Qualys

Qualys helped invent cloud-delivered security scanning in 1999 and has aged into one of the most financially disciplined vendors in the sector: full-year 2025 revenue grew 10% to $669M at a roughly 47% adjusted EBITDA margin, with Q4 non-GAAP EPS of $1.87 — the rare security company that is both a durable cash machine and an S&P 400 component. The core platform continuously discovers assets, detects vulnerabilities and misconfigurations, and quantifies risk from a single cloud-delivered subscription with lightweight agents, serving enterprises and government agencies worldwide with the kind of sticky, compliance-mandated deployments that generate reliable recurring revenue. Qualys's strategic bet is to ride the market's consolidation around continuous exposure management (CTEM): its Enterprise TruRisk platform natively integrates CTEM, exploit confirmation, contextualized cyber-risk quantification, and — crucially — remediation and patch management, a differentiator against pure-play scanners that only find problems and leave customers to fix them elsewhere. Adding an agentic AI risk-management marketplace extends that platform into the automation era. In a market rewarding profitable, cash-generative software, Qualys's 47% EBITDA margins give it the flexibility to buy back stock, invest in ETM, or weather any downturn — the profile of a defensive compounder in a sector where most peers still burn cash chasing growth.

Qualys's discipline comes at the cost of growth, and the gap is widening: 10% revenue growth in 2025 is set to decelerate to a guided 7-8% in 2026 — pedestrian for security software and a sign the legacy vulnerability-management franchise is maturing while the exposure-management transition it is banking on has not reached an inflection point, with management itself conceding ETM adoption is "positive but not yet at an inflection." That is the strategic trap: Qualys is a scan-and-assess pioneer being disrupted by a market that now wants unified exposure management, and the competitors circling are formidable — Tenable and Rapid7 contest core VM, Wiz (now Google) and the CNAPP cohort own cloud-native exposure, and platform players fold vulnerability management into broader suites that make a standalone scanner harder to justify. The competitive ground is shifting fast: ServiceNow's acquisition of Armis signals that asset intelligence and exposure are being absorbed into the ITSM and platform giants Qualys cannot match on breadth. Its high margins, admirable in a stable market, can also read as under-investment relative to faster-growing rivals plowing capital into AI and platform expansion. A slow-growing, profitable incumbent in a category being redefined by better-funded platform players risks the classic value-trap outcome: durable cash flows masking a franchise that is quietly ceding the next generation of demand.