Qualys (QLYS) Q2 2026 Earnings Call Transcript

Qualys reported Q2 revenue of $182.2M (+11% YoY) and non-GAAP EPS of $1.98, up from $1.68 a year ago, alongside adjusted EBITDA of $83.8M (46% margin). The company raised full-year 2026 guidance: revenue to $732M–$738M (from $721M–$727M) and EPS to $7.74–$7.88 (from $7.44–$7.65), with FCF of $55.9M (31% margin). Management also highlighted rapid AI-driven remediation progress (window of exposure collapsing from 21 days to minutes; auto-patching 60% of vulnerabilities) and an additional share repurchase of $76.8M for 797,000 shares, signaling reacceleration in long-term growth.

Analysis

Qualys is being rewarded less for the quarter itself than for proving it can monetize a shift from visibility to remediation workflows. That matters because the spend pool is migrating from scan-only tools and manual ticketing toward platforms that can sit inside the control plane; that is structurally negative for Tenable, Rapid7, legacy MSP-led vulnerability programs, and any point solution that depends on separate patch orchestration. The channel mix inflecting higher is a second-order positive: it lowers CAC, broadens reach into enterprises that want a vendor-neutral layer, and should preserve margin even if direct sales remain flat.

The key risk is that the AI narrative is running ahead of budget conversion. Management is effectively telling us the second-half renewal cohort has not accelerated, so the current momentum is still a pipeline-and-conversation story rather than a broad demand re-pricing. Over the next 1-3 months, the setup hinges on Black Hat, federal procurement, and whether large customers move from pilots to platform standardization; over 6-18 months, the real test is whether autonomous remediation becomes a recurring budget line or stays a premium feature layered onto existing VMDR spend. If current billings stays in the high single digits and NDR stalls near 105%, the multiple should compress back toward "good software, not breakout".

Contrarian view: the market may be underestimating share gains from replacing managed vulnerability workflows, but overestimating the speed of that share gain. The most likely outcome is not a step-function growth reacceleration this year; it is a slower, high-margin upsell cycle with gradual mix shift toward ETM/QFlex. That makes the stock attractive on weakness, but vulnerable if Q3 fails to show better conversion from the AI urgency narrative into booked dollars.

Key Decisions for Investors

• Long QLYS on post-earnings weakness for a 3-6 month hold; thesis is margin-protected upsell, not near-term top-line reacceleration. Risk/reward improves if the stock pulls back while guidance remains intact.
• Pair trade: long QLYS / short TENB for 1-3 months. Qualys has the cleaner path to remediation monetization and channel leverage; Tenable is more exposed to scan-centric commoditization and slower platform expansion.
• Alternative pair: long QLYS / short RPD for 1-3 months. Rapid7’s exposure to legacy vuln/workflow tooling makes it a cleaner relative loser if buyers reallocate budget toward autonomous remediation.
• Set a catalyst alert on QLYS for the next earnings cycle: if H2 current billings stays 7%-8% and NDR remains ~105%, fade any valuation-driven rally; if ETM/CSAM booking mix moves materially above 14% and billings re-accelerate, add to longs.