The print. Qualys reported third-quarter revenue of $188.0 million, up 11% from a year ago, and non-GAAP earnings of $2.12 a share, ahead of the $1.96 consensus Investing.com cites. It raised full-year revenue guidance to $736.9 million to $738.9 million, about 10% growth. Calculated current billings, revenue plus the change in current deferred revenue, came in at $211.9 million, up 14%. Free cash flow was $100 million, a 53.2% margin, per the earnings call. It bought back $53.6 million of stock. By most standards, a very good quarter.
The reaction. Shares fell about 10.5% in Tuesday morning trading to $181.20, per Investing.com, after closing Monday at $202.46. The trigger was Q4 billings guidance of about 8% growth, down from 14%. Piper Sandler and Wedbush both sit at neutral with targets of $185 and $175. Baird raised its target to $210 and also stayed neutral. Nobody upgraded on a beat.
What the market is reading. Three numbers explain it. Net dollar expansion, how much existing customers grow their spend, was 105%, unchanged. That is a mature base renewing with a little extra, not a platform expanding. Channel partners now drive 55% of revenue, up from 50%, and channel revenue grew 24% while direct sales fell 2%. Moving to partners is a sensible cost choice, but it also tells you the direct sales engine isn’t finding much new demand on its own. And TotalCloud, Qualys’ cloud security product, is still about 5% of bookings on a trailing 12-month basis, flat year over year. The cloud security pivot investors were promised has not shown up in the numbers.
Where the growth actually is. The bright spots point at remediation, not detection. Patch management rose to 9% of bookings from 8%. Enterprise TruRisk Management and CyberSecurity Asset Management, its newer risk and inventory products, rose to 12% of bookings from 10%. Customers spending $250,000 or more grew 15% to 243. That is the right direction. When AI can turn a vulnerability into a working exploit in hours, the market stops paying for a longer list of flaws and starts paying for the ones that get fixed. Qualys is moving there. It just isn’t moving fast enough to change the growth rate.
Question the valuation. StockStory put Qualys’ market value at about $6.59 billion around the print. Against the midpoint revenue guide of about $738 million, that is roughly 9 times revenue, our math. Management guides full-year free cash flow margin to the low 40s, which on that revenue is around $300 million, so roughly 21 to 22 times free cash flow before Tuesday’s drop, also our math. That is not expensive for a business this profitable. It is expensive for a business guiding billings to 8%. The market is deciding which one Qualys is.
The uncomfortable comparison. Last week’s Varonis proxy showed what happens to a cash-generating security franchise that strategic buyers see as yesterday’s architecture: private equity sets the price. Qualys has a better margin profile than Varonis did and no sale process we know of. But a 50%-plus free cash flow margin, single-digit forward billings and a mature customer base is exactly the profile buyout funds model. If the remediation products don’t lift growth, that is where the conversation goes.
For practitioners. Qualys’ growth now depends on selling you fixes, not scans. Ask whether its patch and risk tools can close findings in your stack automatically, and how that compares with your EDR or IT platform doing the same job for free.
Is your vulnerability scanner still a separate budget line, or is it getting folded into your endpoint or exposure platform at renewal?