QUALYS (QLYS)·Q4 2025 Earnings Summary

Qualys Beats Q4 But Stock Drops 5% as Growth Decelerates to 7-8%

February 5, 2026 · by Fintool AI Agent

Qualys delivered solid Q4 2025 results with revenue of $175.3M (+10% YoY) and non-GAAP EPS of $1.87, beating consensus estimates of $173.2M and $1.78 respectively . Despite extending its EPS beat streak to 9 consecutive quarters, shares fell 2.2% during the session and dropped another 2.7% in after-hours trading to $124.42 as investors focused on FY2026 guidance implying growth deceleration from 10% to 7-8% .

Did Qualys Beat Earnings?

Yes — both revenue and EPS exceeded expectations, extending a strong beat streak.

This marks 9 consecutive quarters of EPS beats, with an average surprise of ~16% over that period .

Q4 2025 Key Metrics vs Prior Year

What Did Management Guide?

Qualys provided FY2026 guidance that implies growth deceleration — the key reason for the stock's after-hours decline.

Q1 2026 Guidance

Full Year 2026 Guidance

The concern: FY2025 delivered 10% revenue growth, and FY2026 guidance implies a slowdown to 7-8%. With the stock trading at ~25x forward earnings, investors wanted to see sustained double-digit growth.

How Did the Stock React?

The negative reaction contrasts sharply with Q3 2025, when shares surged 21% following a 19% EPS beat . The difference: Q3 guidance was raised, while FY2026 guidance implies deceleration.

Valuation context: At $124.42, QLYS trades at ~17x FY2026E EPS of $7.31, down from 26x before the report.

What Changed From Last Quarter?

Product Mix Shifting Toward Higher-Value Offerings

The investor presentation reveals a meaningful shift in bookings composition, with legacy Vulnerability Management declining as newer products gain traction :

Net Dollar Expansion Rate: 103% — indicating modest upsell/cross-sell activity but limited seat expansion .

Calculated Current Billings Deceleration

Current billings growth slowed to 6% YoY in Q4 2025, down from 13% in Q4 2024 . This leading indicator suggests continued revenue growth moderation.

Customer Spend Trends

Large customer cohort ($100K+ revenue) continues to grow, driving platform adoption :

Full Year 2025 Performance

Product Strategy: The Path to 3x Customer Spend

The investor presentation unveiled Qualys' upsell framework — a systematic approach to tripling per-customer revenue from $1 to $3 through platform expansion :

Stage 1: VMDR ($1) — Exposure detection and visibility. Finds vulnerabilities, misconfigurations, and attack surface .

Stage 2: VMDR + ETM ($2) — Adds cyber risk prioritization with business context. ETM includes CyberSecurity Asset Management (CSAM) plus risk quantification (CRQ), threat prioritization via TruLens, and exploit confirmation via TruConfirm .

Stage 3: VMDR + ETM + PM ($3) — Adds Patch Management (TruRisk Eliminate) for automated remediation. Includes multi-vendor patching integration with Zscaler, CrowdStrike, ServiceNow, and Microsoft Intune .

The key message: "VMDR delivers visibility, not risk decisions. ETM is the risk engine of the Qualys Enterprise TruRisk Platform" .

Agentic AI serves as the automation layer across all three stages — a "marketplace of specialized cyber risk agents" to drive autonomous risk operations and reduce the cost of security teams .

Key Business Developments

Product Innovation

Management highlighted several strategic initiatives:

• Agentic AI Agent Marketplace: Unveiled AI agents that "act as a digital extension of security teams to autonomously drive cyber risk operations"
• Enterprise TruRisk Management (ETM): Added identity security (ETM Identity), industry-specific threat prioritization (TruLens), and exploit validation (TruConfirm)
• TotalAppSec: Launched unified API security, web application scanning, and malware detection
• TotalAI: Expanded with multi-modal protections and internal LLM scanning

Federal & Partner Expansion

• FedRAMP High Authorization achieved for Qualys GovCloud Platform — one of few cybersecurity platforms meeting rigorous federal standards
• Managed ROC (mROC) Alliance expanded to 15 partners including BlueVoyant, GuidePoint Security, and ImagineX
• Opened Washington D.C. office and hosted second annual Public Sector Cyber Risk Conference

Industry Recognition

Qualys received notable analyst recognition in FY2025:

• Gartner: 2025 Magic Quadrant Leader in Exposure Assessment Platforms
• IDC: Leader in 2025 IDC MarketScape Report for Worldwide Exposure Management
• GigaOm: Named Leader in Cloud Workload Security, CNAPP, Attack Surface Management, API Security, and Patch Management

Capital Allocation

Qualys announced a $200 million increase to its share repurchase program .

Balance Sheet Highlights (Dec 31, 2025)

FY2025 share repurchases totaled $183.4 million vs $139.9 million in FY2024 .

Management Commentary

CEO Sumedh Thakar emphasized the company's evolving value proposition:

"Qualys is redefining how organizations manage pre-breach cyber risk by natively unifying Continuous Threat Exposure Management with exploit confirmation, risk quantification, and automated remediation powered by an agentic AI risk fabric."

He pointed to four growth vectors: "competitive differentiation, deeper Enterprise TruRisk Management adoption, broader engagements across large federal agencies, growing partner-led execution, and early QFlex success" .

On Patch Management differentiation, Thakar highlighted:

"Qualys agents have been able to deploy 140 million patches just in the last 12 months... When the attackers are attacking you within 3-5 hours of the vulnerabilities being disclosed, you need that ability to quickly correlate a CVE, figure out that it doesn't matter to your business or that it's not exploitable in your environment, and actually get it fixed."

On the agentic AI opportunity:

"With agentic AI, we can now actually have these agents that feel like they're really part of that team, and they can help you get those outcomes... The ability to get Agent Sarah, who's an expert in patches, the ability to get Agent Val, who's an expert agent with skill sets that can autonomously make calculations and decisions on exploitation remediation."

Q&A Highlights

On Q-Flex Pricing Model

When asked about the Q-Flex beta program, Thakar explained its value proposition:

"The Q-Flex proposal allows the customer at their pace to be able to consolidate a lot of these capabilities on a single platform with Qualys over a period of time during their subscription with us... The security environment is not a static environment at the beginning of the year. It is continuously changing throughout the year. And the flexibility that the pricing model offers them to actually leverage different Qualys capabilities throughout the year as the threats change, is a very big positive for them."

CFO Joo Mi Kim noted that Q-Flex is rolling out "on a case-by-case basis" because the company wants to create "a win-win scenario" without unintentionally resulting in down-sells .

On Agent Val & Exploit Validation

Thakar provided detailed color on how Agent Val differentiates Qualys from exposure management competitors:

"What Agent Val does is leverages autonomous decision-making to basically look at the findings, look at the scoring, but then actually the ability to run a very safe exploit against the asset to confirm whether that vulnerability is actually exploitable in their environment, on their machine, or it is not — not just a theoretical score... It means that the IT teams will be saving significant amount of time not chasing down ghost scores."

On 2026 Growth Outlook

When asked about potential upside to the 7-8% baseline guidance, Thakar outlined several opportunities: federal expansion following FedRAMP High authorization, partner-led motion through mROC partners, and continued ETM adoption .

"It's very early. We are super encouraged with what we are seeing with the POCs and the conversion that we're having. But again, it's very early, right? We're talking about customers that are early adopters."

On ServiceNow/Armis Acquisition

When asked about competitive implications of ServiceNow acquiring Armis, Thakar was dismissive:

"With solutions like ServiceNow, Armis... do you have the time to create ServiceNow tickets and chase people down while attackers are having a free time exploiting your vulnerabilities?... You cannot show up for the AI fight today with your Jira tickets and your ServiceNow tickets. You got to be able to do automation and autonomous decision-making to get things fixed, and that's the differentiator."

On Pre-Breach vs Post-Breach Spending

When asked about budget trends, Thakar noted a meaningful shift in customer priorities:

"There is definitely a bit of a fatigue with these customers and saying, 'These dashboards are not helping me prevent a breach... I've invested a lot over the last few years in EDR, XDR, post-breach solutions around SOC... On the pre-breach side, they have invested in a bunch of I call them XPM tools — DSPM, SSPM, CSPM — but all of them are just giving you multiple dashboards."

On Anthropic's Cybersecurity Announcement

When asked about Anthropic's new model focusing on vulnerability discovery and patching, Thakar framed it as validation of ETM's value:

"The Anthropic development actually really helps stress the reason why after a particular vulnerability is discovered, an exploit is discovered, why it is important to use an ETM agentic AI-type solution to very quickly validate that in your environment and then actually fix it and apply a fix autonomously."

CFO Financial Detail

CFO Joo Mi Kim provided additional color on the business dynamics:

Channel momentum: Channel revenue made up 51% of total revenues vs 48% a year ago. Partners grew 17% while direct grew 4%. Management expects this trend to continue .

Geographic mix: International growth of 15% outpaced domestic growth of 6%. US/International revenue mix is now 56%/44% .

Product mix evolution (full year 2025 vs 2024) :

• CyberSecurity Asset Management + ETM: 10% of total bookings (up from 8%), 13% of new bookings (up from 9%)
• Patch Management: 8% of total bookings (up from 7%), 16% of new bookings (stable)
• TotalCloud: 5% of total bookings (up from 4%)

Retention: Gross dollar retention remained "comfortably above 90%," with modest sequential decline in Q4. Net dollar expansion at 103%, down from 104% last quarter .

2026 OpEx guidance: Investments focused on driving more pipeline, accelerating the partner program, and expanding the federal vertical. Sales & marketing to increase as a percentage of revenue, with modest increases in engineering and G&A .

Seasonality: Renewals expected to be skewed toward second half of 2026, consistent with prior years .

Industry-Leading Profitability

Qualys consistently ranks among the most profitable security and SaaS companies, achieving Rule of 50+ (revenue growth % + EBITDA margin %) :

Revenue Mix Evolution

Geographic and channel diversification continues :

The shift toward partners reflects the mROC (Managed Risk Operations Center) alliance strategy and scalable go-to-market model .

Risks & Concerns

1. Growth Deceleration: FY2026 guidance of 7-8% revenue growth represents a meaningful slowdown from 10% in FY2025, raising questions about the durability of the growth model.

2. Billings Slowdown: Calculated current billings growth of 6% (vs 13% prior year) suggests the revenue deceleration could persist beyond FY2026 .

3. Competitive Pressure: The cybersecurity market remains highly competitive, with larger players like CrowdStrike and Palo Alto Networks investing heavily in platform consolidation.

4. Customer Transitions: Analysts have noted concerns about "customer transitions and increased R&D spending potentially pressuring margins" .

Market Opportunity

Qualys is targeting a $53B+ addressable market by CY2029, up from $53B in CY2026 :

Cloud Security represents the fastest-growing opportunity — where Qualys' TotalCloud (CNAPP) and TotalAI products compete.

Forward Catalysts

• Q1 2026 earnings (expected early May 2026) — watch for billings trends and federal deal flow
• QFlex traction — management's "early success" commentary suggests this could become a growth driver
• AI agent marketplace adoption — early indicator of platform stickiness
• mROC partner expansion — currently 15 partners, targeting broader global reach

---

Data as of February 5, 2026. Stock prices and after-hours data subject to change.

View QLYS Company Profile | Read Q4 2025 Earnings Call Transcript