Financebotresearch desk研究台

QLYS › value

QLYS · Value

TRIM Cybersecurity

Date: 2026-09-22 | Price: $181.23 | Shares: 34.651M | Market cap: $6.28B | Net cash: $650M | EV: $5.63B Baseline: analyze-2026-07-23 — price $134.22, FV $120–150, add $100–115, conviction [6.5] Scope: valuation only. The business-quality work in the July file stands; this pass re-prices it.

1. What changed since 2026-07-23

The July file was written 12 days before a print that materially moved the numbers. One event did almost all of the work.

Date Event Effect on value
2026-08-04 Q2 FY26 print. Revenue $182.2M (+11.0%) vs $178.6M guide. EPS $1.98 non-GAAP vs $1.78 est. Material — raises FV
2026-08-04 FY26 revenue guide raised $721–727M → $732–738M; EPS guide $7.44–7.65 → $7.74–7.88 Material — raises FV
2026-08-04 Net dollar expansion 104% → 105%. First increase in the series. Material — raises FV
2026-08-04 Calculated current billings $176.5M, +16% — vs a 7–8% baseline Material, but see caveat
2026-08-04 ETM/CSAM bookings mix 12% of total / 14% of new (TTM), vs 9%/10% a year ago Modest positive
2026-08-04 Channel revenue +22% y/y, now 54% of revenue (was 52%) Modest positive
2026-08-04 Q2 FCF $55.9M = 31% margin vs 20% in Q2'25; InstaScan launched Positive
2026-08-04 Management held the H2 billings baseline at 7–8% and attributed part of the 16% to a cohort already deep in ROC adoption Caps the raise
~2026-08 Stock sets 52-week high $201.54 —
2026-09-14 Wedbush downgrades to Neutral from Outperform while raising PT $125 → $175 Confirms "good business, full price"
through 2026-09-14 Insiders: still zero buys. CEO Thakar sold 3,200sh in each of Jul/Aug/Sep; CFO Kim sold twice; 3 directors sold Unchanged negative

No Q3 print, no M&A, no buyback authorisation change, no guidance cut. Q3 guide is $185.5–187.5M (+9–10%). Next print is due ~3 Nov 2026 (not yet formally dated).

Answer to "has anything happened that justifies a higher fair value?" — Yes, and it is specific: the four-year deceleration stopped. The July file's headline series was 19 → 13 → 10 → 8%, with the 8% coming from guidance. That guidance has been raised twice since and the series now reads:

FY Revenue growth
2022 +19.1%
2023 +13.2%
2024 +9.6%
2025 +10.1%
2026 guide (mid $735M) +9.9%
Q3'26 guide +9 to +10%

Two consecutive years at ~10% is a plateau, not a slide. The "19→13→10→8" framing that anchored the $120–150 range is now factually out of date — the 8% never happened.

2. Inputs (TTM through Q2 FY26, 2026-06-30)

Item Value Source
Revenue TTM $702.98M Q3'25–Q2'26 sum
Net income TTM $206.55M 29.4% net margin
Diluted EPS TTM (GAAP) $5.78 $1.39+1.47+1.42+1.50
BVPS $16.22 equity $562.22M / 34.651M sh
FCF TTM $313.96M 89.5+74.9+93.6+55.9 → 44.7% margin
SBC TTM $78.25M 11.1% of revenue
SBC-adjusted FCF TTM $235.71M 33.5% margin
Buybacks TTM $225.27M 2.88× SBC (was 2.4×)
Cash + ST investments $426.29M
LT investments $277.17M
Total debt (finance leases only) $53.40M
Net cash $650.07M 10.4% of market cap
Shares out 34.651M −4.8% y/y (36.398M)
Deferred revenue (current) $388.08M float, not leverage
Current ratio 1.38
FY26 non-GAAP EPS guide $7.74–7.88 (mid $7.81)
FY27 consensus EPS ~$8.60

Two inputs improved more than the price move alone would suggest:

  1. FCF base up 8% — TTM FCF $290.5M → $314.0M; SBC-adjusted $213M → $235.7M.
  2. Share count down 4.8% y/y and accelerating — 35.379M → 34.651M in Q2 alone (−2.1% in one quarter, $77.9M repurchased). The July file modelled −2.6%/yr. The run rate is now roughly double that. Every dollar of enterprise value is spread over fewer shares.

3. Models

Graham IV — computed, then excluded

√(22.5 × $5.78 × $16.22) = $45.93

Reported for completeness and given zero weight, for the same reason as July: QLYS has deliberately destroyed book value through buybacks (retained earnings −$187.6M, worse than July's −$166.7M precisely because the buyback accelerated). Graham measures asset backing; QLYS runs $5M of capex on $669M of revenue. Using Graham here would penalise the company for the single best thing it does. Excluded from the range.

DYT / DDM — not applicable

No dividend, none signalled. Correctly skipped per analysis_notes.md §3.

Bogle expected return — 0% yield + EPS growth ± ΔP/E

EPS growth is the sum of ~9% revenue, ~1–2% of continued margin expansion, and ~3–4% of share shrink = ~13% near term, fading to ~9–10% as the buyback normalises. Entry multiple 23.2× FY26 / 21.1× FY27.

Scenario EPS growth P/E change (5yr) Expected return
De-rate to 15× fwd +11% −6.5%/yr ~4–5%/yr
De-rate to 18× fwd +12% −4.0%/yr ~8%/yr
Flat at 21× fwd +12% 0% ~12%/yr
Re-rate to 25× fwd +12% +3.5%/yr ~15%/yr

Bogle base ~8%/yr. Better than July's ~9% looked at the time only because EPS growth is now carried by a heavier buyback; the de-rating risk is larger because the entry multiple is higher.

DCF on SBC-adjusted FCF — this carries the weight

Base is $235.7M, the honest owner-earnings figure: the buyback must absorb $78.3M of SBC before per-share accretion is real. r = 9.5–11% depending on scenario; $650M net cash added back; 34.651M shares. 10-year linear growth fade, then perpetuity.

Scenario Assumptions Fair value/share
Bear bundling thesis proves out; 4% fading to 1.5%, terminal 1.5%, r=11% $99
Conservative 7% fading to 3%, terminal 3%, r=10% $137
July spec, re-run on new base 7%→3.5%, terminal 3.5%, r=10% — identical assumptions to the July file $144
Base 8% fading to 4%, terminal 3.5%, r=9.75% $157
Optimistic 9.5% fading to 4.5%, terminal 4%, r=9.5% $183
Memo: unadjusted FCF $314M, 8%→4%, r=9.5% ignores SBC entirely — upper bound only $210

The bridge is the important row. Holding July's exact growth and discount assumptions constant and changing only the inputs, fair value moves $126 → $144 — an +14% mechanical lift from the higher FCF base, the lower share count, and one fewer year of discounting. The move from $144 to $157 is the judgement call: raising the growth assumption from 7% to 8% on the strength of the raised guide, NRR 105%, and two years at ~10%.

Reverse DCF — what the market demands at $181.23

EV $5.63B. Perpetual growth required to justify it:

On r=9.0% r=9.5% r=10.0%
Unadjusted FCF $314M 3.24% 3.72% 4.19%
SBC-adjusted FCF $235.7M 4.62% 5.10% 5.58%

The bar has risen from 4.5% → 5.1% perpetual growth on owner earnings. Against a company guiding 9.9% this year and shrinking the share count ~4%/yr, that is still a beatable bar — but it is no longer the low bar the July file leaned on. This is the single number that says "fairly priced, not cheap."

Multiple cross-check

Multiple @ $181.23
P/E (TTM GAAP $5.78) 31.4×
Forward P/E (FY26 non-GAAP $7.81) 23.2×
Forward P/E (FY27 ~$8.60) 21.1×
EV / Revenue TTM 8.01×
EV / FY26 revenue 7.66×
EV / FCF TTM 17.9× → 5.58% yield
EV / SBC-adj FCF 23.9× → 4.19% yield
P/B 11.2×

18–22× FY26 EPS → $141–172. 18–20× FY27 EPS → $155–172. The multiple grid and the DCF grid agree, which is the main reason to trust the range.

4. Fair value verdict

Weighted fair value range: $145 – $175. Midpoint ~$160.

Weighting: SBC-adjusted DCF heaviest (correct owner-earnings basis, and the assumption bridge is explicit); forward-multiple grid as the independent cross-check; reverse-DCF as the sanity test; Bogle for return context; Graham excluded; unadjusted-FCF DCF ($210) treated as an upper bound only, because it capitalises stock compensation as if it were free.

Did the fair value rise from $120–150? Yes — to $145–175, a +21% lift at the midpoint ($133 → $160). The evidence is concrete and dated: the 4 Aug guidance raise ($721–727M → $732–738M revenue, $7.44–7.65 → $7.74–7.88 EPS), NRR 104% → 105%, and an FCF base 8% higher on a share count 4.8% lower.

But $181.23 is still above it. Spot sits ~3.6% above the top of the range and ~13% above the midpoint. There is no margin of safety, and the reverse-DCF bar has climbed to 5.1% perpetual growth on owner earnings.

The honest statement: an excellent business, correctly re-rated, and then some. The July call that $134 was fair value was right on the analysis and too low on the inputs. The stock has since done the re-rating the improved numbers deserved — and about 4–13% more.

5. The key judgement — deceleration, NRR, and the bundling threat

Is 19→13→10→8% plus 104% NRR consistent with 23× forward? That framing is no longer the right question, because two of its three terms have changed.

  • The 8% did not happen. FY26 is guiding +9.9%, Q3 +9–10%. The series is 19 → 13 → 10 → 10 → ~10.
  • NRR rose to 105%, the first increase in the series after three flat quarters at 104%.
  • Billings grew 16%, not 7–8%.

A ~10% grower with an 83% gross margin, a 34% operating margin, a 45% FCF margin, no debt, $650M of net cash and a 4%/yr shrinking share count is not obviously mispriced at 23× forward earnings. The multiple is defensible. It is simply not generous.

Is bundling visible in the numbers? — No, and the Q2 print is direct evidence against it.

This is the clearest finding of the pass. If Microsoft Defender Vulnerability Management, Cortex or Falcon Exposure Management were taking QLYS renewals, the damage would appear first in retention and expansion. Both moved the wrong way for the bear:

Bundling would predict Q2 FY26 actual
NRR falls below 104% 105%, up
Billings decelerate below revenue +16%, well above revenue's +11%
Gross margin compresses on price concessions 83%, still rising
Channel shrinks as platforms disintermediate +22% y/y, 54% of revenue
New-product attach stalls ETM/CSAM 12% of bookings / 14% of new, up from 9% / 10%

The July file's thesis break was "overall NRR < 102% two consecutive quarters." It went the other way. The upgrade trigger "billings baseline raised above 7–8%" partially fired — the printed number was 16%, but management explicitly refused to raise the baseline for H2 and flagged that part of the 16% came from a customer cohort already deep in ROC adoption. Call it a half-fire: the quarter was real, the run rate is unproven.

Conclusion: bundling remains the correct structural risk to name, but there is no evidence in the FY26 numbers that it is currently happening. One quarter does not settle a multi-year question, and the H2 guide is the test. Q3 (~3 Nov) is where the 16% either persists or reverts.

Insider signal — unchanged and still negative

Zero buys. The CEO sold 3,200 shares on 14 Jul, 14 Aug and 14 Sep — a monthly 10b5-1 cadence, so not a discretionary signal. But the CFO sold twice and three directors sold, and nobody bought at $86 in May or at $201 in August. Insiders own <1%. This is a weak-alignment flag, not a timing signal.

6. Zones

Zone July 2026 Now Rationale
Fair value $120–150 $145–175 Raised FY26 guide, NRR 105%, FCF base +8%, share count −4.8%
Entry / add $100–115 $125–140 13–22% below base FV $157; ≤18× FY26. A genuine margin of safety
Trim $155+ 23× fwd Top of FV range ≈ 22.4× FY26 / 20.3× FY27; 23× leaves the compounder room to run
Current $134.22 $181.23 Above the trim multiple's near-term equivalent

The trim is set as a multiple, not a dollar, per the valuation rules. At today's FY27 consensus EPS, 23× fwd ≈ $198; on FY26 guidance EPS it is ≈ $180. The site recomputes the live dollar level each build, so the trim rises as earnings do — which matters for a name compounding EPS at ~12–13% with a shrinking share count.

7. Verdict — TRIM [7.0]

Conviction rises 6.5 → 7.0. The position should still come down. Those are not in conflict — the business got better and the price got better faster. That is exactly the condition under which a disciplined holder sells a part of a good thing.

Is 4.00% the right size at $181.23? No. Trim.

The case for trimming is not a view that the business is deteriorating. It is arithmetic:

  1. Price is above its own fair value. $181.23 vs FV $145–175. Every share held above the top of the range is held on hope, not on the valuation work.
  2. Size does not match conviction. A 7.0-conviction name is not a top-five conviction holding. QLYS is the 4th-largest position at 4.00% on the strength of a +35% run since July, not on the strength of a deliberate sizing decision. The weight was set by the market, not by us.
  3. The last time this happened, the trim was flagged and not acted on. The 14 Jul scan flagged QLYS above its $145 trim at $161.48; the stock round-tripped to $134 within nine days. The signal worked; execution did not. The same signal is live again, from a higher level.
  4. The reverse-DCF bar has doubled in absolute terms (4.5% → 5.1% perpetual on owner earnings) while the H2 billings baseline stayed at 7–8%.

Recommended action: trim roughly a quarter to a third of the position — take it from 4.00% down to the 2.7–3.0% range — and let the remainder run against a 23× forward trim.

That sizing does three things at once: it books the gain that the valuation work says is already earned, it right-sizes a 7.0-conviction name out of the top-five slot, and it keeps enough exposure that a Q3 confirmation of the 16% billings run rate is not a missed re-rating. It is deliberately partial — the Q2 print was genuinely good, and selling out of a name whose thesis just improved would be the opposite error.

Do not add. The $125–140 entry band is ~23–31% below spot. Absent a sector de-rating of the kind seen in July, the stock is not returning there soon, and the band should be left alone rather than chased upward to manufacture a buy signal.

What would change this

🚩 Downgrade 🟢 Upgrade
NRR back below 104% NRR ≥ 106% and H2 billings baseline formally raised above 7–8%
Q3 revenue below the $185.5M guide floor FY27 guide above +10%
FY26 guidance cut at Q3 ETM/CSAM bookings share > 18%
Q3 billings revert to 7–8% and NRR flat Any insider open-market buying (still zero)
Gross margin < 80% Credible acquisition approach
Buyback pace slows below 2× SBC Price back to $125–140 with the thesis intact

Risks to this valuation

  1. The 16% billings quarter may not repeat. Management said so itself. If H2 prints 7–8%, the 8% growth assumption behind the $157 base is too high and fair value reverts toward $144.
  2. Multiple risk is now the dominant risk. At 23× forward, a de-rate to 18× is a −22% move with no change in the business at all. In July the multiple was the cushion; now it is the exposure.
  3. Bundling remains structurally unresolved even though it is invisible in the current numbers. Absence of evidence over four quarters is not proof of safety over five years.
  4. SBC at 11.1% of revenue means the unadjusted-FCF framing overstates value by roughly 25%. Anyone quoting "17.9× EV/FCF, cheap" is quoting the wrong number.
  5. Zero insider alignment — <1% ownership, continuous selling, no buys at any price in the $74–201 range.

Sources