Software Stocks: Morgan Stanley Weighs Cybersecurity Turnarounds

Morgan Stanley turned cautious on both cybersecurity software names, cutting Rapid7 to Equal Weight with a $9 target from $10 and Qualys to Underweight with a $96 target from $117. Rapid7 posted Q1 revenue of $209.7 million, slightly ahead of estimates, but ARR fell 0.6% year over year and fiscal 2026 revenue guidance was unchanged at $836-842 million; profitability beat expectations with $24.4 million in non-GAAP operating income and $33.4 million in free cash flow. Qualys reported Q1 revenue of $175.6 million, up 9.8% year over year and above estimates, and raised fiscal 2026 revenue guidance to $724 million midpoint, but Morgan Stanley cited valuation compression and AI-native competitor concerns in reducing its target.

Analysis

The main takeaway is not “cybersecurity is fine,” but that the public-market re-rating is now being driven more by AI-driven multiple compression than by near-term operating inflection. That matters because both names are showing enough execution to avoid obvious deterioration, yet the market is refusing to pay for low-teens growth without a clearer proof point that these platforms can outgrow the category. In other words, fundamentals are stabilizing faster than valuation is willing to acknowledge, which keeps this group in a dead-money regime until a product or demand catalyst breaks the stalemate.

For RPD, the hidden issue is product mix: the healthier core is being masked by weaker adjacent modules, and that creates a trap where management can show margin discipline before revenue reacceleration. If the core platform continues to carry the business while non-core churn persists, the likely outcome is a slower but more durable base, not a clean turnaround—good enough to protect the downside, not good enough to justify multiple expansion. The Kenzo angle is important only if it shortens time-to-value in MDR and improves attach rates; otherwise it is just a roadmap bridge, not a demand engine.

For QLYS, channel strength and NDR improvement suggest the business is still monetizing its installed base, but the guidance posture implies management sees a ceiling on billings acceleration in the near term. That makes the stock vulnerable to a classic “good quarter, limited upside” setup: the market will reward beats less than it punishes any evidence that growth is normalizing at a mid-single-digit billings pace. The contrarian takeaway is that this may be a better quality compounder than the market is pricing, but only if current billings converts into durable cross-sell rather than one-off channel pull-through.

Key Decisions for Investors

• Short RPD into strength over the next 2-6 weeks; thesis is that cost discipline is already priced in while revenue inflection remains unproven. Risk/reward favors a downside drift toward the revised valuation anchor unless ARR stops contracting sequentially.
• Hold QLYS only as a relative-quality long versus weaker cybersecurity SaaS peers, not as an outright momentum long. Best expression is a pair trade long QLYS / short a lower-quality peer with negative ARR trend, with a 3-6 month horizon.
• Avoid adding to both names ahead of the next guidance cycle; the market is currently paying for certainty, not improvement. Wait for either a clear billings inflection in QLYS or a sustained core growth reacceleration in RPD before re-rating the positions.
• For risk-tolerant accounts, buy medium-dated call spreads on QLYS only on a post-earnings pullback if the stock de-rates on unchanged guidance. That structure captures a possible quality re-rating while capping premium burn if billings stagnation keeps the multiple compressed.
• Use RPD as a hedge against a broader cybersecurity basket long if you want sector exposure but believe execution bifurcation will widen. The setup is favorable for a pair where the short leg is a turnaround story with limited evidence and the long leg has cleaner demand visibility.