Qualys: A Cybersecurity Gem Flying Under The Radar (NASDAQ:QLYS)

Call me old-fashioned, but I love profitable companies. I’ve bought plenty of unprofitable ones, and from time to time I did regret that decision. However, Wall Street has decided to throw caution to the wind and prop up companies on non-GAAP adjusted 3-year forward EBITDA and top-line growth at all costs, which I think has set a lot of investors up for failure.

With that, I’d like to discuss Qualys (NASDAQ:QLYS), a mid-cap SaaS cybersecurity stock that has been profitable every quarter since it went public. Founded in 1999, the company counts the majority of the Fortune 100 and Forbes Global 100 as customers.

Qualys excels in vulnerability management cloud software, ranking #1 in a G2 survey, which accounts for reviews of customer satisfaction and market penetration. However, the company offers a wide breadth of products including compliance solutions, patch management, cybersecurity asset management, threat protection, and more.

Upsell hasn’t set the world on fire, however. A key risk for the company from here is the ability to flex its add-on offerings to achieve a real market presence. Canvassing G2 and other software rankings sites, Qualys typically did not fall out among the leaders in the space, and in the case of Security Risk Analysis was among the laggards in customer satisfaction. The grid displayed below shows Cloud Workload Protection, where Qualys has yet to gain meaningful market traction.

However, with net revenue retention in the 110% ballpark on average and gross retention rates hovering around 90%, I assess the company has performed well over time in maintaining customers and tacking on offerings.

Typically, companies are looking for cloud offerings to provide minimal friction for employees while maintaining the value proposition. For cybersecurity offerings, it’s ultimately a need to feel protected without paying through the nose, and the end goal is to have it as streamlined as possible. With that, Qualys leads in vulnerability management, allowing companies to scan for vulnerabilities across hybrid workplace assets and react to those vulnerabilities in one location. Despite a lack of overall market penetration in its other offerings, companies (especially SMB’s) aren’t always going to demand the absolute best offering and then try to juggle all the applications. So long as what Qualys provides is good enough, they’ll tack those on for ease of use.

Now, that isn’t the perfect world when looking to invest in a company. Some I’ve analyzed, including HubSpot (NYSE:HUBS), manage to be a leader in nearly every software they organically pump out. What that provides is additional growth vectors. For Qualys, they are looking to onboard with VM and go from there. HubSpot can onboard with any of its leading offerings and then sell the suite. As an investor, I’m looking for Qualys to improve these offerings over time through R&D and acquisition before I’d expect the growth rates to meaningfully accelerate.

That being said, growth has been great. Looking above, the graph doesn’t even need to dip below 10% to show growth rates all the way back to 2012. That’s the model for consistency, and anyone turning their nose up at consistent double-digit growth rates for a highly profitable company can sell me their shares. In the most recent quarter, the company drove 19% revenue growth on an 81% gross margin, 45% EBITDA margin, and 109% net revenue retention. Additionally, customers spending >$500K grew 26% to 116 YOY.

However, everything hasn’t been smooth for the company. R&D and S&M expenses grew faster than revenues as management has been dissatisfied with sales performance. The Chief Revenue Officer stepped down and the CEO took over his role, and the company hired a new Chief Product Officer to improve packaging for SMB-specific targeting. The company highlighted difficulties with the value proposition for the smaller cohort of customers paying <$20K per year, and is retooling its cloud package. Some color from the earnings call by the CFO:

And just to add a little bit more color to it. The way we’re looking at it is we’ve always been a product leader. We believe that we have a very differentiated cloud platform that works very well and serves our enterprise customers that are looking to solve very complex and difficult problems. And so that’s why we’ve been successful in the last year in terms of our ability to grow both account and the dollar amount from larger organizations.

With that said, where we’ve seen the lack of growth and the inefficiency if you will is on the SME and SMB space, where if you take a look at as an example, customers who spent less than $20,000 with us, the count really didn’t grow that much and that’s been a drag on our business. That’s where we’re really focused on right now with the new product and packaging, we knew that there was friction. And this is where we’re very happy with the new product launch. And with that I am happy to accelerate and gain the momentum in that segment where we’ve seen more of the macro head, we believe that that will have an incremental revenue if you will that we’ll be able to deliver probably in the second half of 2023.

I’ve always had the mindset that I’m not concerned with problems, I’m concerned with the response. Problems will always occur, but good management teams will swarm the issue and drive meaningful resolution. That has yet to be seen, but Qualys management has definitely taken prompt action off what they see as unacceptable performance in the SMB segment off of weaker than expected bookings performance. I don’t like to see the CEO having to dual-hat, but I’d anticipate they bring in a replacement at some point in the near future.

With all that being said, guidance remains strong. Management is guiding to 13-14% revenue growth in 2023 and $4.10-$4.18 in EPS.

Looking across the market, cybersecurity is a great spot to be. Statista projects the sector to grow at a 9.63% CAGR to a total addressable market of $256B by 2028. It’s a sector most investors should be looking at to gain exposure. However, because of the lucrative opportunity, Qualys will not be free from competition as it continues to expand. CrowdStrike (NYSE:CRWD), which I own, and Palo Alto Networks (NYSE:PANW) are juggernauts in the space, with CRWD’s endpoint security offering far and away the leader in its space. Qualys competes directly in its VM offering with Falcon Spotlight, which slightly outranks it in reviews on Gartner, but which has yet to gain significant traction. However, CRWD is more well-funded, larger, and has a history of excellent performance. I think the warning signs will start flashing based on retention figures and revenue growth well in advance of some calamity for Qualys, and I will use that indicator as a time to sell if the company is overcome by its competition.

However, the company was founded in 1999 and carries with it meaningful switching costs, technical expertise, and customer relationships which have thus far managed to keep the company on the right side of a fiercely competitive and rapidly changing space.

Looking at the valuation graph above, which shows company’s prices against next twelve months sales relative to revenue growth rates, Qualys comes in at a premium to the average valuation in the cloud space. This is the case for effectively every profitable company, and is to be expected. The company is cheaper than both CRWD and SentinelOne (NYSE:S), and is also growing much more slowly. Due to its market position being somewhat more questionable, it is also cheaper than some of my favorite cloud stocks, Autodesk (NYSE:ADSK), Adobe (NYSE:ADBE), and HubSpot.

Looking at other operating metrics across the space, Qualys easily hits the Rule of 40 at 57%, and maintains low stock-based compensation figures. In fact, the company is a net buyer of its own shares, which is mind-blowing considering the space it operates in. Expenses against revenues are relatively in-line or lower than peers, and the company boasts among the best GAAP operating margins in the game, similar to another of my favorite cloud companies, Paycom (NYSE:PAYC).

Operating margins and free cash flow are pointed in the right direction, with minimal capex (projected at $18-25M in 2023) and no long-term debt. In all, it’s a pristine balance sheet, well positioned to meaningfully return value to shareholders over time.

Looking below, the company spent $104.5M in the fourth quarter on share buybacks, with $154M remaining on the current authorization. The board approved an additional $100M to add to that.

This is the chart of a compounder. The company has grown earnings at a 29% CAGR since 2012, averaged consistent revenue growth, and hasn’t deviated all that much from its long-term trendlines. The valuation has come down somewhat, which is appropriate considering earnings growth is slowing as the business matures, but I anticipate stock buybacks should allow the company to outpace its revenue growth in earnings from here.

Based on analyst estimates for earnings growth and a return to around 36X earnings, an investment today could yield around 17% annualized total returns from here. Based on consistency, strong earnings growth, and a pristine balance sheet, I do assess Qualys deserves its premium multiple. With that comes execution risk.

Based on free cash flows and a 27.65X multiple (or close to 4% FCF yield), an investment today could yield around 13% annualized.

In all, Qualys is a strong operator in an excellent space. Competition is fierce, and cybersecurity is always changing. The company’s add-on offerings nearly give me pause, but net revenue retention doesn’t lie and I anticipate the company will continue to chug along in the low double-digits revenue growth range for the foreseeable future. If the company’s vulnerability management offering were to hit a significant snag, Qualys may be more materially affected than some of its larger peers. However, that comes with the territory of investing in a $4.6B market cap cloud software company. I see Qualys as ticking all my boxes as a GARP investment and compounder, and will continue to add at fair value.