Qualys

Moat: 2/5

Understandability: 2/5

Balance Sheet Health: 4/5

Qualys, Inc. is a leading provider of cloud-based IT, security, and compliance solutions, offering a unified platform to help organizations identify and manage vulnerabilities, protect against cyber threats, and adhere to regulatory requirements.

Investor Relations Previous Earnings Calls

The moat, understandability, and balance sheet health scores reflect a conservative evaluation to ensure a margin of safety in any assessment.

Business Overview

Qualys operates in the cybersecurity software market, primarily offering subscription-based access to its Qualys Cloud Platform. Their solutions are designed to help customers of all sizes, in various industries including financial services, healthcare, manufacturing and tech, to manage IT security risk and improve their overall security posture.

Here’s a breakdown of key aspects of Qualys’ business:

  • Revenue Streams: The company generates revenue primarily from subscriptions to its cloud platform and its various modules, encompassing vulnerability management, threat detection, and compliance solutions. The subscriptions are priced based on the size of the customer’s infrastructure and the modules they use. A smaller portion of revenue comes from professional and other related services.
  • Target Customers: Qualys serves a diverse range of organizations from large enterprises to small and medium-sized businesses (SMBs), as well as government agencies. Customers are from industries with high compliance requirements. The company’s total customer count is at 10,000, and revenue for those customer base is evenly distributed amongst enterprise, large mid-market, and SMB, according to the most recent earnings call.
  • Competitive Landscape: The cybersecurity market is highly competitive, with many players offering different types of solutions. However, Qualys differentiates itself by offering a unified, cloud-native platform that consolidates many security tools into a single interface, while providing a level of automation and customization not often found among legacy providers. Key competitors include Tenable, Rapid7, and crowdstrike.
  • What Makes Qualys Different: Qualys’ strength lies in its cloud-based architecture that allows for easier deployment, broader scalability and seamless updates. It also offers a variety of modules all under one platform, which reduces integrations and helps with security. Additionally, it has a wide range of solutions, with over 20 integrated cloud modules that have many different use cases, which the other players are not able to provide. Qualys is also known for its vulnerability data, as a core differentiator.
  • Geographic Reach: Qualys has a global customer base, with a significant focus on the United States (67%). However, the company also has strong presence in Europe and Asia.
  • Key Financial Metrics:
    • They achieved a record quarterly revenue of $141 million for 2023.
    • They are guiding a Q1-2024 revenue between $143-144.5 million.
    • Their yearly recurring revenue is $534 million at the end of 2023, up 14% YoY.
    • The company expects 13% revenue growth for 2024.
    • Their free cash flow was $178 million for the full 2023.
    • Their dollar retention rate was 109% for the quarter that ended December 31st, 2023.
    • They have 7.5 million total annual scans performed, an increase of 27% compared to 2022.
    • The company has 451 employees in R&D (which represents 44% of their employees) focused on product development.

Moat Assessment: 2/5

Qualys possesses a narrow moat. While it benefits from certain strengths, such as switching costs, an established customer base, and a unified platform, these advantages do not quite reach the level required to qualify it as a “wide moat” business.

Here’s a breakdown of factors contributing to the rating:

  • Switching Costs: The company’s subscription model with tight integration in its customers’ environments creates switching costs. However, it’s important to note that customers are able to switch to other vendors as there are many security software providers.
  • Network effects: Some security networks are better with a larger client base. However, the company doesn’t seem to have any significant network effects to their business.
  • Brand: Qualys is a reputable brand in the industry and has been recognized by industry experts for it’s work. However, it doesn’t possess the same brand value as more prevalent companies like Microsoft, Apple and Google.

  • Barriers to Entry: The security market has substantial barriers to entry for companies due to long regulatory approval processes. The difficulty in developing the software with appropriate security, and creating customer relationships increases the barrier even further. However, this doesn’t stop other companies from launching new products that may be better than Qualys.

  • Lack of Innovation: Their innovation is slow and lacks any groundbreaking technology, which makes it vulnerable to the market.

These factors give the company a bit of advantage in the long term, and might help the business maintain their returns, but does not provide the business with a wide moat.

Moat Risks and Business Resilience

Despite its competitive advantages, Qualys is susceptible to several risks that could erode its moat and affect its financial performance:

  • Rapid Technological Change: The cybersecurity sector is characterized by rapid innovation, with new threats emerging frequently, necessitating constant product development and upgrades. A competitor could develop an extremely attractive solution to compete with the company and potentially cause it to lose customers.
  • Intense Competition: The cybersecurity software market is highly competitive with other vendors trying to replicate Qualys’ products. Any loss of competitiveness in the pricing market will harm the business. The high competition also brings difficulty in maintaining market share in the industry, and can reduce profit margins over time.
  • Data Security Breaches: Given their specialization, Qualys is subject to security breaches from the outside, or from within the company, which could severely affect the business’ reputation. A data breach or leak will decrease confidence with customers.
  • Dependence on Subscriptions: Since most of Qualys’ revenue comes from subscriptions, any dip in the subscription rates will harm the company and it’s stock value, so the company needs to consistently attract new customers.
  • Integration Challenges: For newer customers, integrating the Qualys solution with their existing security systems might be costly, which might reduce the perceived value of their solution.

However, despite these risks, the business shows several strengths that increase their resilience:

  • Strong Customer Base: The company has a well-established, loyal customer base with a low churn rate. Customers are also very loyal to its brand and products, which makes the company more insulated to pricing issues.
  • Sticky Product: The more you use a product such as Qualys, and more you depend on it, it’s harder to transition to a new service. This stickiness gives the company some safety in its returns.
  • Robust Platform: The Qualys cloud platform is designed to handle many different types of security issues, giving customers an all-in-one solution, which reduces the need for integrations.
  • Recurring Revenue: Because of the subscription-based model, most of Qualys’ revenues are predictable and recurring. This can provide stability in terms of revenues.
  • Low Debt: The company has little debt which adds more security to the company during economic downturns.

Understandability: 2/5

The nature of the cybersecurity business, as well as the technical components that make up the company’s business, make it quite complex to understand for an average investor. The way the company earns money is rather straightforward, but understanding the intricacies of the software and the implications of its different solutions are rather difficult. Overall the business has a clear value proposition but the understanding of its operations and financial nuances might be tricky for an average investor.

Balance Sheet Health: 4/5

Qualys exhibits a healthy balance sheet, indicated by its low debt and high cash position.

Here’s a summary of key factors:

  • Low Debt: The company has very little debt, decreasing chances of bankruptcy even during an economic downturn.
  • High Cash: The company has a strong cash position. Cash and marketable securities amounted to $530 million at the end of the fiscal year of 2023.
  • Positive Free Cash Flow: The company is generating a good free cash flow, which is a sign that it is operating efficiently.

Recent Concerns / Controversies / Problems

  • Despite positive YoY growth, Qualys’ revenue is below expectations for the most recent quarter. For the first quarter of 2024, the company is forecasting revenues of $143 million, but analysts expect $145 million. The business did lower its full year projections as well.
  • In the last earnings call, the company’s CEO indicated that there is more uncertainty in the market and clients are more careful with spending. These factors might lead to slower growth in the short term.
  • However, the company is also putting a lot of emphasis on improving their platform and also using AI to help improve it. They are focusing on cloud products.
  • Also, the company’s new pricing strategy allows them to have increased upsell, which could help in revenue growth over time.
  • The cybersecurity market is becoming more complex and competitive as other players compete for the market. The competitive dynamics of this market are not easily predictable.

Conclusion

Qualys is a strong company that is operating in a sector that’s growing at a fast rate. Although it faces competition, the company has good financials and a somewhat narrow moat. It is not for risk-averse investors, and requires more thorough analysis and a good understanding of the company to get involved in.