Qualys is the higher-quality business, with net cash and exceptional margins, but the growth investment case still needs evidence that Enterprise TruRisk Management and patching can lift net expansion.
Qualys has rare profitability, net cash, and a credible autonomous remediation story. The issue is not business quality; it is whether an 8%-9% revenue-growth guide can become a low-to-mid-teens growth path without breaking margins. S1 S2 S3
The decision hinge is whether Enterprise TruRisk Management, Patch Management, Agent Val, and QFlex become a meaningful second and third dollar of customer spend rather than a slow migration inside the existing base.
All figures are United States dollars unless noted. Currency conversion note: no exchange rate was used and no figures were converted because QLYS reports in USD.
Current market context, normalized Fiscal.ai fundamentals, and the key source conflict are shown upfront because valuation is central to both QLYS and the peer comparison.
| Latest quarter | Q1 2026 revenue was $175.6M, up 9.8% year-over-year; adjusted EBITDA margin was 47%; non-GAAP earnings per share was $1.95. |
| Expansion signals | Total net dollar expansion was 104%; the ETM/CSAM cohort net dollar expansion was 107%; ETM/CSAM represented 11% of last-twelve-month bookings and 14% of new bookings. |
| Cash and capital return | Q1 free cash flow was $93.6M. Qualys repurchased $53.9M of stock in Q1 and had $306.6M remaining under authorization at quarter end. |
| Market data conflict | Live quote-derived market capitalization differs from Fiscal.ai snapshot market capitalization; the report uses the live quote for opening market context and Fiscal.ai for normalized multiples. |
Overall score: 36/45. This is a research-priority score, not a rating or target price.
| Factor | Score / 5 | Evidence |
|---|---|---|
| Revenue growth | 3/5 | Q1 revenue grew 9.8% and full-year guidance implies 8%-9% growth. |
| Earnings growth | 3/5 | Consensus non-GAAP earnings per share growth is positive but not high enough by itself to make a strong growth case. |
| Durability | 4/5 | Qualys has more than 10,000 subscription customers and a long-lived single-agent platform. |
| Margin quality | 5/5 | Adjusted EBITDA margin was 47% in Q1 and GAAP profitability is much stronger than most security software peers. |
| Cash generation | 5/5 | Free cash flow was $93.6M in Q1, a 53% margin. |
| Balance sheet | 5/5 | Fiscal.ai shows net cash of about $677M. |
| Valuation | 4/5 | Fiscal.ai NTM valuation is modest for a high-margin software company, though lower growth deserves a discount. |
| Competitive position | 4/5 | Qualys has a differentiated remediation and patching angle, but must prove it can outgrow Tenable and broader platform vendors. |
| Market timing | 3/5 | Autonomous remediation fits the moment, but reported expansion has not yet inflected. |
The decision hinge is whether Enterprise TruRisk Management, Patch Management, Agent Val, and QFlex become a meaningful second and third dollar of customer spend rather than a slow migration inside the existing base.
Current market fit is strong because defenders need to move from finding vulnerabilities to validating and fixing the ones that matter. Qualys is well aligned with that shift. The market skepticism is that net dollar expansion is still only 104%, so the product story has not yet translated into obvious company-level growth acceleration.
Watch total net dollar expansion, Enterprise TruRisk Management / CyberSecurity Asset Management booking mix, Patch Management attach, QFlex general availability, large-customer growth, and whether federal/partner channels create acceleration.
Qualys sells cloud-based security and compliance software. The platform inventories assets, finds vulnerabilities and misconfigurations, prioritizes true risk, validates exploitability, and helps remediate through patching, compensating controls, tickets, alerts, and automation. Its strategic umbrella is the Qualys Enterprise TruRisk Platform. S3
The long-term company case is that customers move from vulnerability visibility to cyber risk quantification and remediation. Management frames the opportunity as moving from one dollar of vulnerability management to an additional dollar of Enterprise TruRisk Management and another dollar of patch/remediation spend. That uplift remains early and should be treated as an assumption.
The growth products to watch are Enterprise TruRisk Management, CyberSecurity Asset Management upgrades, TruRisk Eliminate / Patch Management, Agent Val, TotalCloud, TotalAI, QFlex licensing, managed risk operations center partners, federal, and cyber-insurance-driven risk scoring.
Good growth investment if Enterprise TruRisk Management and patch adoption lift net dollar expansion above 110%, revenue growth moves back into low-to-mid teens, and free cash flow margins stay above 35%-40%.
Not a good setup if growth stays around 8%-9%, Enterprise TruRisk Management remains a small booking mix, and higher sales and marketing spend does not improve expansion.
Watch total net dollar expansion, Enterprise TruRisk Management / CyberSecurity Asset Management booking mix, Patch Management attach, QFlex general availability, large-customer growth, and whether federal/partner channels create acceleration.
Current market fit is strong because defenders need to move from finding vulnerabilities to validating and fixing the ones that matter. Qualys is well aligned with that shift. The market skepticism is that net dollar expansion is still only 104%, so the product story has not yet translated into obvious company-level growth acceleration.
Market data: live share price was $104.22, quote-derived market capitalization was $3.69B, and quote-derived enterprise value was about $3.01B. Fiscal.ai's normalized snapshot reported market capitalization of $3.95B, so the valuation table treats market value as approximate. S1 S2
Ten-quarter view: six reported quarters, one company-guided quarter, and the next three quarters from analyst estimates. Q2 2026 guidance midpoint: revenue $178.5M and non-GAAP diluted earnings per share $1.765. Earnings are non-GAAP diluted earnings per share because that is the guidance and consensus basis available in the earnings packages. Revenue is in United States dollars. S1 S3
| Quarter | Status | Revenue | Revenue year-over-year | Non-GAAP earnings per share | Earnings year-over-year | Basis |
|---|---|---|---|---|---|---|
| 2024 Q4 | Reported | $159.2M | +10.1% | $1.60 | +14.3% | Reported revenue and actual non-GAAP earnings per share from Fiscal.ai estimate history. |
| 2025 Q1 | Reported | $159.9M | +9.7% | $1.67 | +15.2% | Reported revenue and actual non-GAAP earnings per share from Fiscal.ai estimate history. |
| 2025 Q2 | Reported | $164.1M | +10.3% | $1.68 | +10.5% | Reported revenue and actual non-GAAP earnings per share from Fiscal.ai estimate history. |
| 2025 Q3 | Reported | $169.9M | +10.4% | $1.86 | +19.2% | Reported revenue and actual non-GAAP earnings per share from Fiscal.ai estimate history. |
| 2025 Q4 | Reported | $175.3M | +10.1% | $1.87 | +16.9% | Reported revenue and actual non-GAAP earnings per share from Fiscal.ai estimate history. |
| 2026 Q1 | Reported | $175.6M | +9.8% | $1.95 | +16.8% | Reported revenue and actual non-GAAP earnings per share from Fiscal.ai estimate history. |
| 2026 Q2 | Company guide midpoint | $178.5M | +8.8% | $1.76 | +5.1% | Company Q2 2026 guidance midpoint from the Q1 earnings package. |
| 2026 Q3 | Analyst estimate | $182.7M | +7.5% | $1.91 | +2.5% | Fiscal.ai consensus mean estimate. |
| 2026 Q4 | Analyst estimate | $187.8M | +7.1% | $1.96 | +4.6% | Fiscal.ai consensus mean estimate. |
| 2027 Q1 | Analyst estimate | $188.4M | +7.2% | $2.03 | +4.1% | Fiscal.ai consensus mean estimate. |
Three-year consensus estimates use Fiscal.ai annual revenue and non-GAAP earnings-per-share feeds. The table includes 2025 actuals as the base year and 2026-2028 consensus estimates. S1
| Year | Revenue | Revenue growth | Non-GAAP earnings per share | Earnings growth | Estimate count |
|---|---|---|---|---|---|
| 2025A | $669.1M | base | $7.07 | base | 24 revenue / 24 earnings |
| 2026E | $724.4M | +8.3% | $7.57 | +7.1% | 23 revenue / 23 earnings |
| 2027E | $775.7M | +7.1% | $8.26 | +9.1% | 23 revenue / 23 earnings |
| 2028E | $827.3M | +6.7% | $8.66 | +4.8% | 9 revenue / 9 earnings |
The peer group is intentionally mixed. QLYS, TENB, and RPD are closer vulnerability/exposure-management comps; VRNS is data-risk adjacent; OKTA is identity-adjacent; ZS, CRWD, and PANW show what faster security platforms cost.
| Ticker | Product position | Past growth | Expected growth | Valuation | Read |
|---|---|---|---|---|---|
| TENB | Exposure management, vulnerability management, cloud, identity, operational technology, and AI-security workflow orchestration through Tenable One and Hexa. | 3-year revenue CAGR +12.8% | 2-year forward revenue CAGR +7.3% | NTM EV/sales 2.7x; NTM price/earnings 13.2x; FCF margin +25.4% | Cheaper multiple, credible exposure-management narrative, but reacceleration must be proven. |
| QLYS subject | Vulnerability management, asset inventory, Enterprise TruRisk Management, patching, cloud security, and autonomous remediation through TruRisk Eliminate and Agent Val. | 3-year revenue CAGR +10.5% | 2-year forward revenue CAGR +7.7% | NTM EV/sales 4.7x; NTM price/earnings 14.1x; FCF margin +42.4% | Best profitability and balance sheet in this peer set, but revenue growth is still only high single digit to low double digit. |
| RPD | Vulnerability management, detection and response, application security, and managed threat services. Smaller and more turnaround-like than TENB or QLYS. | 3-year revenue CAGR +6.5% | 2-year forward revenue CAGR -1.3% | NTM EV/sales 0.9x; NTM price/earnings 4.2x; FCF margin +18.1% | Low multiple reflects weak forward growth and execution concern, not a quality benchmark. |
| VRNS | Data security posture, data access analytics, data threat detection, and data-centric remediation. Adjacent to exposure management but focused on sensitive data. | 3-year revenue CAGR +10.9% | 2-year forward revenue CAGR +18.0% | NTM EV/sales 4.4x; NTM price/earnings 155.8x; FCF margin +18.1% | Higher expected growth than TENB/QLYS but valuation is not cheap on earnings; data-security relevance is adjacent. |
| OKTA | Identity and access management. Relevant because identity exposure is a major risk signal, but less direct in vulnerability management. | 3-year revenue CAGR +15.2% | 2-year forward revenue CAGR +9.6% | NTM EV/sales 4.3x; NTM price/earnings 20.1x; FCF margin +30.4% | Identity comp with better scale and cash flow; more comparable as a platform-budget alternative than a product substitute. |
| ZS | Zero-trust access, secure web gateway, cloud security, and data protection. Broader secure-access platform rather than a pure vulnerability-management comp. | 3-year revenue CAGR +29.0% | 2-year forward revenue CAGR +20.8% | NTM EV/sales 7.6x; NTM price/earnings 31.9x; FCF margin +30.4% | Faster growth and strong free cash flow, but investors pay a higher sales multiple. |
| CRWD | Endpoint, cloud, identity, threat intelligence, security operations, and exposure modules on the Falcon platform. Larger, faster-growth platform benchmark. | 3-year revenue CAGR +27.7% | 2-year forward revenue CAGR +22.6% | NTM EV/sales 32.4x; NTM price/earnings 93.2x; FCF margin +29.5% | Premium platform benchmark with much faster growth and much higher valuation. |
| PANW | Broad security platform across network security, cloud security, and security operations. Useful budget-consolidation benchmark, less pure as a comp. | 3-year revenue CAGR +17.8% | 2-year forward revenue CAGR +22.2% | NTM EV/sales 18.6x; NTM price/earnings 50.2x; FCF margin +35.8% | Large platform consolidator; stronger forward growth but far larger, less comparable operating base. |
The decision hinge is whether Enterprise TruRisk Management, Patch Management, Agent Val, and QFlex become a meaningful second and third dollar of customer spend rather than a slow migration inside the existing base.
Fiscal.ai shows NTM enterprise value to sales of 4.7x, NTM price-to-earnings of 14.1x, NTM price to free cash flow of 12.9x, and NTM enterprise value to EBITDA of 10.6x. A target price is deliberately not included because a credible return frame would need a full model of renewal cohorts, share count, stock-based compensation, debt or net cash, and downside multiples. S1
Qualys may be better positioned for the remediation stage of exposure management than investors give it credit for, because it already owns patching, exploit validation, and asset context.
Enterprise TruRisk Management must raise customer spend materially, Patch Management must attach to the same base, and QFlex must reduce procurement friction without discounting away economics.
Total net dollar expansion is only 104%, management assumes no material change in the baseline guide, and ETM adoption is still early.