Qualys (QLYS) : cloud cybersecurity stock analysis

2026-06-16 · By Lubin Danilo, founder of Lubin Investment

Qualys is a quiet cash machine in a noisy sector. It scores 10 out of 10 in my method: 31% FCF margin, steady growth, zero net debt. The downside: it trades 25% above my reasonable buy price today. Outstanding quality, but timing matters.

• Qualys scores 10 out of 10 in my fundamental analysis method.
• Free cash flow margin: 31.1%. Of every 100 dollars in revenue, 31 remain as real cash after all expenses.
• The stock is valued at 19.2 times its annual free cash flow. My buy target is $86.03, against a current price of $114.65: a 25% premium.
• Q1 2026 revenue of $175.6 million, up 10% year-over-year. Full-year guidance raised to $721-727 million.
• Net cash is positive: more cash than debt, a rare sign of strength in cybersecurity.

What Qualys does: scanning vulnerabilities before attackers do

Picture your IT environment as a house with hundreds of windows and doors. Qualys is the company that helps you inspect all of them, continuously, to spot the ones that are poorly locked before an intruder does.

Qualys operates in cloud vulnerability management. Its flagship product, VMDR (Vulnerability Management, Detection and Response), continuously scans enterprise systems, detects known security flaws, prioritizes them by risk level, and recommends fixes. Its CSPM (Cloud Security Posture Management) product does the same for cloud environments (AWS, Azure, Google Cloud).

What sets Qualys apart: its architecture has been fully cloud-native since it was founded in 1999. It deploys a lightweight agent on client machines and centralizes all analysis in the cloud. No hardware to install, no manual updates. It is a platform, not a product.

The 10 criteria and why Qualys scores maximum

My score out of 10 evaluates business quality independently of price. To reach 10, a company must excel on each of my criteria: profitability, growth, balance sheet strength, capital allocation. Qualys validates all of them.

Revenue growth over 5 years exceeds 12.8% per year. Free cash flow per share has grown at 16.8% per year. The company buys back 2.4% of its shares per year, which mechanically increases every shareholder's stake. And the balance sheet shows net positive cash: more money in the bank than debt. Rare in tech.

Qualys's moat: why enterprise clients don't leave

Qualys's moat rests on two pillars. First: switching costs. Deploying Qualys across an organization with 50,000 endpoints takes months. Security teams learn the interface, build workflows around alerts, integrate data into their SIEM (centralized monitoring system). Leaving means restarting that entire process.

Second: the vulnerability database. Qualys has been operating since 1999 and has built one of the most comprehensive security flaw databases on the market. This database grows continuously. Depth of coverage is a powerful selling point for security teams that cannot afford blind spots.

In Q1 2026, CEO Sumedh Thakar described Qualys's ambition as building an autonomous, AI-driven Risk Operations Center capable of prioritizing and patching vulnerabilities without human intervention. That is the strategic direction that justifies future growth.

Where do the exceptional margins come from?

A 31% FCF margin is remarkable. How does Qualys get there? Its cloud-native SaaS model has very low marginal costs: once the platform is built, adding one more customer costs little. No hardware to ship, no on-premise deployment.

Cash ROCE of 58.8% (cash generated for every dollar of capital used) confirms the model's efficiency. Net margin reaches 29.4%. These numbers are not accidental: they reflect a recurring subscription model, loyal customers, and well-targeted R&D.

Valuation: is Qualys expensive compared to its peers?

My tool measures P/FCF: the stock price divided by annual free cash flow per share. Qualys shows a P/FCF of 19.2. My buy target is $86.03. The stock trades at $114.65: a 25% premium. I do not buy at that level.

By comparison, CrowdStrike trades at roughly 60 to 80 times its FCF (depending on the period). Qualys is structurally cheaper than its most hyped peer, and far more profitable than the sector average. But 19 times remains elevated for 12-13% revenue growth.

The risks: CrowdStrike, Wiz and market consolidation

Qualys operates in a sector undergoing rapid consolidation. CrowdStrike is expanding its vulnerability management capabilities into Qualys's territory. More seriously, Wiz (acquired by Google in 2024) is building a very broad cloud security platform that includes posture management. If Wiz is aggressively distributed via Google Cloud, large enterprises could find a credible competitor bundled directly into their cloud contract.

Second risk: growth is decelerating. Qualys grows at 10-13% per year, which is healthy but not spectacular in a sector where some competitors show 30-40%. The market can lose patience with moderate growth, even very profitable growth.

For a full breakdown of Qualys numbers, visit my analysis page: lubin-investment.com/analyse/QLYS.

FAQ

What is vulnerability management?

It is the process of detecting, prioritizing and fixing security flaws in an organization's IT systems. Qualys automates this process continuously, across thousands of machines, from the cloud.

Is Qualys threatened by CrowdStrike?

Both operate in cybersecurity but in different segments: CrowdStrike is historically strong in incident detection and response (EDR), Qualys in preventive vulnerability management. The overlap exists but remains partial. The more serious threat comes from Wiz, which is building a very broad cloud security platform.

Why is positive net cash an important criterion?

A company with more cash than debt can weather a recession, make opportunistic acquisitions, or buy back shares without financial stress. It is a rare sign of strength in growth tech, where many companies take on debt to fund their expansion.

What is Qualys's CSPM?

CSPM (Cloud Security Posture Management) is a tool that continuously monitors cloud environment configurations (AWS, Azure, Google Cloud) to detect security misconfigurations. It is one of the fastest-growing segments at Qualys.

Is Qualys stock a buy today?

My quality score is 10 out of 10, but the stock trades 25% above my buy target ($86.03 versus the current price of $114.65). I watch without buying. This is not investment advice.

Voir l'analyse QLYS sur Lubin Investment

About the author

Written by Lubin Danilo, founder of Lubin Investment. A self-taught individual investor, I have analyzed stocks through their fundamentals for several years and invest my own money with this method. I codified it into a tool that judges a company's quality and its price separately, using criteria drawn from the financial literature (Warren Buffett, Michael Mauboussin, Aswath Damodaran).