Software Stocks: Morgan Stanley Weighs Cybersecurity Turnarounds

Morgan Stanley turned cautious on both cybersecurity software names, cutting Rapid7 to Equal Weight with a $9 target from $10 and Qualys to Underweight with a $96 target from $117. Rapid7 posted Q1 revenue of $209.7 million, slightly ahead of estimates, but ARR fell 0.6% year over year and fiscal 2026 revenue guidance was unchanged at $836-842 million; profitability beat expectations with $24.4 million in non-GAAP operating income and $33.4 million in free cash flow. Qualys reported Q1 revenue of $175.6 million, up 9.8% year over year and above estimates, and raised fiscal 2026 revenue guidance to $724 million midpoint, but Morgan Stanley cited valuation compression and AI-native competitor concerns in reducing its target.

Analysis

The main takeaway is not “cybersecurity is fine,” but that the public-market re-rating is now being driven more by AI-driven multiple compression than by near-term operating inflection. That matters because both names are showing enough execution to avoid obvious deterioration, yet the market is refusing to pay for low-teens growth without a clearer proof point that these platforms can outgrow the category. In other words, fundamentals are stabilizing faster than valuation is willing to acknowledge, which keeps this group in a dead-money regime until a product or demand catalyst breaks the stalemate.

For RPD, the hidden issue is product mix: the healthier core is being masked by weaker adjacent modules, and that creates a trap where management can show margin discipline before revenue reacceleration. If the core platform continues to carry the business while non-core churn persists, the likely outcome is a slower but more durable base, not a clean turnaround—good enough to protect the downside, not good enough to justify multiple expansion. The Kenzo angle is important only if it shortens time-to-value in MDR and improves attach rates; otherwise it is just a roadmap bridge, not a demand engine.

For QLYS, channel strength and NDR improvement suggest the business is still monetizing its installed base, but the guidance posture implies management sees a ceiling on billings acceleration in the near term. That makes the stock vulnerable to a classic “good quarter, limited upside” setup: the market will reward beats less than it punishes any evidence that growth is normalizing at a mid-single-digit billings pace. The contrarian takeaway is that this may be a better quality compounder than the market is pricing, but only if current billings converts into durable cross-sell rather than one-off channel pull-through.

The broader trade is relative, not directional: software cybersecurity names with clearer AI monetization or faster growth should keep taking share of capital from slow-turning legacy platforms. If AI-native security vendors keep pressuring valuations, expect investor preference to shift toward either scale leaders with recurring platform breadth or special situations with visible operating leverage. That leaves both names tactically vulnerable to multiple drift even if the fundamentals do not break.

Key Decisions for Investors

• Short RPD into strength over the next 2-6 weeks; thesis is that cost discipline is already priced in while revenue inflection remains unproven. Risk/reward favors a downside drift toward the revised valuation anchor unless ARR stops contracting sequentially.
• Hold QLYS only as a relative-quality long versus weaker cybersecurity SaaS peers, not as an outright momentum long. Best expression is a pair trade long QLYS / short a lower-quality peer with negative ARR trend, with a 3-6 month horizon.
• Avoid adding to both names ahead of the next guidance cycle; the market is currently paying for certainty, not improvement. Wait for either a clear billings inflection in QLYS or a sustained core growth reacceleration in RPD before re-rating the positions.
• For risk-tolerant accounts, buy medium-dated call spreads on QLYS only on a post-earnings pullback if the stock de-rates on unchanged guidance. That structure captures a possible quality re-rating while capping premium burn if billings stagnation keeps the multiple compressed.
• Use RPD as a hedge against a broader cybersecurity basket long if you want sector exposure but believe execution bifurcation will widen. The setup is favorable for a pair where the short leg is a turnaround story with limited evidence and the long leg has cleaner demand visibility.