 19.0× → 5.3% yield Fair, not cheap
P/FCF 16.3× → 6.1% yield —

Model application (per §3 — conditionally by type)

Graham's Intrinsic Value — computed, then de-weighted to ~zero. √(22.5 × $5.57 × $15.80) = $44.51

This is meaningless here and I will not pretend otherwise. Graham measures book value; QLYS has deliberately destroyed its book value through $1.06B of buybacks over five years (retained earnings −$166.7M). The framework weights Graham toward asset-backed value plays. QLYS is asset-light software with $5M of capex. Reported for completeness; excluded from the fair-value range.

Dividend Yield Theory / DDM — N/A. No dividend, none expected. Correctly skipped per §3.

Bogle's Expected Return — 0% yield + EPS growth ± P/E change:

Scenario EPS growth P/E change Expected return
De-rate to 15× fwd +8% −2.9%/yr ~5–6%/yr
Flat multiple @17.4× +8–9% 0% ~8–9%/yr
Re-rate to 21× fwd +9% +3.8%/yr ~12–13%/yr

Bogle base: ~9%/yr. Adequate, not compelling.

FCF-based DCF — this carries the weight.

Base is SBC-adjusted FCF of $213M, which is the honest owner-earnings figure: buybacks first have to absorb $77.5M of SBC before any share count reduction is real. (The remaining ~$106–131M of repurchase is genuine per-share accretion, and shows up in the falling share count.)

Scenario Assumptions Fair value/share
Bear AI + bundling thesis proves out; growth → 2% perpetual, r=11% $88
Low-base 15× EV/SBC-adj FCF $110
Base 7% growth 5yr fading to 3.5% terminal, r=10% $131
High-base 15–17× EV/unadjusted FCF (April's framework, updated for FCF growth) $143–159
Bull 10% growth sustained 5yr, 4% terminal, r=9.5% $167

Reverse DCF — what is the market actually demanding?

On Implied perpetual growth to justify $4.05B EV
Unadjusted FCF ($290.5M) 2.6%
SBC-adjusted FCF ($213M) 4.5%

The market is asking for ~4.5% perpetual growth against a company guiding 8% with a shrinking share count. That is a low bar — and it is the strongest single argument for the bulls. If the AI-disruption thesis is simply wrong, the stock is worth more than $134.

Fair Value Verdict

Weighted fair value range: $120 – $150. Midpoint ~$133.

Weighting: SBC-adjusted DCF (heaviest — correct owner-earnings basis), reverse-DCF sanity check (confirms the bar is low), Bogle (~9% context), unadjusted EV/FCF (upper bound), Graham (excluded).

Current price $134.22 = fairly valued. Essentially zero margin of safety.

The honest tension: unadjusted FCF says $143–159 (upside); SBC-adjusted FCF says $110–122 (downside). Both are defensible. The truth sits between them, and that is exactly where the stock is trading. This is not a mispricing — it is a genuine coin-flip on the terminal question.

Phase 3 — Debate Round

Tension 1: Fundamentals vs. Moat

Fundamentals: 42% FCF margin, 31% ROIC, $677M net cash, gross margins rising, EPS compounding 32%/yr for four years, share count −2.6%/yr. A picture of health.

Moat rebuttal: Every one of those numbers is consistent with a company harvesting an installed base it can no longer grow. Revenue 19→13→10→8→7%. NRR 104%. Direct sales +3%. Rising margins with falling growth is what managed decline looks like, not what compounding looks like.

Manager resolution: Both are true, and they are the same fact viewed from two sides. QLYS is converting from a growth company into a cash cow, and executing that conversion unusually well. The financial quality is real, and it is partly a consequence of the growth problem — margin expanded because they stopped buying growth. Per §5, for a decelerating mature name Fundamentals + Valuation outweigh Moat's disruption fears — but only if valuation reflects the lower growth. At 24× GAAP / 17.7× forward for 7–8% growth, it roughly does. Fairly priced. Not a bargain.

Tension 2: Sentiment vs. Valuation

Sentiment: 49 insider sells and zero buys. Consensus Hold with a PT below spot. William Blair downgrade. Morgan Stanley cautioning on the whole cohort.

Valuation rebuttal: The stock has already fallen 20%. The reverse-DCF bar is 4.5% perpetual growth against 8% guided. Sentiment is negative but largely priced.

Manager resolution: Valuation wins on the near term — most of the sentiment damage is done. Sentiment wins on the medium term — the insider signal (nobody bought at $86) and four unbroken years of deceleration are not noise. Net: neither side justifies action at $134.

Phase 4 — Manager Verdict

Conviction: 6.5 / 10 — HOLD

Unchanged from April 16 — but for the opposite reason. In April, 6.5 meant "great value, real headwinds." Today it means "value gone, headwinds unchanged, quality intact." Same score, different composition. That is worth noticing: the April call was right ($84 → $167, +100%, through the $140–160 target), and the reason to own it has now been consumed.

Verdict: Hold the position. Do not add here. Do not panic-sell into a sector de-rating.

What would change my mind

🚩 Thesis break → downgrade 🟢 Upgrade trigger
Overall NRR < 102% two consecutive quarters ETM/CSAM NRR > 112% and bookings share > 18%
FY2026 revenue guidance cut Revenue growth reaccelerates above 10%
ETM/CSAM bookings share stalls < 12% through 2026 Any meaningful insider buying (currently zero)
Gross margin < 80% Credible acquisition approach
Buybacks cut or paused Billings baseline raised above 7–8%

Risks — named

  1. Platform bundling (highest, and underrated relative to AI). Microsoft Defender VM inside E5; PANW/CRWD consolidation. Already visible in four years of deceleration. This is the risk that actually compounds.
  2. AI commoditization of detection (loudest, genuinely uncertain). Real, but mis-specified as existential — remediation is the harder, stickier layer and Qualys is positioned there.
  3. Growth deceleration continuing to 2027E +7.1%. At some point a 7% grower gets a 7% grower's multiple, and 24× GAAP isn't it.
  4. R&D discipline vs. under-investment. 17.5% of revenue while running a 46% non-GAAP operating margin. Harvesting margin during a technology transition is how incumbents lose.
  5. Zero insider alignment. <1% ownership, 49 sells, 0 buys.
  6. Event risk: Q2 earnings Aug 4 (12 days). Stock enters the print down 20%, guidance $177.5–179.5M (+8–9%).

Golden flags

  • $677M net cash = 14% of market cap; zero real leverage
  • Buybacks 2.4× SBC — per-share accretion is genuine, not cosmetic; $306.6M authorization remaining
  • Gross margins rising (81.7% → 82.8% → 82.9%) — no economic evidence of moat erosion yet
  • FedRAMP High for TotalCloud (May 2026) — durable federal moat
  • ETM/CSAM NRR 107% > company 104% — the pivot works where it lands
  • Channel +17% vs direct +3% — distribution leverage improving
  • Reverse-DCF bar of only 4.5% perpetual growth
  • Credible acquisition candidate — provides a floor

A portfolio-specific passage was removed from the public build.

Recommended Action

HOLD. No action at $134.22.

  • Do not add. Fair value, no margin of safety, and a high-variance earnings print in 12 days. Adding before Aug 4 is paying full price for a coin-flip.
  • Do not sell. The de-rating is sector sentiment, not company deterioration. Fundamentals are intact and improving on every margin line. The reverse-DCF bar (4.5%) is low enough that the downside is bounded and the net cash + acquisition candidacy put a floor under it.
  • Revisit Aug 4 after Q2. Watch overall NRR (104%), ETM/CSAM NRR (107%) and bookings share (11%), and whether the 7–8% billings baseline finally moves. Those three numbers resolve most of the thesis.
  • If it trades to $100–115 on continued sector de-rating without a fundamental break, that is a genuine add — the quality is not in question, only the price.

Watchlist conviction: [6.5]

Sources