Qualys, Inc. (NASDAQ: QLYS) — Sold as an AI Casualty, Re-Bought as an AI Winner, on a $3 Million Guidance Raise

Report date: 2026-08-01 Price reference: ~$144.75 (close 2026-07-31) Fiscal year-end: December 31 · Sector/GICS: Information Technology — Software-Infrastructure / Cybersecurity (Vulnerability & Exposure Management) · CIK: 0001107843

Coverage note: this is initiating coverage. All figures are reconciled to SEC filings (FY2025 10-K filed 2026-02-20; Q1 FY2026 10-Q filed 2026-05-05; 8-K/Ex-99.1 of 2026-02-05 and 2026-05-05; DEF 14A filed 2026-04-22) and EDGAR. Where a third-party aggregator disagrees with the filing, the filing governs and the discrepancy is noted. Management commentary is treated as a hypothesis and validated against filings, financials and external evidence. Note that Qualys reports Q2 FY2026 on 2026-08-04, three days after this report date; nothing here anticipates that print.

⚡ Claude’s Take

This block is the author’s own subjective opinion. It is general information, not investment advice, and not a recommendation to buy or sell any security. The analytical body that follows (Sections 1–15) takes no position and contains no price target — it discusses valuation only as embedded expectations and scenarios.

Verdict: HOLD — a genuinely high-quality business at a fair, no-longer-cheap price. Accumulate on weakness below ~$115; not a short at any price in this range. The zone I would want to own this at is 16–18x EV/owner-free-cash-flow — which, on ~$213M of SBC-honest owner FCF and $677M of net cash, implies roughly $116–$128 per share. At $144.75 the stock sits at ~21x that measure, which is defensible for a 31%-ROIC franchise but is not a discount. Above ~$155 the AI-remediation narrative is carrying the entire multiple.

The framing is a harvest-quality cash machine that has already been given its re-rate — and the mechanism of that re-rate is the thing to understand. Between February and August 2026 Qualys was priced as two completely different companies. On February 6 it fell 13.3% because FY2026 guidance came in at +7–8% growth versus 2025’s +10%. Through the “SaaSpocalypse” it kept falling, bottoming at $76.20 on April 10 — a 40% collapse — as roughly $1 trillion of software market value evaporated on the fear that frontier AI models would gut legacy enterprise software. Then the identical fact pattern was re-read as a tailwind: if AI models discover vulnerabilities faster, someone must patch them faster, and Qualys deploys 150 million patches with 40 million already autonomous. JPMorgan moved the stock from Underweight to Neutral — not even to Buy — with the target raised from $87 to $139, and the shares gained 24.4% in six sessions (June 25–July 2), running to $164.12 by July 14 and settling at $144.75. Over that entire -40%-then-+90% round trip, the FY2026 revenue guidance midpoint moved from $721M to $724M. A $3 million raise. That is the whole variant perception: the tape repriced the story twice while the business did essentially nothing.

What is genuinely good here — and better than the market’s Tenable/Rapid7 framing implies. Qualys is the only one of the three vulnerability-management incumbents that is a real business by owner-economics standards. FY2025: 82.8% gross margin (expanded seven straight years), 33.2% GAAP operating margin, 31.4% ROIC, $304M of free cash flow — and, critically, SBC of only 11.5% of revenue against Tenable’s 19% and the 20–30% typical of the cohort. Strip SBC out honestly and owner FCF is $227M, or 34% of revenue; Tenable’s equivalent is roughly 6%. The buyback is not a dilution treadmill: diluted shares went from 41.3M (FY2019) to 35.2M actual outstanding today, a real ~15% reduction, with cumulative SBC absorbing only 36% of cumulative repurchase dollars. Net cash is $677M ($19.14/share) with zero borrowings. Much of this rests on an under-discussed structural cost advantage — 70% of employees sit in India — which is the real reason Qualys earns 33% operating margins where Tenable earns −1%.

What is genuinely bad, and why I will not pay up. Net dollar expansion is 103–104% and has not moved. That is the number that matters, and it says the installed base expands three-to-four points a year — a retention moat, not a pricing moat. The strategic bet, Enterprise TruRisk Management, is 11% of bookings after CSAM launched in 2021 and ETM has been generally available for over a year; TotalCloud has been flat at 5% of bookings for a full year, which is what organic-only product development looks like against a frontier where Google paid ~$32B for Wiz. Microsoft ships Defender Vulnerability Management inside E5 at near-zero marginal price — the cleanest mechanical explanation for why an 82.8%-gross-margin product cannot raise prices. And management is now guiding EBITDA margin down (47% → mid-40s) and FCF margin down (45.5% → low-40s) while growing sales-and-marketing 17% to deliver 8–9% revenue growth, with the CFO conceding productivity “is not exactly where we think it will be.” Spending more to grow slower is the late-stage tell. Insiders sold $10.4M under 10b5-1 plans and bought nothing on the way to $76.20 — a pointed contrast with Tenable, where directors and the CFO stepped in at the lows.

Conviction: medium. Flips bullish if net dollar expansion breaks above ~108% — i.e. the ETM/CSAM cohort’s 107% actually bleeds into the whole base — and revenue growth re-accelerates through 10%, proving ETM is additive rather than merely substituting for eroding VM dollars; or simply if the price returns to the $105–115 zone, where the same asset offers a materially different return. Flips bearish if NDR slips below 102% and FY2027 is guided below 7% while S&M keeps compounding mid-teens — at which point the margin story reverses and a 6.5x EV/sales multiple has nowhere to stand. Tag: “The cash machine the market forgot in April and over-remembered in July.”

📈 Stock Price Action — Five-Year Event Map

Text-only by design. The price move is a Fact; the attributed cause is Interpretation. No price target, no recommendation, no chart-pattern reading — the judgment belongs to Claude’s Take above.

Qualys is a twice-round-tripped stock. Over the trailing five years it ran from ~$111 (Sep 2021) to an all-time high of $205.89 (2023-12-19), ground down for two years, then collapsed to a five-year low of $76.20 (2026-04-10) in the software de-rating — a ~63% peak-to-trough drawdown that matches the FactorsToday ten-year max-drawdown reading of −63.0% — before a violent +90.0% four-month rally to $164.12 (2026-07-14). It closed $144.75 on 2026-07-31, roughly −11.8% off the 52-week high and −29.7% off the all-time peak. The trailing-52-week range is $76.20 – $164.12: the stock has traded across a 2.2x band in twelve months while revenue grew 10%.

Cycle narrative. (1) The late-2021 leg was liquidity, not fundamentals — the same melt-up that lifted the whole cyber complex. (2) 2022’s chop was the rate shock; notably management leaned into it with the largest buyback year in company history ($317.3M). (3) The 2023 run to $205.89 was the one genuinely earned re-rate in the five years: operating margin expanded from 26.7% to 29.4% and ROIC hit 38.1%, and the multiple followed. (4) The 2024–2025 grind is the real story — revenue growth decelerated from 13.2% to 9.6%, and EV/sales bled from 12.4x to 6.5x while the business kept getting more profitable; the market was repricing growth, not quality. (5) The two 20%+ single-day gaps on Q3 beats reveal how thin and one-sided positioning had become. (6) February 2026 delivered a genuine fundamental disappointment — a guide to +7–8% — immediately compounded by a sector-wide AI-disruption panic. (7) April 9 was macro, not company-specific: Cloudflare −12%, Snowflake −9%, ServiceNow −7% in the same session; Qualys simply had the highest beta to the fear. (8) The +115% snapback from the low was a basket re-rate plus one analyst’s change of mind — JPMorgan’s move to Neutral with a $139 target was worth 24.4% in six sessions, which tells you how much of the April price was despair rather than analysis. Between the February guide and the May guide, the FY2026 revenue midpoint moved from $721M to $724M. (9) The July fade is ordinary exhaustion after a 115% run.

1. Executive Summary

Qualys sells cloud-delivered software that finds security weaknesses across an enterprise’s IT estate, scores how dangerous each one actually is, and — increasingly — fixes them. Founded in 1999 and public since 2012, it pioneered software-as-a-service vulnerability management and today serves more than 10,000 subscription customers worldwide, including a majority of the Forbes Global 100, with no single customer above 10% of revenue. FY2025 (ended 2025-12-31) produced revenue of $669.1M (+10.1%), GAAP operating income of $222.0M (33.2% margin), GAAP net income of $198.3M ($5.44 per diluted share), and free cash flow of $304.4M (45.5% margin). The balance sheet carries $729.3M of cash and investments against zero borrowings — net cash of $677.1M, or $19.14 per share.

The bull case is a quality-at-a-reasonable-price argument backed by unusually honest cash flow. Qualys is the profitability outlier of its cohort: 82.8% gross margins that have expanded for seven consecutive years, a 33.2% GAAP operating margin against Tenable’s −0.9% and Rapid7’s ~1%, and 31.4% ROIC. Crucially, stock-based compensation is only 11.5% of revenue — roughly half the cohort norm — so SBC-honest owner free cash flow is $227.4M, or 34.0% of revenue, and the buyback genuinely retires stock rather than absorbing dilution (diluted shares 41.3M in FY2019 → 35.2M outstanding today). At $144.75 the enterprise value is $4,444M, or 14.6x guided FY2026 free cash flow and ~19x FY2026 non-GAAP EPS (16.6x ex-net-cash). A reverse discounted-cash-flow at a 10% cost of capital implies the market is embedding roughly 3% perpetual free-cash-flow growth — a low bar for a business that has compounded FCF at 15.4% for seven years behind a regulatory compliance floor that makes vulnerability scanning a mandatory purchase.

The skeptic’s case, which we find the more binding constraint at this price, rests on four reconciliations. First, the expansion engine has stopped. Net dollar expansion was 103% in both FY2025 and FY2024 and 104% in Q1 FY2026 — the installed base grows three-to-four points a year, which means growth increasingly depends on more-expensive new-logo acquisition rather than on the land-and-expand mechanics the platform story assumes. Second, the strategic pivot is not yet visible in the numbers. Enterprise TruRisk Management plus Cybersecurity Asset Management together are 11% of last-twelve-month bookings — after CSAM launched in 2021 and ETM has been generally available for over a year — while TotalCloud has been flat at 5% of bookings for a full year, and Patch Management’s share of new bookings actually slipped from 16% to 15%. The core vulnerability-management franchise still represents ~50% of bookings and is the part under structural attack. Third, the moat is a retention moat, not a pricing moat. It is a brand-and-installed-base intangible with genuine customer captivity — but Microsoft ships Defender Vulnerability Management inside E5 at near-zero marginal price, Google now owns Wiz, and CrowdStrike and Palo Alto both market “exposure management” from a platform position. When adequate substitutes arrive free inside a suite the customer already owns, an 82.8% gross margin cannot be defended by pricing — and the 103% NDR is that erosion showing up in the accounts. Fourth, the 2026 re-rating was sentiment. The stock fell 40% and rose 90% while FY2026 revenue guidance moved $3M.

What the bears must concede. This is not a melting ice cube. Renewal demand is underwritten by PCI-DSS, FedRAMP, HIPAA and cyber-insurance requirements; gross margins are rising, not falling; the company carries no debt, has never made a value-destroying acquisition, converts 34% of revenue to owner cash flow, and shrinks its share count. Rapid7 — the genuinely impaired comparable — trades at 0.77x EV/sales with $965M of debt against a $368M market capitalisation; Qualys is not remotely that situation. The realistic bear outcome is not impairment but chronic mediocrity: a 6–8% grower whose multiple slowly compresses toward a low-teens free-cash-flow yield.

The body that follows evaluates Qualys across a standard fundamental framework and takes no investment position and sets no price target — valuation is discussed only as embedded expectations and scenarios. The subjective view is confined to Claude’s Take above.

2. Business Overview

2.1 What the company actually does

Qualys operates a single, multi-tenant cloud platform — branded the Enterprise TruRisk Platform — that performs four linked jobs for enterprise security teams:

1. Discover and inventory assets. Agents, network scanners, passive sensors, cloud connectors and API integrations enumerate everything an organisation runs: servers, laptops, containers, cloud workloads, network gear, OT and IoT devices, and now AI models. This is the Cybersecurity Asset Management (CSAM) and External Attack Surface Management products.
2. Detect vulnerabilities and misconfigurations. The original and still-largest business — Vulnerability Management, Detection and Response (VMDR) — scans that estate against a continuously updated signature library maintained by Qualys’s own threat-research unit.
3. Prioritise by actual risk. TruRisk scoring, and the newer Enterprise TruRisk Management (ETM) layer, combine the raw findings with threat intelligence, asset criticality and business context to rank what genuinely matters. The Q1 FY2026 addition, TruConfirm / Agent Vail, goes further: it runs safe exploits across the live network to validate whether a given vulnerability is actually exploitable in that specific environment. Management’s claim — that under 1% of theoretical findings are truly exploitable in production — is the commercial premise of the whole layer.
4. Remediate. Patch Management and TruRisk Eliminate deploy the fix, or a compensating control where patching is impossible (registry edits, DLL removal, uninstalling an unused package). Management states over 150 million patches deployed, of which over 40 million in the past year were fully autonomous, at a sub-10% rollback rate.

Alongside these sit Policy Compliance, File Integrity Monitoring, Web Application Scanning, Multi-Vector EDR, Context XDR, TotalCloud (the CNAPP/cloud-security suite) and TotalAI (AI-model security).

2.2 How it makes money

The model is renewable annual subscription, priced principally by asset count and module. Revenue is effectively 100% subscription — the company reports a single operating segment and does not break out perpetual licence or material services revenue. Two structural features follow:

• Revenue recognition is short-duration. Total remaining performance obligations were $518.0M at 2025-12-31, of which $323.0M ($62%) recognises within 2026 and only $52.5M beyond 2028. Current deferred revenue was $393.8M at 2026-03-31. Contracts are predominantly annual; this is not a multi-year-locked backlog business, which cuts both ways — less visibility, but also less deferred-revenue optics propping up the reported numbers.
• The land-and-expand ladder is explicit. Management’s Q1 FY2026 investor materials illustrate a customer progressing from $1.00 of baseline VMDR spend to $3.00 across the full suite including ETM and Patch Management. Whether customers actually climb that ladder is the single most important open question in this report, and the answer so far — 103–104% net dollar expansion — is not yet.

2.3 Customer base and mix

Three observations matter. First, international is the growth engine: US revenue share has fallen from 60% to 55% in three years because international grew 15% in Q1 FY2026 against the US at 6%. Second, the channel is taking over: partner-sourced revenue grew 17% in Q1 against 3% for direct, and management explicitly expects that trend to continue. This improves sales efficiency but interposes a partner between Qualys and the end customer, which is a structural weakening of the direct relationship over time. Third, the large-customer cohort is concentrated but not dangerously so: 221 accounts at ≥$500K generate ~$293M, roughly 43% of trailing revenue, growing 14% — faster than the company. No customer exceeds 10% of revenue in any of the last three years.

2.4 Cost structure — the under-discussed advantage

Qualys employed 2,625 people at 2025-12-31, of whom approximately 78% sit outside the United States and 70% in India, with additional R&D in France. Revenue per employee is ~$255,000. This is not a footnote; it is the mechanical explanation for the margin gap that defines the investment case. Tenable, running a comparable product portfolio at 1.5x the revenue, earns a negative GAAP operating margin. Qualys earns 33.2%. Product quality differences do not explain a 34-point gap; cost geography does a great deal of the work.

2.5 Leadership

President and CEO Sumedh S. Thakar — a 20-year Qualys engineer who rose through Chief Product Officer to the CEO role in 2021 — and CFO Joo Mi Kim. The five-year filing corpus contains no executive departure 8-K, no restatement, no auditor change and no material acquisition. Governance is quiet and boring, which in this sector is a mild positive.

Verdict — a simple, well-understood, genuinely high-quality business model. Recurring subscription revenue, no meaningful customer concentration, an asset-light cost structure (capex 0.7% of revenue) and a structural labour-cost advantage. What it lacks is not quality; it is expansion.

3. Industry Dynamics

3.1 The category and its boundaries

Vulnerability management is the oldest continuously-funded line item in enterprise security. Its demand is not discretionary: PCI-DSS mandates quarterly external scanning; FedRAMP, HIPAA, SOX and virtually every cyber-insurance underwriting questionnaire require documented vulnerability scanning and remediation evidence. This compliance floor is the single most durable feature of the industry and is why net dollar expansion is 103% rather than 90% — customers do not leave, they simply refuse to pay more.

The category is now being renamed and repositioned in real time. “Vulnerability management” has become “exposure management,” then “continuous threat exposure management,” then — in Qualys’s Q1 FY2026 framing — “pre-breach cyber risk management” with an “AI-driven risk fabric” and a “Risk Operations Center.” Serial category re-labelling by an incumbent is usually a symptom of pricing pressure in the original category, not evidence of a new one. Tenable executed the identical manoeuvre with “Tenable One.”

3.2 Market structure and the competitive set

The FY2025 10-K names the competitive field explicitly: CrowdStrike, Palo Alto Networks, Rapid7 and Tenable among public companies, plus Invicti, Tanium and Wiz (Wiz now inside Google) among private vendors, and internally-developed alternatives.

The structure that matters is a three-layer stack:

• Layer 1 — the direct VM incumbents (Qualys, Tenable, Rapid7). All three are decelerating to single digits simultaneously. This synchronicity is the critical evidence: it means the deceleration is a category phenomenon, not any one company’s execution failure.
• Layer 2 — the consolidating platforms (Palo Alto, CrowdStrike, Microsoft). These sell security as a suite and increasingly ship vulnerability management as an included feature. Microsoft Defender Vulnerability Management is bundled into E5 and Defender plans at near-zero marginal price. This is the most corrosive fact in the industry: when a customer already owns an adequate scanner, the standalone vendor’s pricing power collapses regardless of product superiority.
• Layer 3 — the AI-native cloud-security frontier (Wiz, and the CNAPP field). Google’s ~$32B acquisition of Wiz set the price of admission to the frontier at roughly seven times Qualys’s entire enterprise value.

3.3 The tape as evidence of structure

Twelve-month total price returns to 2026-07-31 sort the industry cleanly:

The bifurcation is unambiguous: capital and multiple are flowing to the consolidators and away from single-category vendors. Rapid7 is the object lesson — a $368M market capitalisation against $965M of debt, trading at 0.77x EV/sales with a 59.7x EV/EBIT multiple on near-zero operating income. That is what the market pays for a subscale VM vendor that has lost the profitability argument.

3.4 Capital-cycle read (Marathon lens)

Applying the supply-side framework from Capital Returns: cybersecurity in aggregate is a textbook capital-attracting industry, which under Marathon’s logic is a warning rather than a comfort — capacity (new entrants, feature parity, bundling) is being added faster than the profit pool grows. But the capital is not flowing evenly. It is flooding into the CNAPP/AI-native frontier and out of legacy vulnerability management, where all three incumbents are in buyback-and-harvest mode with no new entrants and no fresh venture funding.

This produces a genuinely two-sided read. Constructive: no new capital is entering Qualys’s specific niche, which protects near-term pricing and explains why gross margins are still expanding. Qualys is harvesting a category that nobody wants to fund — historically a decent place to collect cash. Destructive: the budget line above Qualys is being absorbed by better-capitalised platforms, so the harvest is on a shrinking base of addressable spend. The Marathon framework is explicit that the returns eventually mean-revert; the question is whether the compliance floor sets that reversion at a high enough level.

3.5 The AI question, honestly framed

Both the April crash and the July rally were AI arguments, and both are coherent:

• The bear reading (which produced $76.20): frontier models make it trivially easy to build adequate vulnerability scanning, collapsing the differentiation of a signature-library business and accelerating the commoditisation Microsoft’s bundling already started.
• The bull reading (which produced $164.12): frontier models will discover vulnerabilities at a rate no human remediation process can absorb, and the exploit window is collapsing to under a day. The scarce asset becomes not detection but trusted autonomous remediation at scale — which requires deterministic, auditable execution with near-zero error tolerance, an installed base of agents already inside the firewall, and a proprietary dataset of hundreds of millions of prior patch outcomes. Qualys has all three.

The second argument is genuinely better than it sounds, and it is where Qualys’s real differentiation against Tenable lies: Tenable finds problems and hands them to somebody else to fix; Qualys fixes them. Management’s demonstration claim — detect, validate the exploit, apply a mitigation and re-validate in under 15 minutes — is a capability Tenable does not have. Whether it is worth more money is the unresolved question, and the honest answer from the accounts is that it has not been yet: Patch Management is 8% of bookings and its share of new bookings fell from 16% to 15% year over year.

Verdict — structurally mediocre for a subscale point vendor, with a genuinely durable demand floor. The product-level economics are excellent and the compliance mandate makes revenue extraordinarily sticky. But the bargaining position at the platform level is deteriorating, the profit pool is migrating one layer up, and the free substitute inside Microsoft E5 caps pricing power permanently. This is a good business inside a structurally challenged category — not a good category.

4. Competitive Position

4.1 Naming the moat

Under the Greenwald taxonomy, Qualys’s competitive advantage decomposes into two components of very different quality:

(a) A brand-plus-installed-base intangible with moderate customer captivity — real, but narrow. Qualys has been the SaaS vulnerability scanner of record for two decades. Switching costs are genuine but not enormous: the agent is deployed across the estate, scan history and compliance evidence accumulate inside the platform, security teams are trained on it, and auditors have seen its reports. Replacing it is a project, not a decision. This is the same moat type Tenable owns in Nessus, and it produces the same outcome: near-total retention with negligible pricing power.

(b) A genuine, separable cost advantage — the most defensible and least discussed part of the franchise. With 70% of employees in India and 78% offshore, Qualys runs the same product category at a structurally lower cost base than US-headquartered competitors. The evidence is in the accounts, not the narrative:

Tenable figures per its FY2025 Form 10-K and Q1 FY2026 Form 10-Q; Rapid7 figures per its SEC filings and market data; Qualys figures per its FY2025 Form 10-K and Q1 FY2026 Form 10-Q.

This table is the single strongest fact in the Qualys file. Three companies sell substantially similar products into substantially the same buyers, and one of them earns 33% operating margins while the others earn zero. That gap is a cost advantage, and cost advantages are the most durable of Greenwald’s three genuine advantage types when they derive from a structural input-price difference rather than from temporary scale.

4.2 What Qualys is not

It is not a network-effects business. The 10-K makes no such claim, and neither should we. One customer’s scan data does not measurably improve the product for another customer. The closest thing to a network effect is the patch-outcome dataset — hundreds of millions of deployed patches used to train the new “patch reliability score” that predicts patch-induced outages. That is a genuine data asset, arguably the beginnings of a real data moat, and it is the most interesting thing management said on the Q1 call. But it is early, unmonetised, and unverifiable from outside.

It is not scale-advantaged in the classic sense. Qualys is the smallest of its named public competitors by revenue. It has no scale economies over Palo Alto or CrowdStrike; it has cost economies over Tenable and Rapid7.

4.3 The moat test, applied honestly

If the moat disappeared tomorrow, which financial outcome would deteriorate? The answer is pricing and expansion — net dollar expansion. NDR is 103% (FY2024), 103% (FY2025), 104% (Q1 FY2026). The outcome that a moat is supposed to protect is already sitting at a level that says the moat protects retention but not price.

Set that against what an intact pricing moat would look like in a business with 82.8% gross margins, a mandatory-purchase demand floor, >10,000 customers and a majority of the Forbes Global 100: it would look like 115–125% NDR, as CrowdStrike and Palo Alto have posted in their expansion phases. Qualys posts 103%.

4.4 Market-share stability test

Greenwald’s diagnostic for a genuine barrier to entry is stable market shares over time. Qualys, Tenable and Rapid7 have held roughly stable relative positions — but all three are decelerating in lockstep to single digits while the category’s growth migrates to platforms. Stable shares of a stagnating pool is not evidence of a fortress; it is evidence of a mature oligopoly that has collectively lost the ability to grow. The share stability is real; the pool is the problem.

4.5 The one place Qualys is genuinely differentiated

Against Tenable and Rapid7 specifically, Qualys owns the remediation step. Tenable’s Vulcan acquisition orchestrates remediation; Qualys executes it, through the same agent that did the detection. In an environment where the exploit window collapses to hours, closing the loop inside one agent is a real architectural advantage, and it is why the AI-remediation narrative attached to Qualys rather than Tenable in June–July 2026. It is also why Qualys’s #1 rating in the GigaOm Patch Management radar is a more meaningful credential than most analyst-firm placements.

The counter-evidence is commercial rather than technical: Patch Management is 8% of LTM bookings, and its share of new bookings declined from 16% to 15%. Customers acknowledge the capability and are not yet paying much for it.

Verdict — a real but asymmetric moat: strong on cost, adequate on retention, weak on pricing; durable but not compounding. The cost advantage is genuine, structural and visible in a 34-point operating-margin gap versus the nearest comparable. The customer-captivity advantage is genuine but yields only 103% expansion. What Qualys has is a franchise that can be harvested at exceptional returns on capital for a long time — 31.4% ROIC on an asset-light base with no debt — but that cannot currently compound, because the mechanism by which software companies compound (expanding the installed base’s spend) is broken at 103%. Whether ETM repairs that mechanism is the whole question, and the evidence to date is not encouraging.

5. Growth History and Forward Opportunities

5.1 The record

Six-year revenue CAGR: 13.0%. Six-year FCF CAGR: 15.4%. The shape is unmistakable — growth peaked at +19.1% in FY2022 and has decayed to a guided +8–9%, while margins expanded every single year. Qualys has been converting growth into profitability for four consecutive years. That is a rational response to a maturing category, and it has been executed unusually well; it is also, definitionally, what a business does when it can no longer grow.

The one nuance worth crediting: FY2025’s +10.1% was a marginal re-acceleration from FY2024’s +9.6%, and Q1 FY2026 came in at +9.8% against a guide of +8–9%, prompting a small guidance raise. The deceleration is not yet a collapse.

5.2 Decomposing the growth

Organic, not acquired. Unlike Tenable (three bolt-ons in two years) or Rapid7, Qualys has made essentially no acquisitions — goodwill is $7.4M on a $1.09B balance sheet. Every point of the 13.0% CAGR is organic. This is a genuine quality mark: the headline growth rate needs no adjustment.

Geographic mix is doing the work. International grew 15% in Q1 FY2026 against 6% domestic. US revenue share has fallen 60% → 58% → 56% → 55% over three years. The domestic business — the mature, most-penetrated, most-exposed-to-Microsoft-bundling market — is growing at roughly the rate of nominal GDP.

Channel over direct. Channel revenue grew 17% in Q1 against 3% for direct, taking the channel to 52% of total revenue from 49%. Management explicitly expects this to continue and is building dedicated partner sales teams and a network of “nearly two dozen certified MRO partners.”

Large customers are outgrowing the company. The ≥$500K cohort grew from 203 to 221 accounts (+8.9%) with revenue up 14% — modest but real evidence that the land-and-expand ladder works at the top of the base, even as the aggregate NDR sits at 104%.

5.3 The forward opportunities, ranked by credibility

1. Enterprise TruRisk Management (the primary bet) — credible mechanism, unproven monetisation. ETM plus CSAM is now 11% of LTM bookings (from 8%) and 14% of new bookings (from 9%) — genuinely improving. The newly disclosed ETM/CSAM cohort NDR of 107% versus 104% company-wide is the most important new datapoint in the file: it is direct evidence that customers who adopt ETM spend more. The bear response is equally direct: 107% is three points better, and the cohort is small. If the entire base converted to ETM at that spend behaviour, company NDR goes to 107% — better, but not transformative. Management’s own guidance assumes “no material change in our net dollar expansion rate” in 2026.

2. Autonomous remediation / TruRisk Eliminate — the strongest strategic logic, the weakest commercial evidence. The argument that collapsing exploit windows force enterprises toward autonomous patching is sound, and Qualys is architecturally best-placed among the VM incumbents to serve it. The commercial reality: Patch Management is 8% of bookings, down a point in new-bookings share. Management’s evidence on the Q1 call was explicitly anecdotal — a Canadian bank CISO starting a proof-of-concept, “something that happened two days ago.”

3. Federal — real, slow, underweighted. Qualys holds FedRAMP High authorisation and is running its third annual federal conference. Management believes federal “will fuel a new leg of growth for the company over time.” The thesis — that budget pressure pushes agencies from costly on-premise deployments to cloud-native risk management — is plausible, and FedRAMP High is a genuine barrier that took years to obtain. No sizing is disclosed.

4. Q-Flex (consumption-style credits) — a pricing-model change, not a growth driver. Customers pre-commit to a dollar amount and swap products through the year. Generally available “later this year.” This should improve adoption velocity for new modules and is a sensible answer to a fast-moving product frontier. It is not obviously accretive to total spend, and it may reduce revenue predictability.

5. TotalCloud / CNAPP — stalled. Flat at 5% of bookings year over year. This is the segment where Google paid ~$32B for Wiz and where Palo Alto and CrowdStrike are investing hardest. Qualys is competing organically, at a fraction of the R&D budget, and it is not gaining share.

6. The AI partnerships — brand signal, not revenue. Qualys has joined OpenAI’s early-access cyber programme and Anthropic’s cyber-verification programme. These are useful for threat research and for credibility; neither is a monetisation channel.

5.4 The quality of the growth

The growth that exists is high-quality: entirely organic, subscription, 82.8%-gross-margin, from a diversified base with no customer above 10%, generating 31.4% ROIC. The problem is not quality but quantity and source. The company is growing 8–9% by selling internationally through partners while the domestic direct business grows at 3–6%, and the incremental products meant to change the trajectory account for 11% and 8% of bookings respectively after multi-year runways.

Sales productivity is the sharpest tell. S&M grew 17% in Q1 FY2026 and 18% the prior quarter, against 8–9% revenue growth. The CFO’s answer when asked directly was unusually candid: productivity “is not necessarily the traditional SaaS feel of it, it’s not exactly where we think it will be in the future… I’m not seeing it there yet.” Growing sales spend at twice the rate of revenue is the classic signature of a business buying growth that used to arrive for free.

Verdict — decelerating but high-quality growth; the forward opportunities are real in mechanism and unproven in monetisation. A 13.0% six-year CAGR delivered entirely organically at expanding margins is a good record. But the trajectory is monotonically downward, the two products meant to arrest it are 11% and 8% of bookings, the segment facing the largest addressable market (cloud) is flat, and the company is now spending 17% more on sales each year to produce 8–9% more revenue. Management guides to no NDR improvement in 2026 — which is the most honest statement in the file, and the one that should anchor expectations.

6. Financial Quality

6.1 Income statement — the margin story is the story

Gross margin has expanded in seven consecutive years, from 76.3% (FY2018) to 82.8% (FY2025), and reached 83.4% in Q4 FY2025 and 82.9% in Q1 FY2026. In a category supposedly being commoditised by a free Microsoft substitute, the incumbent’s gross margin is rising. That is a genuine anomaly and a point for the bulls: pricing at the product level has held, and the cloud-platform cost base is scaling.

Operating margin has expanded from 18.1% (FY2018) to 33.2% (FY2025), with Q1 FY2026 at 34.7%. Incremental operating margin was 56.5% in FY2025 — meaning 56 cents of every incremental revenue dollar dropped to operating income. Economics improve materially with scale.

6.2 Cash flow and the SBC question

This is where Qualys separates from its cohort, and it deserves precision.

Two things stand out. First, SBC is genuinely low for enterprise software — 11.5% of revenue against Tenable’s 19.2% and a cohort norm of 20–30%. Second, SBC is flat in absolute dollars ($77.1M → $77.0M) while revenue grew 10%, so the ratio is improving.

The consequence is that Qualys’s cash flow survives an honest adjustment. Where Tenable’s headline free cash flow is roughly 75% funded by stock-based compensation — reducing a 15–18x headline multiple to ~70x owner-FCF — Qualys’s $304.4M becomes $227.4M, still a 34.0% margin. Applying the same adjustment to the current valuation: TTM owner FCF of ~$213M against an enterprise value of $4,444M gives 20.9x EV/owner-FCF. That is a real multiple on a real number, and it is the fairest single valuation statistic in this report.

Cash conversion is high and clean: cash flow from operations / net income was 1.56x in FY2025. Capex is negligible at $5.0M (0.7% of revenue), guided to $8–12M in FY2026.

6.3 Quality-of-earnings checks

We looked specifically for the distortions that flatter software P&Ls, and found none of consequence:

• No acquisition accounting. Goodwill $7.4M, disclosed intangibles $11.1M. No inventory step-ups, no bargain purchase gains, no purchase-accounting deferred-revenue haircuts.
• No tax one-timers. Effective tax rate 19.7% (FY2025), 17.2% (FY2024), 15.1% (FY2023) — trending up toward a normal rate, so recent EPS growth is not tax-manufactured. There is no valuation-allowance release inflating a year.
• No capitalisation games. SBC is reported “net of amounts capitalised,” and the capitalised portion is de minimis ($17K in Q1 FY2026 — $19,357K gross versus $19,340K net).
• No deferred-revenue optics. RPO is short ($518.0M against $669.1M of revenue, 0.77x) and predominantly annual. Revenue is not being flattered by a lengthening backlog.
• Receivables are seasonal, not deteriorating. Accounts receivable swings from $171.0M (Q4 FY2025) to $134.9M (Q1 FY2026) on Q4 billing seasonality; the Q1 collection of $35.9M is the ordinary pattern.
• One small negative: Q1 FY2026 free cash flow margin fell to 53% from 67% in the prior-year quarter, and FY2026 FCF margin is guided down to “low 40s” from 45.5%. This is deliberate — the company is spending — but it means the FCF line will not grow with revenue this year.

6.4 Balance sheet

At 2026-03-31: cash $279.5M + short-term investments $191.9M + long-term investments $258.0M = $729.3M, against zero borrowings. The only “debt” on the balance sheet is $52.2M of finance and operating lease obligations. Net cash $677.1M, or $19.14 per share — 13.2% of the current market capitalisation.

Total equity is $569.9M against a $167.3M accumulated deficit — the deficit is an artefact of $1.3B of cumulative buybacks charged against retained earnings, not of operating losses. Current ratio 1.43x, of which the largest current liability is $393.8M of deferred revenue, which is a customer prepayment, not a claim on cash.

A note on enterprise value. ROIC.ai’s enterprise-value tool nets only “cash and near-cash” ($279.5M) and ignores the $449.9M of marketable securities, materially overstating EV. All enterprise-value conclusions in this report are computed from the filing.

6.5 Returns on capital

ROIC above 30% for three consecutive years is, in Greenwald’s framework, prima facie evidence of a genuine barrier to entry — competitive returns cannot persist at that level without one. Two honest qualifications: the denominator is small and shrinking because buybacks reduce equity, which mechanically flatters ROE; and ROIC has declined from its 38.1% FY2023 peak as the company reinvests in sales capacity. But even the declining figure is triple a reasonable cost of capital.

Verdict — yes, economics improve with scale, and the quality of the earnings is high. Seven straight years of gross-margin expansion, a 56% incremental operating margin, 31.4% ROIC, 1.56x cash conversion, low and flat SBC, a genuinely clean accounting record, and $677M of net cash with no debt. This is the highest-quality income statement and balance sheet in its direct competitive set by a wide margin. The single blemish is that FY2026 margins are guided down — the first planned reversal in seven years — to fund a sales expansion whose productivity management concedes is not yet where it needs to be.

7. Capital Allocation

7.1 The record

Qualys pays no dividend, carries no debt, and returns capital exclusively through buybacks. Since the programme began on 2018-02-12, it has repurchased 11.2 million shares for $1.3 billion. Board authorisations have been increased serially, most recently by $200M on 2026-02-05, bringing aggregate authorisation to $1.6 billion, with $306.6M remaining at 2026-03-31.

This is the rare software buyback that actually works. Cumulative repurchases of $1.2B against cumulative SBC of $438M means SBC absorbs only 36% of buyback dollars; the other 64% genuinely retires stock. Diluted share count fell from 41.3M to 36.5M over FY2019–25, and actual shares outstanding were 35,217,007 at 2026-04-22 — a real reduction of roughly 15%. Compare Tenable, whose $247.5M FY2025 buyback merely held the share count flat.

Execution quality is mixed, not brilliant. The largest year, FY2022’s $317.3M, was executed at prices well above the April 2026 low. Conversely, Q1 FY2026’s $53.5M was struck at roughly $106 per share against today’s $144.75 — the one clearly well-timed tranche in the record, and to management’s credit it was deployed into the panic rather than withheld. On balance the programme is steady-state rather than opportunistic: it spends roughly 60% of free cash flow every year regardless of price.

7.2 M&A — absence as a policy

Goodwill of $7.4M on a $1.09B balance sheet is effectively an M&A record of zero. Across the five-year filing corpus there is no acquisition 8-K.

This is a genuine two-sided fact. Positive: Qualys has destroyed no capital on integration failures, has no purchase-accounting distortions, no earn-outs, no goodwill impairment risk, and no acquired-revenue padding of its growth rate — every point of the 13.0% CAGR is organic. In a sector littered with expensive bolt-ons, that is discipline. Negative: the company has therefore bought none of the CNAPP or cloud-security capability its competitors acquired, and the result is visible — TotalCloud has been flat at 5% of bookings for a year. Google spent ~$32B on Wiz; Palo Alto has rolled up a platform; Tenable bought Eureka, Vulcan and Apex. Qualys built organically at 17.5% of revenue in R&D and did not keep pace in the fastest-growing adjacency. With $677M of net cash and no debt, the balance-sheet capacity to have done something existed and was not used.

7.3 Operating expense allocation — the concerning shift

R&D at 17.5% of revenue is respectable in absolute terms but small in dollars — $117M against Palo Alto’s and CrowdStrike’s multiples of that. More importantly, the direction of incremental spend has shifted decisively: in Q1 FY2026, sales and marketing grew 17% year over year (18% the prior quarter) while R&D grew approximately 2%, and management guided FY2026 opex growth to “mid-teens” with the increase weighted to sales and marketing and “more modest increases in engineering and G&A.”

This is the allocation decision we like least in the file. At precisely the moment management argues the product frontier is moving fastest — frontier models, agentic remediation, collapsing exploit windows — the company is re-weighting spend away from engineering and toward sales headcount, to produce 8–9% revenue growth, with sales productivity already acknowledged as sub-par. It is a defensible short-run response to a demand environment where the product is good and the pipeline is thin. It is a poor long-run response if the competitive threat is architectural.

7.4 Incentive alignment

Per the DEF 14A filed 2026-04-22:

• Annual cash bonus is earned on bookings, revenue growth and non-GAAP EPS.
• PRSUs vest annually over three years on revenue growth and adjusted EBITDA margin.
• RSUs vest over four years on service alone.

No capital-efficiency metric appears anywhere in the plan. There is no ROIC, no ROE, no free-cash-flow-per-share, and no relative total-shareholder-return modifier. Two specific consequences follow:

1. Non-GAAP EPS is mechanically improved by the buyback that the same management controls. Repurchasing 3% of the shares raises EPS ~3% with no operating improvement. Paying an annual bonus on a metric that management can move through the share count is a design flaw.
2. “Adjusted EBITDA margin” excludes the stock-based compensation that is the cost of the very awards being measured. The PRSU metric is calculated on a basis that ignores its own price.

To be fair, the chosen metrics are not gamed in practice — SBC is low and falling as a percentage of revenue, and the buyback genuinely retires shares. The design is weak; the outcome has been acceptable. But the plan pays for growth and accounting margin, not for returns on capital, and it is worth noting that the metric the plan does reward (revenue growth) has decelerated for four years while the executives have been paid.

Compensation levels. CEO Thakar’s 2025 compensation was $15.94M as reported (salary $616K, cash incentive $723K, long-term incentive grant-date value $14.60M), against an “intended” target of $17.39M. CFO Kim: $6.84M. Equity overhang at 2026-03-31 is 2,336,540 shares, ~7% of shares outstanding, with a three-year average gross burn of ~899,000 shares (~2.5% per year). Stockholders approved an amended and restated 2012 Equity Incentive Plan on 2026-06-10, replenishing the reserve. For a company with $669M of revenue and a $5.1B market capitalisation, a ~$16M CEO package is at the high end of reasonable but not an outlier for enterprise software.

7.5 Insider behaviour

Across 120 Form 4 filings since 2025-01-01, the record is unambiguous: zero open-market purchases (code P) by any insider. Total code-S sales were 82,598 shares for $10.44M, every one of them under a Rule 10b5-1 plan — CEO Thakar 69,600 shares ($8.92M), CLO Posey 5,996 ($0.71M), CFO Kim 3,623 ($0.42M), plus small director sales.

Planned selling under 10b5-1 is not a bearish signal on its own; it is diversification. What is a signal is the absence of buying. The stock fell 40% to $76.20 — a price at which the company was capitalised at roughly 11x guided free cash flow with $19 per share of net cash — and not one officer or director bought a share. The company itself bought $53.5M at ~$106. Set against Tenable, where two directors and the CFO bought at the lows, the contrast is pointed.

Verdict — capital allocation has been disciplined and shareholder-friendly, with two real defects. The positives are substantial and rare: no debt, no dividend trap, no value-destroying M&A, a buyback that actually shrinks the share count by 15%, low SBC, and trivial capex. The defects are (i) an incentive plan that rewards growth and adjusted margin but is silent on returns on capital and is partly self-referential through the buyback, and (ii) an allocation shift toward sales headcount and away from engineering at a moment of architectural change, funded by the first planned margin decline in seven years. Management has managed the harvest well. It has not yet demonstrated it can allocate capital to restart growth.

8. Changes and Headwinds — Last Two Years

8.1 Strategic and product

• Enterprise TruRisk Management (ETM) generally available (2025). The strategic repositioning from “vulnerability management” to “pre-breach cyber risk management.” ETM + CSAM reached 11% of LTM bookings by Q1 FY2026 (from 8%) and 14% of new bookings (from 9%).
• Q4 FY2025 product wave: ETM Identity (identity security), TruLens (industry-specific threat prioritisation) and TruConfirm (exploit validation).
• Agent Vail generally available (Q1 FY2026). Autonomous exploit validation plus remediation — the flagship of the “agentic AI risk fabric” story, and the specific capability the July rally was priced on.
• AI-powered patch reliability score. Trained on Qualys’s proprietary dataset of hundreds of millions of deployed patches to predict patch-induced outages. Potentially the most genuinely defensible new asset in the portfolio.
• Q-Flex consumption-credit purchasing model, in pilot, general availability planned late 2026.
• ROCon user-conference series launched, attendance up over 20%.
• Third-party recognition: leader in the Q1 2026 Forrester Wave for CNAPP; 2026 SC Award for Best Cloud Security Management; leader in the 2026 GigaOm CIEM report; #1 in the GigaOm Patch Management radar.
• AI partnerships: OpenAI early-access cyber programme; Anthropic cyber-verification programme.

8.2 Commercial and go-to-market

• Channel shift accelerating. Channel is now 52% of revenue (from 49%), growing 17% against direct at 3%. Nearly two dozen certified MRO (managed risk operations) partners.
• International outgrowing domestic. 15% versus 6% in Q1 FY2026; US revenue share down to 55%.
• Federal build-out. FedRAMP High status being advanced with large agencies; third annual federal conference held May 2026.
• New disclosure (Q1 FY2026): ETM/CSAM cohort net dollar expansion of 107%, introduced as management’s preferred indicator of the strategy’s success.

8.3 Financial and capital

• FY2026 guidance issued at +7–8% (2026-02-05) — the first sub-double-digit annual guide in the company’s recent history — then raised to +8–9% ($721–727M) on 2026-05-05 after a Q1 beat.
• Margin guidance reversed. FY2026 adjusted EBITDA margin guided to “mid-40s” from 47% achieved; free cash flow margin to “low 40s” from 45.5%. Opex to grow mid-teens.
• $200M buyback authorisation increase (2026-02-05), taking cumulative authorisation to $1.6B.
• Amended and restated 2012 Equity Incentive Plan approved by stockholders (2026-06-10).

8.4 The headwinds, named

1. The expansion stall. NDR pinned at 103–104% for two full years is the central headwind. Everything else is downstream of it.
2. Microsoft bundling. Defender Vulnerability Management shipped inside E5 at near-zero marginal price permanently caps pricing power in the core product.
3. The AI narrative cuts both ways and neither is in the numbers. February–April 2026 saw ~$2 trillion erased from software on the thesis that AI agents obsolete conventional enterprise software; the single worst session (2026-04-09) erased ~$1 trillion globally and took Qualys down 12.2%. June–July reversed the reading. Management’s guidance embeds neither: the CFO stated explicitly that guidance assumes no material change in net dollar expansion, and that AI announcements “could increase the sales cycle” as easily as increase sales.
4. Sales productivity deterioration. S&M +17–18% against revenue +8–9%, explicitly acknowledged by the CFO as below where it needs to be.
5. Cloud security stalled. TotalCloud flat at 5% of bookings while the category’s capital and growth concentrate there.
6. Macro and geopolitical caution. Management referenced “ongoing macro volatility” and “geopolitical conditions” as reasons for a conservative baseline, while noting no actual change in customer budgets to date.

8.5 What is not a headwind

Worth stating explicitly, because the peer set invites the assumption: there is no balance-sheet stress (net cash $677M, zero debt), no customer concentration risk (no customer >10%), no accounting concern, no litigation of disclosed materiality, no executive turnover, and no activist pressure (fifteen Schedule 13G filings in five years, zero 13Ds). Gross margins are expanding.

Verdict — the last two years have strengthened the product and weakened the growth thesis. The product portfolio is materially better than it was: exploit validation, autonomous remediation and the patch-reliability dataset are real capabilities that Tenable and Rapid7 do not match, and the third-party recognition is genuine. But the commercial translation has not happened — bookings mix has moved only a few points, expansion is flat, guidance decelerated below 10% for the first time, and margins are now being spent to buy growth. On net these developments weaken the thesis: the company has spent two years and considerable engineering effort building the answer to its growth problem, and the growth problem has not improved.

9. Risk Analysis

Verdict — the risk profile is one of chronic erosion, not acute failure. Risks 1, 2 and 3 are the thesis-relevant ones, they are correlated, they are all rated Medium-High-to-High likelihood, and they all resolve into the same observable metric: net dollar expansion. The tail risks that dominate most software names — leverage, customer concentration, accounting, going-concern — are essentially absent here. The realistic bad outcome is not losing money in a collapse; it is owning a well-run cash machine that grows 5% and de-rates slowly.

10. Valuation Discussion — Embedded Expectations

No price target and no recommendation appear in this section. Valuation is framed as what the current price requires.

10.1 The enterprise value, built from the filing

10.2 Multiples

10.3 Own-history context — and the percentile trap

The AZI valuation index places QLYS at the following percentiles of its own ~10-year range (2026-07-31):

GAAP earnings here are clean — no REIT structure, no in-process R&D, no acquisition distortion — so the P/E percentile is usable rather than misleading. Taken at face value, Qualys has been cheaper on earnings only ~7% of the time in a decade.

The trend that produced it, from ROIC.ai’s multi-year series:

This is where the analysis must be careful, because the percentile is the most-cited bull statistic and it is partly a trap. Qualys earned 50–75x earnings in 2016–2021 while growing 13–19% with operating margins of 15–27%. It now earns 26x while growing 8–9% with a 33% operating margin. A substantial part of that de-rating is the correct repricing of a decelerating grower, not a market error. The percentile measures distance from the stock’s own past; the past was a different growth regime and a different interest-rate regime. A 6.6th-percentile P/E on a business whose growth rate has halved is not automatically cheap — it may simply be accurately re-rated.

The defensible version of the percentile argument is narrower and better: the multiple has compressed while the margin structure and return on capital improved. Between FY2020 and FY2025, EV/sales halved (12.4x → 6.5x) while operating margin rose from 26.6% to 33.2% and ROIC from 19.3% to 31.4%. The market has paid progressively less for progressively better unit economics because it now expects less growth. Whether that trade is attractive depends entirely on whether 8% growth is the floor or a waypoint.

10.4 Peer context

Qualys is the most expensive of the three direct VM incumbents on revenue — and by a wide margin the only one that earns a real operating margin, generates honest owner free cash flow and holds net cash. The premium is earned. But it is a premium, and it means the “cheap versus peers” argument is not available: Qualys is cheap only versus its own history and versus the broader software complex, not versus its category.

10.5 Embedded expectations — the reverse discounted cash flow

Taking FY2026 guided free cash flow of approximately $304M (42% margin on $724M) against an enterprise value of $4,444M, and solving a perpetuity for the growth rate the current price requires:

The market is embedding roughly GDP-level perpetual free-cash-flow growth. For context, Qualys compounded free cash flow at 15.4% annually over the last six years, holds a mandatory-purchase compliance demand floor, earns 31.4% ROIC on an asset-light base, and is guided to +8–9% revenue growth this year.

This is the single strongest quantitative fact in the bull case, and it deserves to be stated plainly: at $144.75 the price does not require Qualys to solve its growth problem. It requires only that Qualys not shrink.

The equally important offset: the bar is undemanding because the market has concluded the expansion engine is broken, and 103–104% NDR against a free Microsoft substitute is a coherent basis for that conclusion. A 2–3% perpetuity is not obviously wrong for a franchise whose installed base expands three points a year. The reverse DCF tells you the price is not demanding; it does not tell you the assumption is wrong.

10.6 Scenario analysis

Five-year forward scenarios, all discounted at 10% with a terminal perpetuity, expressed as enterprise value:

Assumptions are explicit and are the analyst’s own; they are not company guidance. Enterprise values convert to equity value by adding $677M of net cash.

The distribution is roughly symmetric in magnitude — a ~30% downside against a ~50% upside — but asymmetric in probability, because the base case requires nothing to change and the bull case requires a demonstrated inflection in a metric that has not moved in two years.

10.7 What the market is pricing correctly and incorrectly

Correctly: that growth has decelerated to single digits and is unlikely to re-accelerate sharply; that net dollar expansion of 103–104% caps the value of the installed base; that Microsoft’s bundling permanently limits pricing power in core VM; that the cloud-security opportunity has been forfeited to better-capitalised competitors.

Possibly incorrectly: the quality of what remains. The market appears to price Qualys as a mildly better Tenable. On owner economics it is a categorically different business — 33.2% versus −0.9% GAAP operating margin, 11.5% versus 19.2% SBC, 34% versus ~6% owner free cash flow margin, +$677M versus flat net cash, and a buyback that shrinks the share count 15% rather than holding it flat. If the terminal question is “how much cash can this franchise return to owners while its category matures,” Qualys’s answer is far better than its comparables’ and arguably better than a 2–3% perpetuity implies.

Verdict on valuation. At $144.75 Qualys trades at 6.1x forward revenue, 14.6x forward free cash flow, ~19.6x owner free cash flow, and 19.2x forward non-GAAP earnings (16.6x ex-net-cash), against a reverse-DCF bar of 2–3% perpetual growth. That is a fair price for a high-quality, low-growth, cash-generative franchise — neither the bargain it was at $76.20 in April (where the same maths implied roughly 11x forward free cash flow and a negative embedded growth rate) nor an obviously stretched multiple. The valuation offers no margin of safety for the bear case and no requirement of heroics for the base case. It is priced approximately right for what it is.

11. Variant Perception

11.1 What consensus believes

Consensus in mid-2026 has moved from despair to cautious constructiveness in eight weeks. The prevailing view now: Qualys is a structurally challenged but well-run vulnerability-management incumbent whose valuation had overshot to the downside, which has re-rated on credible exposure to the AI-remediation theme; growth is 8–9%, margins are best-in-class, and the balance sheet removes downside risk. JPMorgan’s move from Underweight to Neutral with a target of $139 (from $87) is the cleanest expression: the sell side is no longer bearish, and is not yet bullish.

11.2 The strongest bull case

Qualys is the only vulnerability-management incumbent that is a genuinely good business, and it is priced as though it is merely the least-bad one.

The argument, in sequence: (i) the compliance floor makes revenue extraordinarily durable — PCI-DSS, FedRAMP, HIPAA and cyber-insurance all require documented scanning, so the base does not churn; (ii) the cost position is structural, not cyclical — 70% of employees in India supports 82.8% gross margins and 33.2% operating margins that competitors at 1.5x the revenue cannot match; (iii) the cash is honest — SBC at 11.5% of revenue leaves owner free cash flow at 34% of revenue, and the buyback has retired 15% of the shares rather than absorbing dilution; (iv) the price embeds only 2–3% perpetual growth against a 15.4% six-year FCF CAGR; (v) the strategic bet is beginning to show — ETM/CSAM bookings share went 8% → 11%, new-bookings share 9% → 14%, and the ETM/CSAM cohort expands at 107% versus 104% company-wide; (vi) if AI genuinely collapses the exploit window, the scarce asset becomes trusted autonomous remediation at scale, and Qualys is the only VM incumbent that closes that loop inside its own agent, with 150 million patches of proprietary outcome data to train on; (vii) at $4.4B enterprise value with net cash and 34% owner-FCF margins, Qualys is an obvious strategic or private-equity target.

11.3 The strongest bear case

Qualys is a high-quality harvest asset whose expansion engine is permanently broken, that has just been re-rated 90% on a narrative its own management declines to put in guidance.

The argument: (i) net dollar expansion has been 103–104% for two years — the installed base does not expand, which is the mechanism by which software companies compound; (ii) the cause is structural, not cyclical — Microsoft ships adequate VM free inside E5, which caps price permanently regardless of product quality; (iii) the pivot has not worked commercially — ETM+CSAM is 11% of bookings after a five-year CSAM runway, Patch Management’s new-bookings share fell from 16% to 15%, and TotalCloud has been flat at 5% for a year; (iv) the company is now buying growth — S&M +17% for revenue +8–9%, with the first planned margin decline in seven years (EBITDA 47% → mid-40s, FCF 45.5% → low-40s) and the CFO conceding productivity is below target; (v) the July re-rate was a single analyst upgrade to Neutral plus basket beta — the FY2026 revenue midpoint moved $3M across a -40%/+90% round trip; (vi) management embeds none of the AI upside in guidance and explicitly warned that AI announcements “could increase the sales cycle”; (vii) insiders sold $10.4M and bought nothing at $76.20; (viii) the direct comparable, Rapid7, is being priced at 0.77x sales, which is what the market does to a subscale VM vendor once profitability goes.

11.4 The 3–5 assumptions that actually matter

1. Does net dollar expansion inflect above ~108%? Everything resolves here. At 103–104% Qualys is a bond with a call option; at 110%+ it is a compounder and the multiple is wrong by half.
2. Is Microsoft’s bundling a price cap or a demand destroyer? Evidence so far says cap, not destroyer — gross margins are still expanding and the customer base is stable. If it becomes a destroyer, the bear case is too conservative.
3. Does autonomous remediation become a budgeted line item, or stay a feature? The technical case is strong; the commercial evidence (8% of bookings, declining new-bookings share) is not.
4. Is the India cost advantage durable? It has produced a 34-point operating-margin gap versus the nearest comparable and it is the least-discussed part of the story. Indian wage inflation in senior engineering roles is the risk.
5. Is 8% the floor or a waypoint? The reverse DCF only needs ~3%. But the trajectory over five years has been monotonically downward, and the domestic direct business is already growing 3–6%.

11.5 Falsification tests

11.6 The positioning read

FactorsToday prices Qualys as primarily a cybersecurity-industry beta vehicle: industry loading 1.167 against a market loading of only 0.707 in the same (All Factors) model, with R² of 0.348 and idiosyncratic volatility of 42.1% annualised. Alpha is −0.143. The risk-adjusted track record is the tell: three-year annualised return +1.8% with a Sharpe of approximately zero, a one-year maximum drawdown of −50.5%, and a ten-year maximum drawdown of −63.0%. The three-month figure — an annualised +6.15, or roughly +64% for the quarter — is not a data error; it is the April-to-July snapback, and it is the fourth violent directional move this stock has made in five years.

The positioning conclusion is that this is not a momentum compounder and never has been. It is a high-idiosyncratic-volatility, range-bound, basket-correlated name that has round-tripped twice in five years and is currently in the upper half of its own range after a 90% move. Consensus is not crowded long — the sell side has just arrived at Neutral — but it is no longer offsides bearish either. The market’s mistake in April was despair; the risk in August is that the correction of that despair has been extrapolated into an inflection that management’s own guidance does not contain.

Where consensus may still be wrong: in continuing to bucket Qualys with Tenable and Rapid7 on category while ignoring the owner-economics gap. A business converting 34% of revenue to SBC-honest free cash flow with 31% ROIC, no debt, $19/share of net cash and a share count falling 15% is a different terminal asset from two competitors earning approximately nothing. That is the durable variant perception. It is largely a quality variant, not a growth variant — and quality variants get paid slowly.

12. Fact vs. Interpretation

13. Open Questions

1. What is the ETM/CSAM cohort’s size? Management disclosed the cohort’s 107% NDR but not what share of revenue or customers it represents. Without the denominator, the metric cannot be used to forecast company NDR. (Highest-value single disclosure the company could make.)
2. What is the organic uplift when a customer adopts ETM? The CFO stated it is “a little too early to comment on how much of the uplift actually is” and that the illustrative $1.00 → $3.00 ladder is based on list price. Realised uplift is unknown.
3. What fraction of the base is exposed to Microsoft E5 bundling, and has any customer actually downgraded? No disclosure exists. This is the central bear mechanism and it is entirely un-quantified from outside.
4. What is the gross retention rate? Only net dollar expansion is disclosed. A 103% net figure could be 98% gross with 5 points of expansion, or 92% gross with 11 points — radically different businesses. Peers commonly disclose gross retention.
5. Why is TotalCloud flat at 5% of bookings? Is this a product-capability gap, a go-to-market gap, or a deliberate decision to cede CNAPP? Management has not addressed it directly despite the Forrester Wave leader placement.
6. What is the federal business worth? Management calls it “a new leg of growth” with FedRAMP High authorisation, but provides no revenue, pipeline or contract-vehicle sizing.
7. How does Q-Flex affect revenue recognition and predictability? A consumption-credit model with product-swapping rights may change the timing and RPO characteristics of the book. No accounting discussion has been offered.
8. Is the sales-productivity decline cyclical or structural? S&M has grown 17–18% for two quarters against 8–9% revenue. Management says productivity “is not exactly where we think it will be.” At what point does the investment get cut?
9. What is the patch-outcome dataset actually worth? Hundreds of millions of patch outcomes training an outage-prediction model is the closest thing to a genuine data moat in the story, and it is entirely unquantified and unmonetised as a standalone.
10. Why did no insider buy at $76.20? The absence is notable but not self-explaining; blackout windows around the Q1 print may account for part of the April period.
11. What is the India wage-inflation exposure? 70% of headcount in one country underpins the entire margin advantage; the 10-K discusses international risk generically but does not quantify wage sensitivity.
12. Is management contemplating M&A? With $677M of net cash, zero debt and a stalled cloud-security position, the absence of any acquisition discussion is conspicuous.

14. What Must Be True

14.1 For the bull case

14.2 For the bear case

14.3 The single decisive metric

Both cases collapse into one disclosed number: net dollar expansion rate. It has been 103%, 103%, 104% across FY2024, FY2025 and Q1 FY2026. If it breaks decisively above 108%, the bear case is wrong and the current valuation is too low. If it slips below 102%, the bull case is wrong and 6.1x forward revenue has no support. Every other argument in this report — the moat type, the cost advantage, the AI narrative, the buyback, the percentile — is a mechanism for explaining or forecasting that one number. The next print is 2026-08-04.

15. Source Appendix

Full source detail, with URLs and access dates, appears in Appendix B. Primary sources relied upon:

SEC filings (primary)

• Form 10-K for FY2025, filed 2026-02-20 (and FY2021–FY2024 10-Ks)
• Form 10-Q for Q1 FY2026, filed 2026-05-05 (and the trailing 15-quarter series)
• Form 8-K, 2026-02-05, with Exhibit 99.1 (Q4/FY2025 results; initial FY2026 guidance; $200M buyback authorisation increase)
• Form 8-K, 2026-05-05 (Q1 FY2026 results and revised guidance)
• Form 8-K, 2026-06-11 (stockholder approval of the amended and restated 2012 Equity Incentive Plan)
• DEF 14A, filed 2026-04-22 (compensation design, equity overhang, burn rate)
• Forms 3/4/5 — 120 Form 4 filings reviewed for the period 2025-01-01 to 2026-07-21
• Schedules 13G/13G-A — 15 filings over five years; no Schedule 13D

Company communications

• Q1 FY2026 earnings call transcript, 2026-05-05
• Q1 FY2026 investor presentation and prepared remarks

Market and quantitative data

• AZI (azitrading.com) daily price history through 2026-07-31; AZI valuation index (own-history percentiles)
• ROIC.ai: income statement, balance sheet, cash flow, profitability ratios, enterprise value, valuation multiples (NASDAQ:QLYS, NASDAQ:TENB, NASDAQ:RPD)
• FactorsToday: stock loadings, leaderboard, stock info, specific volatility, related stocks (2026-07-31)

Financial and trade press (secondary; used only for event attribution and corroboration)

• Reporting on the 2026-02-06 guidance-driven decline and the 2026-04-09 software selloff
• Reporting on JPMorgan’s late-June 2026 upgrade of QLYS from Underweight to Neutral (target $87 → $139)
• Reporting on Q1 FY2026 results and the large-customer cohort disclosure (221 accounts ≥$500K, ~$293M)

APPENDIX A — Standard Diligence Questionnaire

Qualys, Inc. (NASDAQ: QLYS) · Report date 2026-08-01 · Price reference ~$144.75 (close 2026-07-31)

Supplemental to the main analysis. Answers carry Fact / Interpretation / Assumption labels where the distinction matters. The Greenwald “Competition Demystified” and Marathon “Capital Returns” frameworks are applied where they add insight.

General

What thoughtful questions have other investors asked about this company?

The Q1 FY2026 call is a good sample of where the sophisticated debate actually sits, and it is notably not about the product:

• Scotiabank (Patrick Colville): whether the AI-model hype is producing real inbounds and how those translate into the 2026 financial model. Management’s answer: engagement is positive, “a little too early right now to talk about how the impact is going to be on the pipeline and outlook,” and no change to guidance. He followed up to confirm the 7–8% current-billings guide was unchanged. It was.
• Jefferies (Joseph Gallo) and Kothari: the timeline for total net dollar expansion to accelerate, given the ETM cohort is at 107% and total is at 104%. Management: ETM adoption is early, no material NDR movement is assumed in 2026.
• D.A. Davidson (Rudy Kessinger): precisely how the 107% cohort metric is constructed (it includes total spend by customers who held ETM or CSAM subscriptions a year earlier, not just their ETM spend), and — separately — what sales productivity looks like given S&M is outgrowing revenue. The CFO conceded productivity “is not necessarily the traditional SaaS feel of it… I’m not seeing it there yet.”
• UBS (Roger Boyd): attach rates for Patch Management and TruRisk Eliminate on new logos. Answered qualitatively, with bookings percentages rather than attach rates.
• JPMorgan (Brian Essex): where frontier-model vulnerability discovery is best placed across OS/infrastructure/custom-app/OT, and how that changes the customer risk profile — the most substantive product question asked.
• William Blair (Jonathan Ho): what makes Qualys better positioned than competitors in “pre-breach risk management.”

The pattern is unmistakable: analysts are asking about expansion, productivity and monetisation, not about product capability. The product is not in dispute; the ability to charge more for it is. A second recurring investor question, outside the call, is whether Qualys is a takeout candidate — a $4.4B enterprise value with 34% owner-FCF margins and net cash is an obvious private-equity or strategic target.

Cyclicality & Earnings Nature

Are earnings at a cyclical high or low? Interpretation: neither — earnings are at a structural high on a decelerating revenue base. Operating margin has risen every year from 18.1% (FY2018) to 33.2% (FY2025), and Q1 FY2026 hit 34.7%. This is not cyclical; it is seven years of deliberate operating leverage in a business with minimal capital intensity. The important nuance is that FY2026 is the first guided margin decline in seven years — adjusted EBITDA margin to “mid-40s” from 47%, FCF margin to “low 40s” from 45.5%. So earnings are at a high, and management has told us the next print is lower by design.

Driven by the external environment or internal actions? Fact: overwhelmingly internal. The margin expansion came from gross-margin improvement (76.3% → 82.8% over seven years) and disciplined opex growth against a 70%-India cost base. There is no commodity input, no rate sensitivity, no FX translation of consequence (55% US revenue, and reporting is in USD), and no cyclical demand driver. Cybersecurity budgets have been the most defended line in enterprise IT through two downturns.

How stable are revenues? Fact: exceptionally stable. Essentially 100% subscription, >10,000 customers, no customer above 10% of revenue in any of 2023/2024/2025, and a compliance mandate (PCI-DSS, FedRAMP, HIPAA, cyber-insurance underwriting) that makes vulnerability scanning a required purchase rather than a discretionary one. Quarterly revenue has risen sequentially in essentially every quarter for years. The stability is the reason net dollar expansion is 103% and not 90% — customers renew; they simply do not expand.

Outlook for products/services? Core vulnerability management (~50% of bookings) is mature and under bundling pressure. The growth products — ETM/CSAM (11% of bookings, from 8%), Patch Management (8%), TotalCloud (5%, flat) — are improving in mix but from a small base. Interpretation: the outlook is for continued single-digit growth with mix shifting slowly toward the newer layers; the product roadmap (exploit validation, autonomous remediation, the patch-reliability model) is genuinely ahead of Tenable and Rapid7, and genuinely behind the platform vendors on cloud.

How big will this market be — growing, shrinking, domestic or international? Fact: Qualys’s own international revenue is growing 15% against 6% domestically, and US revenue share has fallen 60% → 55% in three years. Interpretation: the addressable market for exposure management is growing, but the profit pool available to a standalone VM vendor is flat-to-shrinking as it is absorbed into platform suites. The market is increasingly international for Qualys specifically, because the US market is the most penetrated and the most exposed to Microsoft bundling.

Business Quality & Competitive Moat

Is the industry getting more or less competitive? More — decisively. The FY2025 10-K names CrowdStrike, Palo Alto Networks, Rapid7, Tenable, Invicti, Tanium and Wiz (now inside Google). The competitive pressure is not primarily from peers but from above: Microsoft Defender Vulnerability Management ships inside E5 at near-zero marginal price, and CrowdStrike and Palo Alto both market exposure management from a platform position. Interpretation: the mechanism is not share loss — it is price capping. An adequate free substitute inside a suite the customer already owns permanently limits what a standalone vendor can charge, regardless of product superiority.

How profitable is the business (ROIC, ROE)? Fact: FY2025 ROIC 31.4%, ROE 38.2%, ROA 19.2%. ROIC has exceeded 30% for three consecutive years (38.1% in FY2023, 33.7% FY2024, 31.4% FY2025) on an asset-light base with $5M of annual capex. Interpretation (Greenwald): sustained ROIC at 3x cost of capital is prima facie evidence of a genuine barrier to entry. Two honest caveats: the equity denominator is shrinking from buybacks, which flatters ROE; and ROIC is declining from its FY2023 peak as the company reinvests in sales capacity.

How profitable is the industry — how many competitors, what barriers to entry? Fact: the industry is bifurcated in profitability to an extraordinary degree. Qualys earns a 33.2% GAAP operating margin; Tenable earns −0.9% and Rapid7 approximately +1.3% on comparable or larger revenue bases. Barriers to entry into vulnerability management are low technically (signature libraries and scanners are reproducible) but moderate commercially (agent deployment across an estate, accumulated compliance evidence, auditor familiarity, and FedRAMP-class certifications that take years).

Interpretation (Greenwald taxonomy): Qualys’s advantage is (a) a brand/installed-base intangible with moderate customer captivity — the same type Tenable owns in Nessus — plus (b) a genuine structural cost advantage from a 70%-India workforce. Type (b) is the more durable and the less discussed; it is the mechanical explanation for a 34-percentage-point operating-margin gap versus the nearest comparable. It is not a network effect: one customer’s scan data does not measurably improve the product for another, and the 10-K makes no such claim.

Interpretation (market-share stability test): relative shares among Qualys, Tenable and Rapid7 have been broadly stable — but all three are decelerating into single digits together. Stable shares of a stagnating pool is evidence of a mature oligopoly, not a fortress.

Interpretation (Marathon capital-cycle test): capital is flowing out of legacy VM (all three incumbents in buyback-and-harvest mode; no new entrants; no venture funding) and into the CNAPP/AI-native frontier (Google’s ~$32B Wiz acquisition). Two-sided read: no new capacity is being added to Qualys’s specific niche, which protects near-term pricing and explains why gross margins are still expanding — a classic favourable supply-side setup. But the budget line above it is being absorbed by better-capitalised platforms, so the harvest is on a shrinking base of addressable spend.

Can the business be easily understood? Yes. Find security holes, rank them by real risk, fix them. Single reporting segment, one platform, subscription pricing by asset and module, no acquisitions to unpick, no financing arm, no leases of consequence, no purchase accounting. This is among the cleaner enterprise-software P&Ls one will encounter.

Can it be undermined by foreign low-cost labour? Fact: Qualys is the low-cost-labour play. 78% of employees are outside the US and 70% are in India, with additional R&D in France. Interpretation: rather than being threatened by offshore labour, Qualys has already captured that advantage — which is precisely why it earns 33% operating margins where US-centric Tenable earns nothing. The correct inversion of the question is: what happens if Indian senior-engineering wage inflation erodes the gap? That is a real, unquantified risk with 70% of headcount in a single jurisdiction, and the 10-K does not size it.

Do brands matter? Moderately. In security procurement, an incumbent scanner whose reports auditors already accept carries real weight, and Qualys has two decades of that. But brand does not command a price premium here — the 103% NDR proves it. Analyst-firm placements (Forrester Wave CNAPP leader, #1 in the GigaOm Patch Management radar, 2026 SC Award) are useful sales credentials rather than pricing power.

What is the nature of competition? Increasingly bundling and consolidation, not head-to-head feature competition. Qualys wins product bake-offs (as the third-party recognitions suggest) and still cannot expand its base beyond 104%. The competition is for the budget line, and it is being fought one layer up the stack.

Customers’ switching costs? Interpretation: real but moderate. Agents are deployed across the estate; multi-year scan history and compliance evidence live inside the platform; security teams are trained on the workflows; auditors have seen the reports. Replacing Qualys is a project, not a decision — which is why gross retention is presumably high. But the switching cost is clearly not high enough to support price increases, or NDR would exceed 103%. The switching cost protects the renewal, not the price. A structural erosion risk: the channel now carries 52% of revenue, growing 17% against direct at 3%, which over time interposes a partner between Qualys and the end customer and weakens the direct relationship the switching cost depends on.

Financial Condition & Balance Sheet

Assets not fully recognised on the balance sheet? Yes, several of consequence:

• The customer base itself. >10,000 customers including a majority of the Forbes Global 100, built organically over 25 years, with essentially zero acquired goodwill ($7.4M). The economic value of that installed base appears nowhere on a $1.09B balance sheet.
• The patch-outcome dataset. Management describes hundreds of millions of deployed patches used to train an outage-prediction model. Interpretation: this is the closest thing in the story to a genuine data moat and it carries no book value.
• The threat-research signature library, built and expensed over two decades.
• 52 issued patents (expiring 2029–2044) plus an exclusive licence to four US patents, carried at negligible value.
• FedRAMP High authorisation, a multi-year regulatory asset.

Off-balance-sheet liabilities? Fact: minimal and disclosed. The only meaningful item is $52.2M of finance and operating lease obligations (already recognised under ASC 842). There is no debt, no pension, no securitisation, no variable-interest entity, no material purchase commitment disclosed beyond shared cloud-platform agreements running to 2030. One genuine concentration to flag: the platform runs on 15 shared cloud platforms operated by large third-party vendors across the US, Canada, Switzerland, Netherlands, UAE, Australia, UK, Italy, Saudi Arabia and India — a low-likelihood, high-impact operational dependency rather than a financial liability.

How conservative is the accounting? Interpretation: conservative, and unusually clean. Specific checks performed and passed:

• No acquisition accounting distortions (goodwill $7.4M, intangibles $11.1M — nothing to step up or impair).
• No tax one-timers. Effective rate 15.1% → 17.2% → 19.7% over FY2023–25, trending up toward normal, so recent EPS growth is not tax-manufactured. No valuation-allowance release.
• Negligible software capitalisation — SBC is reported net of capitalised amounts and the difference was $17K in Q1 FY2026 ($19,357K gross vs $19,340K net).
• Short-duration RPO ($518.0M against $669.1M revenue, 0.77x) with no lengthening backlog flattering the numbers.
• Cash conversion of 1.56x operating cash flow to net income (FY2025).
• Notably, Qualys guides and reports GAAP prominently and its non-GAAP adjustments are essentially SBC plus small intangible amortisation — no “adjusted” restructuring parade.

How CapEx-hungry is the business? Fact: barely at all. FY2025 capex $5.0M = 0.7% of revenue; FY2026 guided to $8–12M. Contrast with FY2019–2020 when capex ran $27–32M as the company built out its own infrastructure. The shift to third-party shared cloud platforms converted capital intensity into operating cost, which is why free cash flow margin reached 45.5%.

Capital Allocation & Management

How much FCF does the business generate, how does management use it, what is the philosophy? Fact: FY2025 free cash flow $304.4M (45.5% margin). SBC-honest owner free cash flow $227.4M (34.0% margin). The philosophy is simple and consistent: no dividend, no debt, no M&A, and roughly 60% of free cash flow returned via buyback every year, with the remainder accumulating in marketable securities (now $729.3M of cash and investments).

Significant acquisitions recently? Fact: none. Goodwill of $7.4M on a $1.09B balance sheet, and no acquisition 8-K in the five-year corpus. Interpretation — genuinely two-sided. Positive: no capital destroyed, no integration risk, no acquired-revenue padding, and every point of the 13.0% six-year revenue CAGR is organic. Negative: the company has bought none of the CNAPP capability its competitors acquired, and TotalCloud has been flat at 5% of bookings for a year. With $677M of net cash and no debt, the capacity to act existed and was not used.

Buying back shares? Fact: yes, and — unusually for enterprise software — it works. Since February 2018: 11.2 million shares for $1.3 billion; aggregate authorisation $1.6B after a $200M increase on 2026-02-05, with $306.6M remaining at 2026-03-31. Diluted shares fell from 41.3M (FY2019) to 36.5M (FY2025), and actual outstanding was 35,217,007 at 2026-04-22 — a genuine ~15% reduction. Cumulative FY2019–Q1 2026 repurchases of ~$1.21B against cumulative SBC of ~$438M means SBC absorbs only 36% of buyback dollars; the rest genuinely retires stock. This is the single clearest contrast with Tenable, whose $247.5M FY2025 buyback merely held the share count flat.

Execution quality — Interpretation: steady-state rather than opportunistic. The largest year (FY2022, $317.3M) was struck well above the April 2026 low. To management’s credit, Q1 FY2026’s $53.5M was deployed into the panic at roughly $106 per share, against today’s $144.75 — the one clearly well-timed tranche.

Issuing large amounts of new shares to insiders? Fact: no — SBC is low for the sector. $77.0M in FY2025 = 11.5% of revenue, versus Tenable’s 19.2% and a cohort norm of 20–30%; and it is flat in dollars year over year ($77.1M → $77.0M) while revenue grew 10%. Equity overhang at 2026-03-31 was 2,336,540 shares (~7% of shares outstanding); three-year average gross burn ~899,000 shares (~2.5%/yr). Stockholders approved an amended and restated 2012 Equity Incentive Plan on 2026-06-10, replenishing the reserve — routine, but worth monitoring.

Compensation policy of directors/management? Fact (design): annual cash bonus on bookings, revenue growth and non-GAAP EPS; PRSUs vesting annually over three years on revenue growth and adjusted EBITDA margin; RSUs vesting over four years on service.

Interpretation — the design is weak in two specific, identifiable ways:

1. No capital-efficiency metric appears anywhere — no ROIC, no ROE, no FCF-per-share, no relative TSR modifier. For a company whose entire investment merit rests on 31% returns on capital, that is a meaningful omission.
2. Two of the metrics are partly self-referential. Non-GAAP EPS is mechanically improved by the buyback the same management controls (retiring 3% of shares lifts EPS ~3% with no operating improvement), and “adjusted EBITDA margin” excludes the stock-based compensation that is the cost of the very awards being measured.

In fairness, the outcome has been acceptable — SBC is low and falling as a share of revenue, and the buyback genuinely retires stock — so the metrics have not been gamed in practice. But the plan pays for growth and accounting margin, not for returns on capital; and the metric it does reward (revenue growth) has decelerated for four consecutive years while executives were paid.

Fact (levels): CEO Sumedh Thakar’s 2025 compensation was $15.94M as reported (salary $616,167; cash incentive $723,377; long-term incentive grant-date value $14,597,565), against an “intended” target of $17.39M. CFO Joo Mi Kim: $6.84M. Chief Legal Officer Bruce Posey: $4.21M. For a $669M-revenue, $5.1B-market-cap software company, a ~$16M CEO package is at the high end of reasonable but not an outlier.

Motivations of management? Fact: CEO Thakar is a 20-year Qualys engineer who rose through Chief Product Officer to CEO in 2021 — an insider builder, not a hired operator. His public framing is relentlessly product-and-category-focused (“pioneering a new category in pre-breach risk management”), and the last two years of product output (ETM, TruConfirm, Agent Vail, the patch-reliability model) show genuine engineering ambition.

Interpretation: the incentive structure and the observed behaviour align management with growth and reported margin, which is broadly the right direction. Two cautions. First, insider selling with no offsetting buying: across 120 Form 4 filings since 2025-01-01 there were zero open-market purchases and $10.44M of Rule 10b5-1 sales (CEO $8.92M, CFO $0.42M, CLO $0.71M). Planned selling is diversification, not a signal — but the stock fell 40% to $76.20, a price at which the company traded near 11x forward free cash flow with $19/share of net cash, and not one officer or director bought a share, while the company itself bought at ~$106. Tenable’s insiders bought at their lows. Second, the re-weighting of incremental spend toward sales headcount (+17%) and away from engineering (+2%) at a moment of architectural change suggests a management team optimising for the next few quarters’ bookings metric.

Valuation & Market Data

Is the stock an ADR, MLP, or K-1 issuer? No. Qualys, Inc. is a Delaware corporation with common stock, $0.001 par value, listed on NASDAQ under QLYS (CUSIP 74758T303, ISIN US74758T3032). Ordinary Form 1099 tax reporting; no K-1, no ADR structure, no partnership. Secondary listings exist in Germany and Milan (BX/GETTEX: 3L7A; MIL: 1QLYS), which are venue listings rather than depositary structures.

Dividend policy? Fact: none, and none contemplated. Capital return is 100% buyback. Given a 31% ROIC and a share count that is genuinely shrinking, this is the correct policy — a dividend would be a worse use of the same dollar.

How profitable is the business? FY2025: gross margin 82.8% (seven consecutive years of expansion), GAAP operating margin 33.2%, GAAP net margin 29.6%, adjusted EBITDA margin 47%, FCF margin 45.5%, owner FCF margin 34.0%, ROIC 31.4%, ROE 38.2%. Q1 FY2026: gross margin 82.9%, GAAP operating margin 34.7%. Incremental operating margin in FY2025 was 56.5% — 56 cents of every incremental revenue dollar reached operating income.

Is net income diverging from cash from operations? Fact: no — cash flow comfortably exceeds net income, in the healthy direction. FY2025 operating cash flow $309.4M against net income $198.3M = 1.56x. The bridge is ordinary and clean: SBC $77.0M, depreciation and amortisation $14.5M, deferred taxes $8.4M, and $13.4M of working-capital release driven by deferred-revenue growth. There is no receivables build masking revenue quality — accounts receivable moves seasonally with Q4 billings ($171.0M at Q4 FY2025 → $134.9M at Q1 FY2026, a $35.9M collection) and does not trend adversely against revenue.

One item to watch: Q1 FY2026 free cash flow margin fell to 53% from 67% in the prior-year quarter, and FY2026 FCF margin is guided down to “low 40s” from 45.5%. This is a deliberate spending decision, not a conversion problem — but it means the cash-flow line will not grow with revenue this year.

Valuation summary (at $144.75, 2026-07-31): market capitalisation ~$5,121M; net cash $677.1M ($19.14/share); enterprise value $4,444M. On FY2026 guidance: 6.14x EV/revenue, 13.6x EV/EBITDA, 14.6x EV/FCF (6.8% yield), ~19.6x EV/owner-FCF, 19.2x P/E on non-GAAP EPS (16.6x ex-net-cash). Own-history percentiles: P/E 6.6th, P/S 14.2nd, P/B 28.3rd, composite 16.4th. A reverse DCF at a 10% cost of capital implies ~3% perpetual FCF growth.

Risks & Downside

What factors would cause the stock to decline? In descending order of probability-weighted impact:

1. Net dollar expansion slipping below ~102%, confirming the base is contracting rather than merely flat. This is the decisive metric.
2. FY2027 guidance below 7% while sales and marketing continues to grow mid-teens — spending more to grow less, which reverses the margin story with no growth offset.
3. ETM/CSAM bookings share stalling at 11–13%, proving the pivot substitutes for eroding VM dollars rather than adding to them.
4. A renewed AI-disruption de-rating. The April 9, 2026 session erased ~$1tn of global software value and took QLYS down 12.2%; the “SaaSpocalypse” removed ~$2tn across 2026. The stock’s cybersecurity-industry factor loading of 1.167 (versus a market loading of 0.707) means it participates fully in any repeat.
5. Sentiment reversal on the July re-rate. The +90% move off $76.20 was driven substantially by JPMorgan’s upgrade to Neutral with a $139 target while FY2026 revenue guidance moved $3M. Narrative-driven multiples unwind quickly.
6. Gross-margin reversal — the first sign that Microsoft bundling has moved from capping price to forcing concessions.

Risk of a catastrophic loss? Low, with one genuine tail. The financial tail risks that dominate the peer group are absent: $677M of net cash and zero debt (Rapid7, by contrast, carries $965M of debt against a $368M market capitalisation), a 33.2% GAAP operating margin, no customer above 10% of revenue, no accounting concerns, no material litigation, no going-concern question, and no activist or leverage pressure (fifteen Schedule 13G filings in five years, zero 13Ds).

The one genuine catastrophic scenario is a security breach of Qualys itself. A vendor holding the complete, current vulnerability inventory of a majority of the Forbes Global 100 is a maximally attractive target, and a compromise exposing customer vulnerability data would be existential for trust in a way no financial metric captures. No such incident is disclosed. A second, lower-probability structural tail is the third-party cloud dependency — 15 shared platforms across 10 countries.

Chance of a total loss? Very low — effectively de minimis absent fraud or an existential breach. The business generates $304M of free cash flow, converts 34% of revenue to SBC-honest owner cash flow, holds $19.14/share of net cash against a $144.75 share price, has no debt maturities, and sells into a regulatorily mandated demand floor with >10,000 customers on annual renewals. Even in a severe bear case where growth falls to 3% and margins compress, the enterprise remains profitable and cash-generative. The realistic bad outcome is chronic underperformance — a well-run cash machine that grows 5% and de-rates slowly — not impairment of capital.

Recent News & Events

Has the business environment changed recently? Yes, twice, in opposite directions, within five months — and the fundamentals barely moved.

• February–April 2026 (negative). FY2026 guidance was issued on 2026-02-05 at $717–725M (+7–8%), the first sub-double-digit annual guide in recent company history, with a non-GAAP EPS midpoint of $7.31 that missed consensus. The stock fell 13.3% on 2026-02-06. That company-specific disappointment was then compounded by the sector-wide “SaaSpocalypse” — approximately $2 trillion erased from software stocks on the thesis that AI agents would obsolete conventional enterprise software, with the single worst session on 2026-04-09 erasing ~$1 trillion globally (Cloudflare −12%, Snowflake −9%, ServiceNow −7%). QLYS fell 12.2% that day and bottomed at $76.20 on 2026-04-10, a five-year low and a 40% decline from the pre-print level.
• May–July 2026 (positive). Q1 FY2026 (2026-05-05) beat, with revenue of $175.6M (+9.8%) against a guide of +8–9%, and guidance was raised to $721–727M (+8–9%). Then in late June, JPMorgan upgraded QLYS from Underweight to Neutral with the price target raised from $87 to $139, and the shares gained 24.4% over six sessions (June 25 – July 2), running to $164.12 on 2026-07-14 before fading to $144.75 by month-end — a +90.0% total recovery from the low.

Interpretation — the essential fact. Across that entire −40%-then-+90% round trip, the FY2026 revenue guidance midpoint moved from $721M to $724M. A $3 million raise, or 0.4%. The environment as management describes it changed hardly at all: the CFO stated guidance assumes “no material change in our net dollar expansion rate,” and warned that AI announcements from OpenAI or Anthropic “could increase the sales cycle” as readily as increase sales. The CEO said budgets have “stayed roughly the same.”

Significant acquisitions? None — by Qualys, in the entire five-year filing corpus. In the surrounding industry, the relevant transaction is Google’s ~$32B acquisition of Wiz, disclosed as pending in the FY2025 10-K’s competition section, which set the cost of entry to the CNAPP frontier at roughly seven times Qualys’s entire enterprise value.

Change in accounting policies? None disclosed. No restatement, no auditor change, no critical-audit-matter escalation, and no change in revenue-recognition policy across the five-year corpus.

Recent changes — new markets, facilities, management?

Products (last ~18 months): Enterprise TruRisk Management reached general availability; Q4 FY2025 added ETM Identity, TruLens (industry-specific threat prioritisation) and TruConfirm (exploit validation); Q1 FY2026 brought Agent Vail to general availability (closed-loop autonomous exploit validation and remediation) plus an AI-powered patch reliability score trained on the proprietary patch-outcome dataset; TotalAI was enhanced for AI-model security and governance (announced 2026-07-29).

Go-to-market: the channel reached 52% of revenue (from 49%), growing 17% against direct at 3%, supported by nearly two dozen certified managed-risk-operations partners; Q-Flex, a consumption-credit purchasing model, is in pilot with general availability planned for late 2026; the federal vertical is being built out on FedRAMP High authorisation, with a third annual federal conference held in Washington in May 2026.

Partnerships: Qualys joined OpenAI’s early-access cyber programme and Anthropic’s cyber-verification programme, and announced a cyber-insurance partnership with Converge Insurance under which customers demonstrating good TruRisk scores can qualify for premium reductions — a genuinely novel attempt to tie a security score to a business outcome.

Recognition: leader in the Q1 2026 Forrester Wave for CNAPP; 2026 SC Award for Best Cloud Security Management; leader in the 2026 GigaOm CIEM report; #1 in the GigaOm Patch Management radar. The threat-research unit published “Track Armor,” disclosing critical AppArmor vulnerabilities enabling root-level compromise and container escape across Linux systems.

Management and governance: no executive departures or appointments in the five-year corpus. Stockholders approved an amended and restated 2012 Equity Incentive Plan on 2026-06-10. The board authorised a $200M increase to the share repurchase programme on 2026-02-05, bringing cumulative authorisation to $1.6B.

Disclosure: management introduced a new quarterly metric in Q1 FY2026 — net dollar expansion of the ETM/CSAM customer cohort, reported at 107% versus 104% company-wide — explicitly positioned as the best available indicator of whether the ETM strategy is working. It is the single most useful new number the company has provided, and its principal limitation is that the cohort’s size has not been disclosed.

Next scheduled event: Q2 FY2026 results, 2026-08-04.

APPENDIX B — Source Appendix

Qualys, Inc. (NASDAQ: QLYS) · Report date 2026-08-01 · CIK 0001107843

Primary sources are listed first. Where a third-party aggregator conflicts with an SEC filing, the filing governs and the discrepancy is noted below. All URLs accessed 2026-08-01 unless stated.

1. SEC filings (primary)

The trailing 60-month SEC filing corpus was enumerated and reviewed in full. Five-year census: 377 Form 4, 72 Form 144, 34 8-K, 15 Schedule 13G/13G-A, 15 10-Q, 7 DEFA14A, 6 Form 3, 5 10-K, 5 DEF 14A, 5 SD, 4 ARS, 2 S-8, 1 PRE 14A, 1 CORRESP. Zero Schedule 13D. Zero Form 425.

EDGAR company landing page: https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001107843&type=10-K

2. Company communications (primary)

3. Quantitative and market data (third-party; reconciled to filings)

4. Financial and trade press (secondary — event attribution only)

Used solely to attribute causes to price moves already established as fact from the AZI tape. Each item is labelled Interpretation in the memo where it explains a move.

5. Peer and industry cross-reference

6. Analytical frameworks applied

7. Data-integrity notes and limitations

1. Enterprise value is computed from the filing, not from an aggregator. ROIC.ai’s get_enterprise_value omits $449.9M of marketable securities. The EV used throughout ($4,444M) is market capitalisation ($144.75 × 35.379M shares) less net cash of $677.1M, built from the Q1 FY2026 balance sheet.
2. Two NDR figures are in circulation and both are used, each attributed. The FY2025 10-K states 103% for FY2025 and FY2024 (annual LTM basis); the Q1 FY2026 call states 104% for the quarter and 103% for the prior quarter.
3. A transcript error was corrected against the filing. The Q1 FY2026 call renders the prior non-GAAP EPS range as “7.97 to 7.45,” which is not a range. The 8-K Ex-99.1 of 2026-02-05 states $7.17–$7.45 and governs.
4. ROIC.ai returned no news for QLYS (get_company_news → empty array). The recent-events timeline was therefore assembled from SEC 8-Ks, company releases and financial/trade press, per protocol.
5. The ≥$500K customer cohort figures (221 accounts, ~$293M) come from the Q1 FY2026 investor presentation as reported in secondary coverage; the earnings-call audio transcription of this passage is garbled. The direction and magnitude are corroborated by management’s stated “+9%” growth in that cohort.
6. Scenario analysis in Section 10.6 uses the analyst’s own assumptions, explicitly stated, and is not company guidance. Qualys provides no multi-year outlook.
7. Timing. Qualys reports Q2 FY2026 on 2026-08-04, three days after this report date. Nothing in this report anticipates that print, and the decisive metric identified in Section 14.3 — net dollar expansion — will be updated by it.