QLYS

Source: Q1 2026 earnings release (May 2026), SEC 10-K FY2025, company guidance

Capital efficiency profile: ROIC ~17%, FCF margins ~45%, ~$500M+ cash / no debt. Aggressive buyback ($53.5M in Q1 2026 alone, ~1% of market cap per quarter). This is a cash-compounding machine, not a growth story.

Revenue growth trajectory:

• FY2021: $363M → FY2022: $490M (+35% — COVID acceleration)
• FY2023: $554M (+13%) → FY2024: ~$607M (+9.6%) → FY2025: ~$660M (+8.7%)
• Growth deceleration is the central bear case — declining from mid-teens to high single digits

Qualys sells a cloud subscription platform (VMDR + Enterprise TruRisk Management) that inventories assets, detects vulnerabilities/misconfigurations, scores TruRisk, and drives remediation — now adding scanless, advisory-triggered detection (InstaScan) on top of telemetry Qualys and third-party scanners already collect.

No 8-K/10-Q has been filed since 2026-08-04 (submissions.json through 2026-09-03 is Form 4 / 144 / S-8 only).[4]

• monetization model: Cloud SaaS subscriptions to Qualys Cloud Platform; professional services; no perpetual license/hardware. FY24 10-K, Item 1; Note 2, [sec.gov , acc. 0001107843-25-000009]
• revenue mix: One reportable segment; FY24 revenue ~$607.0M: subscriptions ~94.8%, professional services ~5.2% (~$575.4M / ~$31.6M). [FY24 10-K, Note 2]
• who pays: Enterprise/government security, IT, and compliance budgets; economic buyer is CISOs & Security Operations and Compliance & GRC Officers, with IT/cloud leadership sign-off. [FY24 10-K, Item 1]
• margin_value_capture: High-margin SaaS; GAAP gross margin ~80%, GAAP operating margin ~22% (FY24). Value accrues in subscription renewals and multi-product upsell. [FY24 10-K, MD&A]

• customer classes: CISOs & Security Operations, Compliance & GRC Officers, Platform & Developer Teams [FY24 10-K, Item 1]

Qualys sells a cloud-based security and compliance platform delivered as a subscription service. The company’s core economic model is software-as-a-service: customers subscribe for a term, generally one to three years, and revenue is recognized ratably over the subscription period. The 10-K describes its offering as a “cloud-based platform delivering IT, security, and compliance solutions” and states that it “generates revenues primarily from subscriptions to our cloud platform” [Q10K23, Business section].

The company does not sell the core platform as a perpetual license. Instead, it deploys lightweight sensors and optional scanner appliances, while the actual analytics, correlation, reporting, and workflow engine runs in Qualys’s multi-tenant cloud. This matters for unit economics: the cost of goods sold is mainly cloud infrastructure, support, and allocated personnel costs, not physical product distribution.

Qualys has one reportable operating segment. The 10-K does not disclose a product-line revenue split; instead, revenue is reported by geography and by timing. The segment mix therefore is:

This is a structural fact: Qualys operates and manages its business as a single segment. The company states in its segment note that its chief operating decision maker reviews financial information on a consolidated basis [Q10K23, Note 1/segment disclosure]. Any product-level or geography-level revenue split needs the underlying 10-K revenue-disaggregation note; exact percentages should be pulled from the filing and are not reproduced here as load-bearing unless verified. The key point is that Qualys does not run a separate on-prem software segment or a large hardware segment—it is almost entirely subscription.

From the audited income statement in Qualys’s FY2023 10-K, the headline economics are:

Sources: [Q10K23, Income Statement]; figures rounded to one decimal. The underlying dollar figures are from the audited consolidated statements of operations in the 10-K. The margin percentages are derived from those filed figures.

The model is high-margin: roughly 79% gross margin and roughly 28% operating margin. The decline from FY2022 operating margin of 27.9% to FY2023 operating margin of 27.7% is small; the more relevant trend is that revenue growth slowed from about 18.9% in FY2022 to 13.2% in FY2023, calculated as:

• FY2022 growth: ($489.7M / $411.9M) - 1 = 18.9%
• FY2023 growth: ($554.5M / $489.7M) - 1 = 13.2%

Both inputs are from the same three-year income statement [Q10K23]. This is a primary-source-derived growth formula, but the two years are from the same issuer filing, so for cross-verification purposes this remains single-source from the issuer. I do not treat it as an independent corroboration.

Qualys monetizes primarily through term subscriptions priced per asset, per application, or per module. The 10-K describes that customers pay for access to the cloud platform and that subscription fees are generally based on the number of assets, applications, or users being monitored, with additional fees for premium modules. The exact price list is not disclosed in the 10-K; it is not a public per-seat disclosed SaaS metric. Therefore, any precise ARPU or list-price claim would require the underlying customer contracts or a Qualys investor-day disclosure.

The company’s high gross margin is consistent with a software-subscription model: once the cloud platform and agent/scanner fleet are deployed, incremental revenue carries low marginal cost. This supports pricing power, but it does not prove pricing power by itself. Qualys has maintained gross margins near 79% over three years, which suggests it has not been forced into deep discounting to retain revenue; however, this is an inference, not a direct statement from management.

Qualys reports deferred revenue, which reflects billed but not yet recognized subscription revenue. Deferred revenue is a key working-capital feature of the model. The exact current and non-current deferred revenue balances should be pulled from the balance sheet in [Q10K23]. I am not quoting them here because the exact line-item amounts need direct verification against the filing; the model is still clear: customers pay upfront or periodically, and Qualys recognizes revenue ratably.

Qualys’s customer base pays for security and compliance outcomes: vulnerability management, policy compliance, web application security, patching, endpoint detection, and related audit workflows. The paying entity is usually the security or IT organization. The 10-K states that it sells to enterprises, mid-market businesses, government agencies, and managed service providers [Q10K23, Business section]. No customer names are disclosed in the 10-K; Qualys does not provide a named top-customer list. Therefore, top customers are not named in filings — that is a disclosure gap, not a fact I can fill from another source without violating the source-tier rule.

The 10-K’s business description identifies the following customer classes:

• Large enterprises
• Mid-market businesses
• Government agencies
• Managed service providers / managed security service providers

This is important: Qualys is not solely an enterprise product. Its low-friction agent model and cloud delivery make it accessible to mid-market buyers, while MSSPs use the platform to deliver security services to their own customers.

From the product modules and regulatory workflows, the buying archetypes are:

• CISO / VP of Security: owns vulnerability risk reduction, board reporting, and security operations.
• IT operations / vulnerability management team: performs scanning, prioritization, patch orchestration, and remediation tracking.
• Compliance / audit team: needs PCI, HIPAA, NIST, or other regulatory evidence.
• MSSP / service provider: delivers managed vulnerability management for multiple clients on one multi-tenant platform.
• Cloud security or DevOps team: uses API/container/cloud workload visibility where agents cannot be installed.

These are inferred from the product disclosures in [Q10K23, Business section]; Qualys does not publish named buyer personas in the filing.

The prompt asks for named customers from filings only. Qualys’s 10-K does not name specific customers. Therefore, I will not invent customer names. This is a disclosure limitation. The correct statement is:

Qualys’s SEC filings do not provide a named top-customer list; any customer names circulating in marketing materials are not Tier 1 under the rules of this note and are omitted.

The only territorial/company-size customer information in the 10-K is aggregated, not account-specific.

• QLYS requires verified SEC financials and competitor filing checks before conviction changes.

• Q2 FY2026 EX-99.1 reported revenue of $182.2M (+11% YoY), GAAP net income of $52.4M, non-GAAP EPS of $1.98, Adjusted EBITDA of $83.8M, and raised FY2026 revenue guidance to $732.0M-$738.0M.
• CEO Sumedh Thakar said Qualys' innovation spans “AI for security and security for AI” and highlighted AI-native Risk Operations Center adoption, a growing federal pipeline, partner-led execution, and early QFlex engagement.
• Q2 FY2026 10-Q shows revenue $182.175M, cost of revenue $30.244M, gross profit $151.931M (~83.4% gross margin), and operating income $61.902M (~34.0% operating margin).
• Q2 current deferred revenue was $388.075M versus $393.800M in Q1 FY2026; the sequential decline of $5.725M implies calculated current billings of about $176.45M for the quarter.
• TotalCloud achieved FedRAMP High Authorization sponsored by the DEA, extending the federal/government platform to CNAPP and making TotalCloud available through the FedRAMP Marketplace.

1. Billings reconciliation (the deceleration bear-case metric).

Calculated current billings = revenue + Δ current deferred revenue:

• Q2 FY26: $182.175M + ($388.075M − $393.800M) = $176.45M
• Q1 FY26: $175.638M + ($393.800M − $401.127M) = $168.31M
• Q2 billings +4.8% QoQ; billings/revenue ratio 96.9%. Current-deferred-revenue decline is narrowing (−$7.327M in Q1 → −$5.725M in Q2). Billings still trail revenue, but the gap is closing, not widening.

2. H2 FY2026 implied revenue (guide-raise de-risking).

• Raised guide midpoint $735.0M − H1 actual $357.813M = $377.19M implied H2.
• H2 FY2025 actual = $669.125M − $323.961M = $345.164M → implied H2 YoY +9.3%.
• Implied H2-over-H1 sequential step-up = +5.4% — below Q2's +11% run-rate. The midpoint does not require re-acceleration; it is a modest sequential step-down.

3. Free-cash-flow bridge.

• Q2 standalone OCF = $154.908M (H1) − $95.294M (Q1) = $59.61M (matches the +77% YoY in the 08-08 update).
• Q2 standalone capex = $5.367M − $1.667M = $3.70M → Q2 FCF $55.91M (30.7% margin, seasonally low).
• H1 FY26 FCF = $154.908M − $5.367M = $149.54M (41.8% margin) vs H1 FY25 FCF $139.99M → +6.8% YoY.
• FY2025 FCF = $309.400M − $4.990M = $304.41M (45.5% margin), confirming the compounder profile.

4. Capital-return / cash bridge.

Cash & equivalents fell $29.18M QoQ ($279.468M → $250.291M) despite +$55.91M Q2 FCF, implying ~$85M of buyback + financing outflow — the aggressive repurchase cadence ($53.5M in Q1 alone) continued through Q2.

• technical_scarcity: 5/10 (unchanged). Agentless scanning remains non-unique; the moat is switching cost + compliance audit trail. Q2's TotalCloud FedRAMP High authorization (DEA-sponsored) extends the federal/regulatory moat surface, but Tenable and other peers also hold FedRAMP — so it is an incremental, not decisive, scarcity signal.
• economic_capture: 6/10 (unchanged). Q2 beat-and-raise confirms execution (83.4% GM, 34.0% OM, 45.5% FY25 FCF margin), but +9–11% growth keeps the TAM expansion gradual, not explosive.
• time_to_monetize: 5 → 6/10. The prior 5 was anchored to "Q2 earnings (~Aug 4) is the nearest binary event." That event resolved positive (beat + raised guide + FedRAMP High + OCF +77% YoY). Monetization is visible now; the AI-native ROC / QFlex re-acceleration remains a 12–24-month call.

Composite: 5.7/10 (vs prior 5.3) — a quality compounder whose near-term catalyst cleared, but not a re-acceleration story.

1. "Growth stuck ~10%, Q2 guide ~8–9%" → FALSIFIED. Q2 actual +11.0% YoY; FY2026 guide raised to +9.4–10.3% (on the corrected $669.125M base).
2. "Billings +8% trails revenue +10%" → SOFTENED. Billings still trail revenue (96.9% ratio), but the current-deferred-revenue decline narrowed QoQ and Q2 billings re-accelerated +4.8% QoQ.
3. "Q2 earnings due imminently — binary event" → RESOLVED POSITIVE. Beat-and-raise; no miss materialized.

Hypothesis verdict: INTACT (reconciled). The durable INTACT verdict and the 08-08 "STRENGTHENED" read are now consistent: the Q2 reconciliation materially weakens the deceleration bear case (2 of 3 disconfirming bullets falsified or softened) but leaves the structural risks — platform bundling by PANW/CRWD/MSFT and standalone-VM wallet saturation — intact. Qualys remains a ~10%-grower compounder with a 2.5x–5.8x switching-cost moat and 45% FCF margins, not a re-acceleration story.

Composite 5.7/10 — quality compounder; launch is feature-velocity, not a re-acceleration print.

bypass 2 / concentration 2 / hyperscaler 2 = 6 STRONG PROXY. Consolidation 2.0 ingesting MSFT Defender + Tenable is additional Q3-PARTIAL evidence: Qualys is coexisting with the bundle, not displacing it. No live capital (research_only).

• Revenue, margin, and backlog figures: needs primary source validation.

• Competitor filings should be checked for demand, pricing, and share-shift contradictions.

• sec.gov
• sec.gov

Because the customer count is “more than 10,000,” the lowest possible count consistent with the filing is 10,001. So:

\[

\text{Implied ARPU} \le \frac{\$554,500,000}{10,001} \approx \$55,450

\]

Since the denominator is a lower bound, the true average revenue per customer is less than or equal to about \$55,450—unless the company’s actual customer count is materially lower, which would contradict the 10-K. This is an upper-bound calculation, not an exact ARPU.

The sensitivity table shows that the implied ARPU is highly dependent on the actual customer count. Because Qualys does not disclose a precise customer count, the single point is not robust enough for a conviction-driving ARPU conclusion. This calculation is a reasonable proxy for scale, but it should not be used as a precise SaaS KPI.

• Can: It provides a sanity check on the average account size and suggests that Qualys’s revenue is not driven by a tiny number of mega-deals.
• Cannot: It cannot separate new customers from renewals, expansion revenue from seat/asset growth, or direct customers from MSSP end-customers. It also does not account for multi-year subscriptions recognized entirely within FY2023.

Every issuer financial figure is single-source from that issuer’s own 10-K; this is acceptable under the primary-source rule but lowers confidence for cross-issuer conclusions.