Qualys' Third Quarter 2026 Investor Call - QUALYS INC

Financial Performance:

• Q3 2026 revenue grew 11% year-over-year (YoY) to $188 million; full-year 2026 revenue guidance raised to $736.9–$738.9 million (10% growth).
• Non-GAAP adjusted EBITDA was $89.9 million with a 48% margin (down slightly from 49% YoY); full-year EBITDA margin expected at 46%.
• Free cash flow was $100 million, representing a 53.2% margin; non-GAAP EPS was $2.12 per diluted share.
• Channel partner revenue accounted for 55% of total revenue (up from 50%), growing 24% YoY, while direct revenue declined 2%.
• Net Dollar Retention (NDR) remained stable at 105% overall; ATM and CSAM customer cohort NDR improved to 108%.
• Full-year non-GAAP EPS guidance raised to $8.07–$8.14 (up from $7.74–$7.88); Q4 2026 EPS guidance set at $2.05–$2.12.
• Capital expenditures for Q3 were $1.8 million; full-year guidance $9.5–$11.5 million. Share repurchases totaled $53.6 million ($330k shares), with $176.1 million remaining in the program.
• New booking growth for ETM/CSAM comprised 12% of total bookings and 14% of new bookings (up from 10%/11% YoY); TrueRisk Eliminate accounted for 9% of total and 18% of new bookings.

Guidance and Future Outlook:

• Full-year 2026 revenue growth expected at 10%; Q4 2026 revenue growth expected at 9–10% ($191–$193 million).
• Full-year 2026 EBITDA margin targeted at 46%; free cash flow margin expected in the low 40s.
• Management anticipates continued acceleration in TrueRisk Eliminate and ETM adoption, with Q4 calculated current billings projected at 8% (base case), though pipeline potential exists for outperformance.
• Long-term focus remains on shifting customer budget from reactive detection/response to proactive "pre-breach risk management" via the Risk Operations Center (ROC) model.
• Anticipated growth driven by customers consolidating fragmented security stacks into a single AI-native risk fabric to meet emerging CISA directives (e.g., 2604 requiring 72-hour remediation).

Business Segments and Product Lines:

• TrueRisk Eliminate & AgentSERA: Autonomous patch deployments up 47% since early 2026; 180 million patches deployed in 12 months with 60% executed autonomously (up from 30% YoY); rollback rate under 1 in 8,000.
• AgentInsta & InstaScan: Detects new vulnerabilities in customer environments within 60 minutes of disclosure without scanning cycles or agents.
• AgentVal & TrueConfirm: Performed ~9 million exploit validations; 11% confirmed exploitable, eliminating 89% of noise for customers.
• QFLEX: New flexible subscription model showing strong traction; first full quarter saw average annual bookings increase >20% YoY for participating customers.
• Federal Sector: Significant momentum with new federal and state wins; a large government agency consolidated seven modules (including ETM, VMDR, TrueRisk Eliminate) into a single platform, reducing detection-to-fix time from weeks to hours.
• Ecosystem & Integration: Expanded partnerships for mobile, IoT, OT, and cloud asset monitoring (including Azure, routers, and air-gapped infrastructure); integration with Dynatrace for post-deployment operational resiliency.

Market and Competitive Landscape:

• Threat Environment: Microsoft disclosed 1,414 new vulnerabilities in a single Patch Tuesday (15-fold increase from pre-AI era), accelerating the shift to autonomous adversarial attacks.
• Competitive Differentiation: Qualys positioned as the only vendor offering a native, end-to-end closed-loop solution for detection, validation, and autonomous remediation, contrasting with competitors that offer handoffs between scanning and patching tools.
• Analyst Recognition: Ranked highest for proactive security platforms (Forrester 2026) and Attack Surface Management (Kupinger 2026) for product and market leadership.
• Customer Sentiment: Shift from theoretical risk scores to validated exploitability; customers prioritizing vendors that can prove remediation closure within hours rather than weeks.
• Market Expansion: Increased engagement with CIOs and IT teams (not just security) due to "TrueConfidence" reducing operational risk and enabling resiliency budget discussions.

Risks and Challenges:

• Sales Cycle Length: No material shortening of sales cycles observed; large deals involving internal IT/Dev alignment may experience variable timing for closing.
• Revenue Recognition Linearity: Q3 revenue growth (10.7%) slightly trailed bookings due to deal timing and a higher mix of new logo acquisitions closing late in the quarter.
• Adoption Friction: Customer implementation of autonomous remediation requires organizational change management (IT/Security alignment), which can delay full platform utilization.
• Market Saturation: High volume of theoretical findings (CVEs) creates noise; competitors focusing solely on detection volume rather than actionable remediation are losing relevance.
• Pipeline Variability: Q4 bookings guidance assumes an 8% base case, acknowledging potential lumpsiness in federal deals compared to the strong Q3 performance.

Management Commentary and Tone:

• Tone was highly confident and assertive, emphasizing the "indefensibility" of traditional CTEM models against Frontier AI threats.
• Management framed Qualys not just as a detection tool but as an operational "system of action" that proves risk closure, a key differentiator for board-level reporting.
• CEO Sumedh Thakkar highlighted the urgency of the AI-driven threat landscape, citing CISA directives as a catalyst for accelerating autonomous remediation adoption.
• CFO Jimmy Kim noted strong financial discipline with robust free cash flow, supporting continued investment in sales/marketing and share buybacks.

Analyst Questions and Answers:

• Automated Patching Confidence: Management explained that "TrueConfidence" (reliability scores, rollback protection, and post-deployment monitoring) is the primary driver for IT team buy-in, enabling 20–30% of estates to be automated.
• Q4 Billings Sustainability: Analysts questioned the drop from 14–16% Q1/Q2 billings growth to an 8% Q4 base case; management attributed Q3 outperformance to specific federal closures and post-MISO cohort activations, stating base case remains prudent due to sales cycle durations.
• Competitive Dynamics: Responses indicated the market conversation has shifted from "who detects more CVEs" to "who can remediate autonomously within 72 hours," favoring Qualys' integrated stack.
• International Growth: International revenue grew 50% (vs. 7% domestic), driven by partner channels and global demand for risk-based frameworks; no specific geographic anomalies were cited beyond standard regional trends.
• QFLEX Adoption: The 20%+ booking uplift for QFLEX customers was described as consistent with expectations, validating the model's ability to reduce friction for multi-module expansion.
• Budget Shift: Confirmed a trend of shifting budgets from reactive SOC (post-breach) to proactive ROC (pre-breach), though organizational changes required for implementation may slow immediate revenue spikes.

Other Key Points:

• CISA 2604 Directive: Highlighted as a critical regulatory driver requiring agencies to operationalize risk-based remediation, directly fueling Qualys' federal wins.
• Platform Consolidation: Multiple examples of customers replacing 3–5 disparate vendors (scanners, ticketing, patching) with the single Qualys ROC platform to unify workflows.
• Zero-Day Remediation: Introduced "wave-based remediation" and peer-to-peer patching capabilities to handle high-volume, rapid exploitation scenarios.
• Risk Fabric: The concept of the "AI-native ROC" is now central to nearly all enterprise and federal customer conversations, moving beyond theoretical roadmaps to operational execution.