Qualys, Inc. (QLYS) Company Overview

What does Qualys do?

Qualys, Inc. is a Nasdaq-listed cybersecurity software company that helps organizations discover technology assets, identify vulnerabilities and misconfigurations, measure cyber risk, prioritize remediation, and document compliance. Its core product architecture is the Enterprise TruRisk Platform, a cloud-delivered system that combines asset inventory, vulnerability management, policy compliance, cloud security, endpoint controls, application security, and risk-based remediation workflows. The company describes its role as helping customers manage “pre-breach” risk: reducing the exposures that attackers can exploit before an incident becomes a loss event.

Which products define the platform?

The best-known franchise is Vulnerability Management, Detection and Response, or VMDR. Around it, Qualys has added CyberSecurity Asset Management, Enterprise TruRisk Management, Patch Management, TotalCloud, Web Application Scanning, policy compliance, file integrity monitoring, endpoint detection and response, and related tools. These modules share cloud infrastructure, agents, scanners, data, and workflows, which lets customers add capabilities without deploying a completely separate platform for every security problem.

Why does the company matter in cybersecurity?

Qualys matters because vulnerability and exposure management sit close to the foundation of enterprise security. A company cannot prioritize remediation without first knowing which assets exist, which weaknesses affect them, how exposed they are, and whether compensating controls are working. Qualys has built an unusually profitable software business around that continuous measurement layer. The strategic question is whether it can convert its large installed base and data advantage into faster adoption of newer modules such as Enterprise TruRisk Management, TotalCloud, and Patch Management.

How does Qualys make money?

Qualys earns nearly all of its revenue from renewable subscriptions to cloud-based security and compliance applications. Customers generally sign one-year contracts and are usually invoiced at the beginning of the subscription term. The company records that cash or receivable initially as deferred revenue, then recognizes revenue ratably over the contract period. This model produces high visibility because a large portion of the next year’s reported revenue is already contracted, while advance billing supports cash generation.

What determines subscription value?

Pricing depends on the applications purchased and the quantity of covered assets, devices, web applications, cloud resources, or related units. A subscription can include physical or virtual scanner appliances, but those devices are not sold as stand-alone products and generally must be returned if the subscription is not renewed. The economic engine is therefore recurring software access rather than hardware margin.

Which channel is becoming more important?

Channel contribution has risen steadily. Partners generated 43% of revenue in 2023, 46% in 2024, 49% in 2025, and 52% in the first quarter of 2026. In that latest quarter, partner revenue grew 17% year over year versus 3% for direct revenue. That mix shift is strategically important: a stronger partner ecosystem can improve reach, but it also makes enablement, economics, and partner execution more important to growth.

What does Qualys’s latest quarter show?

The quarter ended March 31, 2026 showed a company maintaining double-digit revenue growth while expanding GAAP operating leverage. According to the official first-quarter 2026 results, revenue increased 10% year over year to $175.6 million. GAAP gross margin reached 83%, GAAP operating margin rose to 35%, and adjusted EBITDA margin remained 47%.

What did customer and product metrics signal?

Overall net dollar expansion was 104%, up from 103% in the prior quarter, while the ETM/CSAM cohort reached 107%. On a trailing-twelve-month basis, ETM and CSAM represented 11% of total bookings and 14% of new bookings; Patch Management represented 8% of total bookings and 15% of new bookings; and TotalCloud represented 5% of total bookings. These figures suggest that newer products are gaining relevance, but the total company expansion rate still reflects moderate rather than exceptional wallet growth.

What does management expect next?

Qualys raised full-year 2026 revenue guidance to $721.0 million to $727.0 million, implying 8% to 9% growth. Second-quarter guidance called for $177.5 million to $179.5 million of revenue, also 8% to 9% growth. The guidance indicates durable growth, but not a sudden acceleration; the investment case depends on whether newer products and the channel can push expansion higher over time.

How strong was the 2025 financial base?

The 2025 Form 10-K shows a highly profitable software model. Revenue increased 10% to $669.1 million from $607.6 million in 2024. Gross margin was 83%, operating margin was 33%, and net margin was 30%. The company generated growth while keeping cost of revenue at only 17% of sales.

Where did growth come from?

Of the $61.6 million increase in 2025 revenue, 76% came from customers that already existed at the end of 2024 and 24% came from new customers. Geographically, 63% of the increase came from foreign countries and 37% from the United States. By route to market, 80% of the increase came through partners and 20% through direct sales. The pattern supports a clear interpretation: Qualys’s 2025 growth was primarily an expansion-and-channel story rather than a new-logo-only story.

What gives Qualys a competitive advantage?

Qualys’s moat is not a single patent or brand slogan. It is the combination of an installed cloud platform, a large body of continuously refreshed security content, embedded agents and scanners, historical asset and vulnerability data, customer workflows, and high switching costs created by operational dependence. Once a security team uses Qualys as a system of record for assets, exposures and compliance evidence, replacing it can require re-instrumenting infrastructure, rebuilding integrations, retraining staff, and recreating audit processes.

Why does platform architecture matter?

The platform uses shared infrastructure and a common interface across modules. That creates economic leverage because Qualys can add applications without duplicating every layer of data collection and delivery. It also creates commercial leverage: a customer that already deploys cloud agents or scanners can add Patch Management, ETM, TotalCloud, or compliance applications with less deployment friction than a greenfield vendor may face.

Where is the moat weaker?

Cybersecurity buyers can choose broad platforms or best-of-breed tools, and large rivals can bundle exposure management with endpoint, cloud, identity, or security-operations products. Qualys therefore cannot rely on its installed base alone. The moat remains durable only if product quality, threat research, integrations, and remediation workflows keep pace with competitors and changing infrastructure.

Which competitors pressure the business?

Qualys competes in overlapping markets rather than one narrow category. In vulnerability and exposure management it faces vendors such as Tenable and Rapid7. In broader endpoint, cloud, and security-platform decisions it can encounter CrowdStrike, Microsoft, Palo Alto Networks, Wiz, Cisco, Ivanti, and other vendors. The important competitive distinction is that Qualys emphasizes a unified asset-and-risk record with strong vulnerability, compliance, and remediation depth, while several rivals approach the customer from endpoint detection, cloud workload protection, SIEM, identity, or network security.

How should a student analyze industry structure?

Rivalry is high because customers have many credible vendors and security budgets are heavily scrutinized. Buyer power is meaningful among large enterprises that can run competitive evaluations and demand integration. Substitution risk comes from bundled platform products and internally assembled tooling. Barriers to entry are still substantial, however, because global scanning infrastructure, security research, enterprise trust, certifications, data scale, and partner distribution take years to build. Qualys’s strategic defense is to make a common risk platform more valuable than a collection of disconnected point products.

How did Qualys become the company it is today?

Qualys’s history is best understood as a progression from cloud-delivered vulnerability assessment to a broader platform for measuring and reducing enterprise cyber risk. The turning points below matter because each expanded the company’s addressable problem while preserving its recurring subscription architecture.

1. 1999
   Qualys was founded around internet-delivered security assessment, establishing the cloud-first operating model that remains central today.
2. 2012
   The company completed its public listing on Nasdaq, gaining access to public capital while retaining a focused cybersecurity identity.
3. Mid-2010s
   Cloud Agent technology expanded continuous visibility beyond periodic network scans and deepened deployment inside customer environments.
4. 2019–2021
   VMDR and Patch Management connected detection, prioritization and remediation, moving the platform closer to closed-loop risk reduction.
5. 2021
   Sumedh Thakar became chief executive officer, reinforcing a strategy centered on platform consolidation and profitable growth.
6. 2023–2025
   CyberSecurity Asset Management, Enterprise TruRisk Management and TotalCloud became central expansion products, widening the company beyond traditional vulnerability management.
7. 2026
   Qualys introduced Agent Val and expanded Risk Operations Center workflows, adding AI-assisted exploit validation and remediation prioritization.

What strategic tension does the timeline reveal?

The company has repeatedly broadened its platform while protecting unusually high margins. That discipline is a strength, but it creates a trade-off. Qualys must invest enough in sales, partners, research, AI, cloud security, and adjacent modules to remain strategically relevant, yet it has trained investors to expect strong profitability. The next phase depends on showing that newer products can lift expansion and bookings without requiring a structurally lower margin model.

How financially strong is Qualys?

Qualys entered 2026 with a debt-light balance sheet and substantial liquidity. At December 31, 2025, cash, cash equivalents, and short- and long-term marketable securities totaled $696.8 million. Cash and cash equivalents alone were $250.3 million, while short-term marketable securities were $195.7 million. The company stated that existing liquidity and expected operating cash flow should fund operations for at least the next twelve months and beyond.

How does capital allocation work?

Qualys does not pay a regular dividend. Its main shareholder-return tool is repurchasing stock. In the first quarter of 2026, it spent $53.9 million to repurchase approximately 505,000 shares. Since the program began in February 2018, the company had repurchased 11.2 million shares and returned about $1.3 billion by March 31, 2026. The board added $200 million of authorization in February 2026, and $306.6 million remained available at quarter-end.

What should researchers watch in cash flow?

Free cash flow equals operating cash flow minus capital expenditures. Because capex is small, movements in receivables, deferred revenue, taxes, and other working-capital items can make quarterly free cash flow volatile. The first-quarter 2026 decline from a 67% to a 53% free-cash-flow margin should therefore be interpreted in context rather than as a standalone deterioration. The more important long-term questions are whether billings and deferred revenue keep pace with sales, whether subscription collection remains strong, and whether buybacks offset dilution at sensible economics.

Who owns Qualys stock, and how is it governed?

Qualys has one class of common stock, with one vote per share and no cumulative voting. As of the April 14, 2026 record date, 35,289,949 shares were outstanding. This is not a founder-controlled dual-class structure; economic ownership and voting power are aligned on a one-share, one-vote basis. The result is a more conventional public-company governance model in which institutional investors, directors, and management influence strategy through ordinary voting rather than super-voting shares.

The 2026 proxy statement reported that six of seven directors were independent under Nasdaq standards. The classified board, with directors divided into three staggered classes, can provide continuity but may also delay changes in control. For investors, governance analysis should focus on board oversight, executive incentives, dilution, repurchase discipline, and whether compensation metrics reward both growth and durable profitability.

What risks and opportunities could change the story?

The largest opportunity is to turn Qualys from a respected vulnerability-management vendor into a broader risk-operations platform. ETM, CSAM, Patch Management, TotalCloud, AI-assisted exploit validation, and managed Risk Operations Center offerings can expand wallet share within the installed base. International revenue and channel partnerships are additional levers: in Q1 2026, international revenue grew 15% versus 6% in the United States, and channel revenue grew 17% versus 3% direct.

Which risks are most material?

• Competition and bundling: larger platforms can package vulnerability, endpoint, cloud, identity, and security-operations capabilities together.
• Cybersecurity incident risk: a breach or service disruption affecting Qualys or its cloud providers could damage trust in a company whose products are designed to improve security.
• Innovation risk: research and development may not produce commercially successful products quickly enough to offset mature-core growth.
• Sales-cycle and budget risk: macro uncertainty, scrutiny of security spending, and longer enterprise approvals can delay bookings.
• Cloud infrastructure dependence: Qualys uses shared cloud platforms operated by third-party vendors under agreements extending through 2030.
• International and regulatory risk: privacy, cybersecurity, data protection, currency, and local compliance rules can raise costs or constrain deployment.

The first-quarter 2026 Form 10-Q also highlights foreign-exchange exposure, inflation, interest rates, geopolitical conflicts, customer budget scrutiny, competition, talent retention, intellectual-property claims, and execution in new markets. The central risk is strategic: Qualys must expand beyond its mature foundation while defending the reliability and profitability that make the franchise distinctive.

Why does Qualys matter for valuation?

A Qualys valuation should not be driven by revenue growth alone. The business combines recurring subscriptions, low capital intensity, high gross margin, substantial operating margin, net cash, and aggressive repurchases. Those traits can support strong free-cash-flow conversion. At the same time, a mature overall expansion rate means long-term value is sensitive to whether newer modules can sustain growth after the core vulnerability-management market becomes more competitive.

Which KPI set is most decision-useful?

Researchers should track revenue growth, overall net dollar expansion, ETM/CSAM cohort expansion, partner mix, international growth, product booking shares, GAAP operating margin, stock-based compensation, operating cash flow, free cash flow, repurchase spending, and diluted share count. Together, these metrics show whether Qualys is converting platform breadth into faster expansion while preserving the financial characteristics that justify a premium-quality software profile.

What is the key takeaway from Qualys analysis?

Qualys is a high-margin cybersecurity subscription company built around continuous asset visibility, vulnerability assessment, risk prioritization, compliance, and remediation. Its shared cloud platform, embedded customer workflows, security research, broad installed base, and recurring billing model create meaningful switching costs and strong cash economics. The 2025 annual results and first quarter of 2026 show a company growing around 10% while producing an 83% GAAP gross margin, a 35% quarterly GAAP operating margin, and substantial free cash flow.