QLYS · Research
Qualys Bought Back More Stock Than It Kept in Owner Cash as Growth Settled Near 10 Percent
Qualys turns a third of revenue into owner cash, but since 2020 buybacks topped that cash while existing customers expanded spending by only 3% a year.
- Buybacks as a share of owner cash, 2020 to Jun 30, 2026
- 118.9%
- Cash left for shareholders after capex and all stock pay
- 33.5% of revenue
- Net dollar expansion rate
- 103%
1. Our call: Hold off, because the scan record is sticky but growth and pricing are stuck near 10%
Our call: Hold off. Qualys runs a cloud platform that finds a customer's computers, servers, cloud workloads and containers, scans them for weaknesses, ranks the risk and tracks the fix [1].
More than 10,000 customers use it, including a majority of the Forbes Global 100 [1].
It is clearly software. Customers buy renewable annual subscriptions, usually invoiced up front and recognized over the term [1].
Revenue was $669.1M in 2025 and $182.2M in the second quarter of 2026, up 11% [1][3]. The company holds $703.5M of cash and marketable securities and has no debt on its balance sheet, our sum [2].
We measure owner cash, the cash left for shareholders: operating cash flow, less capital spending, less all stock pay. Over the twelve months to Jun 30, 2026 it was $235.6M, 33.5% of revenue of $702.9M, our calculation [2][6].
The question is what Qualys does with that cash. From 2020 through Jun 30, 2026 it spent $1.20B buying back its own stock, 118.9% of the owner cash it produced in that time, our calculation
2. A subscription toll on the vulnerability record
| Metric | Value |
|---|---|
| Recurring share of revenue | Nearly all, renewable annual subscriptions [1] |
| Operating margin | 34.0%, $61.9M of operating income on $182.2M, second quarter 2026, our calculation [3] |
| Stock pay share of revenue | 11.5% in 2025 ($77.0M), 10.7% in the first half of 2026, our calculation [6][2] |
| API quality | 3 of 5, our scoring: partners embed Qualys technology and build on the platform, but most value is consumed in its own console [1] |
| Toll-gate score | 2 of 4 pass, 1 partial, 1 fail (section 2b) |
2b. Qualys holds the record and the sensors, but prices access, not outcomes
A gate is valuable when the owner holds the record others depend on and can price what passes through it. Qualys keeps the asset inventory and the vulnerability history for each customer, gathered by its own sensors and cloud agents installed on customer machines [1].
Moving that history and those agents to a rival takes work, which is why customers renew [1].
| Test | Result | Evidence |
|---|---|---|
| Owns the record | Pass | The platform builds the customer's asset inventory and stores vulnerability, compliance and risk data that customers use to quantify exposure and track fixes [1]. |
| Owns the connection | Pass | Physical and virtual scanners and cloud agents sit inside customer networks, behind firewalls, in cloud workloads and on endpoints [1]. |
| Prices close to outcomes | Fail | Customers pay a subscription fee to access each cloud solution [1]. A new program with the insurer Converge may cut premiums for customers who prove good security hygiene, but Qualys does not share in the saving [3]. |
| R&D on the gate vs features | Partial | Research and development was $117.3M, 17.5% of 2025 revenue, with 1,262 of 2,625 staff [6][1]. But first half 2026 research spending was flat at $59.7M while sales and marketing rose 16.5% [2]. |
3. Growth slowed from the teens to about 10%
The net dollar expansion rate, which compares this year's recurring revenue from last year's customers with what they paid a year earlier, was 103% in both 2025 and 2024 [1]. That means nearly all growth comes from new customers and price, not from existing customers buying much more [1].
Growth is coming from abroad. United States revenue rose 6.5% in 2025 to $377.5M, while revenue from other countries rose 15.3% to $291.7M, our calculation [1].
Channel partners sold 49% of revenue in 2025, up from 43% in 2023 [1].
4. The outlook calls for more of the same
On Aug 4, 2026 Qualys raised its 2026 revenue guide to $732.0M to $738.0M, growth of 9% to 10%, from $721.0M to $727.0M [3]. For the third quarter it guided to $185.5M to $187.5M, also 9% to 10% growth [3].
It posts third quarter results on Nov 9, 2026 [9].
Remaining performance obligations, the contracted revenue not yet recognized, were $499.9M at Jun 30, 2026, with $162.2M due in the rest of 2026 [2]. Current deferred revenue was $388.1M, down from $401.1M at Dec 31, 2025, a normal seasonal pattern for up-front annual billing [2].
Management pointed to its Enterprise TruRisk Management product, a federal pipeline helped by FedRAMP High authorization for its TotalCloud product, and partner sales as the sources of renewed growth [3].
5. Margins widened as research spending held flat
Operating income rose 20% to $61.9M in the second quarter, 34% of revenue against 31% a year earlier [3]. Gross margin was 83% against 82% [3].
Over five years, operating income grew from $87.7M in 2021 to $222.0M in 2025 [6].
The mix of spending changed. In the first half, sales and marketing rose to $79.8M from $68.5M, while research and development was $59.7M against $59.4M [2].
About 70% of employees are in India, which keeps engineering costs low [1].
Stock pay is moderate. Expense was $77.0M in 2025 and $38.2M in the first half of 2026, and the annual share grant rate averaged 2.5% of shares over 2023 to 2025 [6][2][4].
6. Owner cash is high, and buybacks take more than all of it
Owner cash is our calculation: operating cash flow less purchases of property and equipment less stock pay expense [6][2]. Second quarter operating cash rose 77% to $59.6M, 33% of revenue [3].
Buybacks run ahead of that cash. Qualys spent $126.7M on its own stock in 2020, $130.0M in 2021, $317.3M in 2022, $170.8M in 2023, $139.9M in 2024 and $183.4M in 2025 [6].
It spent another $131.4M in the first half of 2026, against owner cash of $111.3M, our calculation [2].
Across 2020 to Jun 30, 2026, buybacks were $1.20B against owner cash of $1.01B, our calculation [6][2]. On top of that, the company paid $155.2M of employee taxes on vested stock in place of issuing shares, our sum [6]
7. The balance sheet is all cash
At Jun 30, 2026 Qualys held $250.3M of cash and equivalents, $176.0M of short-term and $277.2M of long-term marketable securities [2]. Total liabilities were $512.0M, mostly deferred revenue, with no borrowings shown [2].
Cash and securities equal roughly two and a half years of buybacks at the 2025 and first half 2026 pace, our calculation [6][2]. That gives the board room to keep buying even if growth slows, and it also means the company has not used its balance sheet for a large acquisition [2].
8. The main risks are crowded competition and slow expansion
Competition. Qualys names CrowdStrike, Palo Alto Networks, Rapid7 and Tenable Holdings, and private rivals Invicti, Tanium and Wiz, which Google acquired in March 2026 [2].
Several rivals bundle vulnerability scanning into larger security platforms [2].
Expansion. A 103% net dollar expansion rate leaves little room if new customer wins slow [1].
Pricing could also come under pressure as product launches and bundling increase [1].
Channel dependence. Partners sold 49% of 2025 revenue, and their agreements do not stop them from selling competitors [1].
Concentration of staff. With about 70% of employees in India, a disruption there would hit engineering and support [1].
9. A scanning company trying to become a risk operations platform
Qualys wants customers to run a full risk operations center on its platform, moving from listing weaknesses to measuring, ranking and fixing them [3]. Its Enterprise TruRisk Management product pulls in data from other vendors' tools as well as its own [3].
If it works, Qualys becomes the record of cyber risk across a customer's tools, not only its own scans [3]. The Converge insurance program hints at a future where that record affects what customers pay for coverage [3].
If it does not, Qualys stays a strong scanner competing on price with larger platforms [2].
10. Superintelligence tools are the bull case and the threat
Qualys says it is building autonomous agents that validate and fix risk, and it joined programs run by frontier model developers to help test security uses of their systems [3]. Faster attacks raise the value of a platform that finds and closes gaps quickly [3].
The threat is that superintelligence systems make finding vulnerabilities cheap, so the scan itself loses value and buyers pay for remediation inside the platforms they already own [2]. We weight the threat slightly higher because current pricing is tied to access, not results [1].
11. A widely held company with a staggered board and a long-serving chair
Vote control. Qualys has one class of common stock, and no holder controls it [4].
All directors and executive officers as a group held 255,155 shares, under 1% [4]. BlackRock, Inc. reported 5,090,379 shares, 14.4%, in a Schedule 13G/A filed Apr 29, 2025 [4][10].
The Vanguard Group reported 4,181,323 shares, 11.8%, as of a Nov 12, 2024 filing; a Mar 27, 2026 Vanguard 13G/A reported zero shares for the parent after an internal realignment moved holdings to subsidiaries [4][7].
Activists. We found no Schedule 13D filed on Qualys and no public activist campaign [8].
The large holders file passive Schedule 13G forms [10][7].
Board structure. The seven directors sit in three classes with staggered three-year terms, so only two or three seats are up each year
12. The questions we would ask management, and the calls we are tracking
Question one: why did buybacks exceed owner cash over six years, and what share count does the board target? [6][2]
Question two: when will any product be priced on risk reduced or remediation completed rather than access? [1]
Question three: why is research spending flat while sales spending rises 16.5%? [2]
Question four: what would lift net dollar expansion above 103%, and when? [1]
Question five: why does chief executive pay ignore stock pay and the cash left for owners? That answer sets our conviction.
Prediction one: third quarter 2026 revenue lands inside the $185.5M to $187.5M guide (75%). [3]
Prediction two: the net dollar expansion rate reported for 2026 is 104% or lower (75%). [1]
Prediction three: shares outstanding on the 2026 10-K cover are below 34.65M (70%).
Bottom line: a cash machine that buys back more than it earns while growth stalls near 10%
Qualys holds a sticky vulnerability record, turns a third of revenue into owner cash and has no debt [1][2][6]. But existing customers expand only 3% a year, pricing is tied to access, and buybacks since 2020 exceeded the owner cash that funded them [1][6][2].
We would move to Buy if net dollar expansion rises above 106% or outcome-based pricing shows up in revenue, and to Avoid if growth falls below 8% while buybacks continue to exceed owner cash. Our call: Hold off, conviction 3 of 5.
Stock Profiles & Comparable Companies
QLYS Stock Profile →More Published Research
View All →Digimarc Lost 27 Percent of Recurring Revenue and Its 10-Q Doubts It Can Fund a Year
Digimarc Corporation has strong watermark technology and a 30-year central bank customer, but owner cash is deeply negative, an activist holds 18.5% and new shares keep coming.
Telos Grew Revenue 52 Percent on One Identity Program and Its Founder Filed His 13D Five Years Late
Telos Corporation reversed three years of decline on TSA PreCheck enrollment work, but owner cash was about 2% of revenue and the guide shows growth cresting.