Qualys, Inc. QLYS

Key data

The business

Qualys sells software that hunts for security weaknesses. Its customers, mostly large companies and governments, install lightweight agents across their laptops, servers and cloud accounts, and Qualys continuously scans everything for missing patches, misconfigurations and exposed systems, then ranks what to fix first. It is sold as a yearly subscription off one cloud platform the company calls Enterprise TruRisk. The money is made by renewing those subscriptions and selling more modules into the same account: web-app scanning, cloud security, patch management. The moat is switching cost. Once the agents are deployed and the vulnerability history lives inside Qualys, ripping it out to move to Tenable, Rapid7 or CrowdStrike means re-instrumenting the whole estate, so renewals hold and pricing sticks. Roughly 45% of revenue is now foreign, $81.9M of the $182.2M booked last quarter, a reminder this is a global buy, not a US one.

The numbers

Two things move at once here, and only one is slowing.

Revenue climbed every quarter, $164M to $182M, up 11% year over year in Q2. Net income rose in step to $52.4M. On adjusted earnings, which is what the sell-side tracks, Qualys has beaten every quarter for a year, $1.98 against $1.78 last quarter. The GAAP number that ties to the filing is $1.50 diluted, up 16% from a year ago, faster than revenue because margins keep widening. Operating margin reached 34%.

Step back five years and the split is stark. Revenue compounded about 13% a year from $411M in 2021 to $669M in 2025. Earnings per share compounded 32% over the same stretch, from $1.77 to $5.44. The gap is margin expansion and buybacks doing the work the top line no longer does alone. But watch the slope of that top line: 19% growth in 2022, then 13%, then 10%, now holding near 11%. This is a low-teens grower dressed as a fast one by its own capital discipline.

The forward book tells you whether that holds. Contracted revenue not yet recognized sits at $499.9M. The prepaid balance customers carry slipped to $402.3M from $417.4M at year-end. Some of that is ordinary, renewals bunch into the fourth quarter, but a softening prepaid balance is the first place a slowdown appears. It bent, it did not break. The market prices this as a decelerating mid-teens compounder worth 20 times next year's earnings. if margin and buybacks keep EPS growing mid-teens while revenue holds double digits, that multiple is too low, and the print that settles it is whether the backlog reaccelerates or keeps drifting.

Management

Read the record, not the résumé. Over the last twelve months insiders sold about $12.8M of stock across 81 transactions and bought nothing. CEO Sumedh Thakar accounted for the largest lots, roughly $4M sold at the end of June, and the pack does not carry whether those were pre-set sales, so read them as neutral rather than a tell either way. What matters more is what the cash does. Qualys spent $183M buying back stock in 2025 and another $53.5M in the first quarter of 2026, shrinking the diluted share count from 36.7M to 35.4M in a year. That buyback is the quiet engine: it turned about 10% revenue growth into 16% EPS growth last quarter. With almost no debt and $703.5M in cash and securities, it is funded, not borrowed.

How it fails or surprises you

The forward book softens. Total backlog is $499.9M and the prepaid balance fell to $402.3M from $417.4M at year-end. Fourth-quarter renewal timing explains part of it, but if the next filing shows backlog growing slower than revenue, the 10% growth rate is heading toward high single digits. Watch backlog against revenue growth.

Revenue keeps decelerating. This is the number the long case explains least. Growth fell from 19% in 2022 to 11% now, a steady four-year glide with no floor yet visible. Margin and buybacks have masked it in EPS, but both are finite. If revenue prints below 10% while operating margin stalls near 34%, the compounder read is done.

Exposure management reaccelerates (right tail). Qualys is pushing beyond scanning into cloud, API and unified risk scoring on one platform, where budgets are still growing. Nobody pays for reacceleration at 20 times forward earnings. If net expansion turns and a quarter prints revenue back above 12%, the multiple and the growth rate re-rate at once. The tell: one quarter reversing the four-year slide.

Closing thoughts

Which world is this? Mostly a priced one. At 20 times forward earnings, below its own decade and below peers near 30, the market already assumes growth keeps fading toward low double digits. The edge is not in the multiple, it is in whether the earnings engine, margin plus buyback, keeps converting 10% revenue growth into mid-teens EPS growth for longer than the market credits. The left tail is shallow: net cash of $700M, 34% operating margins and a subscription base that renews mean a weak year dents the growth rate, not the survival. The right tail, a real reacceleration in the forward book, is the part nobody is paying for. Weigh the two and the downside is a de-rating you can wait out, the upside a re-rating you get for free.

The bet is still that big companies keep paying Qualys every year to scan for security holes and keep buying more of its tools, and that the profit engine outruns the slowing top line. What breaks it is the forward book: if backlog and the prepaid balance keep sliding while revenue growth dips under 10%, the compounding story is over and 20 times becomes the right price, not a cheap one. The one pair of numbers that tells you first: remaining backlog against revenue growth across the next two filings. If backlog grows slower than sales, the machine is winding down.