Software Stocks: Morgan Stanley Weighs Cybersecurity Turnarounds By Investing.com

Morgan Stanley kept cautious views on Rapid7 and Qualys, cutting Rapid7 to Equal Weight with a $9 target from $10 and Qualys to Underweight with a $96 target from $117. Rapid7 posted first-quarter revenue of $209.7 million, slightly above estimates, while Qualys reported $175.6 million, up 9.8% year over year and also ahead of consensus. Both companies showed some execution improvement, but Morgan Stanley highlighted limited evidence of a sustained turnaround and trimmed valuations on broader software multiple compression and AI-related competitive concerns.

Analysis

The read-through is not “cybersecurity is fine,” but that the category is bifurcating into operating models that reward distribution and platform breadth versus point products that need expensive reinvention. QLYS is closer to the former: channel mix is doing the heavy lifting, which usually improves sales efficiency and cushions near-term volatility, but also makes the next leg of growth more dependent on partner economics than product pull. RPD’s core platform stabilization is encouraging, yet the business still looks like a low-conviction recovery where margin improvement is more visible than durable top-line reacceleration.

The second-order effect is valuation de-rating across the cohort as investors rerate “good enough” security vendors against AI-native threat detection and automated remediation. That is more damaging for companies whose growth story depends on multiple expansion than on accelerating bookings; it compresses upside even when execution improves. In practice, this favors larger platforms and bundled security suites over standalone tooling, because procurement teams will increasingly prefer fewer vendors with clearer automation ROI.

The catalyst path is asymmetrical: QLYS likely needs multiple quarters of billings confirmation to re-rate, while RPD needs evidence that ARR can stop drifting before the market assigns any sustainable recovery premium. The risk is that both names can look operationally decent yet remain dead money if the market keeps haircutting software FCF multiples. The contrarian miss is that “AI competition” may be less about immediate displacement and more about slower renewal cycles and budget reallocation, which can persist for 4-6 quarters before showing up cleanly in reported revenue.

Key Decisions for Investors

• Short QLYS on strength or via 3-6 month put spreads: the setup is better as a valuation-compression trade than a fundamental collapse, with downside tied to any billings disappointment or continued multiple de-rating.
• Avoid chasing RPD on the profitability narrative; if long exposure is needed, use a pairs structure long a platform vendor / short RPD to isolate execution dispersion rather than sector beta.
• For event-driven positioning, buy QLYS downside protection into the next billing inflection point; the asymmetry is poor if channel growth slows even modestly.
• Consider a basket short of smaller standalone cybersecurity names versus a long in a diversified software/security leader over the next 1-2 quarters, as procurement consolidation should continue to favor bundled platforms.
• If RPD pulls back toward levels implied by 5x forward FCF, only step in with a tight stop and a 6-12 month horizon; the trade works only if ARR stabilization becomes visible, not just if margins hold.