Qualys, Inc. (QLYS) Earnings

Management highlights

### Product Innovation & Strategic Positioning - AI has fundamentally reshaped cybersecurity: AI enables adversaries to discover and weaponize vulnerabilities in hours, often before patches are released, creating an urgent need for faster, autonomous risk management that moves beyond theoretical exposure scoring. - Launched new AI-focused capabilities ahead of the Black Hat conference: * AI for Security: Introduced Instascan powered by Agent Insta, which generates high-confidence vulnerability findings within minutes of a new advisory disclosure without requiring full scans or agent disruption, followed by immediate exploit validation by Agent Val. Added autonomous zero-day remediation orchestrated by Agent Serra, with peer-to-peer patching for distributed environments, delivering a <1.5% rollback rate and auto-patching 60% of vulnerabilities, reducing exposure windows from 21 days to minutes. * Security for AI: Launched Local AI 2.0, which provides full visibility into an organization's entire AI estate, discovers shadow AI activity, extends compliance coverage to major AI SaaS platforms, and identifies security gaps across AI infrastructure and models, with all risks prioritized via Qualys' existing True Risk engine. - Qualys' AI-native Risk Operations Center (ROC) powered by Enterprise Threat Management (ETM) is differentiated from competing CTEM solutions, which only generate more findings and rely on siloed, manual handoffs that waste critical response time. ### Business Development & Customer Wins - The number of customers spending over $500,000 annually grew 8% YoY to 229. - Secured a low seven-figure QFlex annual upsell from an existing large global enterprise customer that consolidated fragmented security tools onto Qualys' platform, cutting exposure windows from months to hours and reducing manual workload. Secured a six-figure QFlex upsell from a small existing European healthcare customer that replaced its manual managed vulnerability service with Qualys' autonomous workflow, reducing cost and increasing control. - QFlex, Qualys' flexible enterprise licensing model, continues to gain traction as a strategic lever to drive platform expansion and large upsells, and is now generally available to all enterprise customers looking to expand. ### Leadership Updates - Following the departure of the former CISO and ETM General Manager, Shailesh Atle (14-year Qualys veteran and former SVP of Products) was appointed Chief Product Solutions Officer to lead ETM product strategy. Nathan Smolenski, former Global CISO at Ciara, joined as new Chief Information Security Officer.

Guidance

- Full year 2026 revenue guidance was revised upward to $732 to $738 million, representing 9% to 10% YoY growth, up from the prior guidance range of $721 to $727 million. - Q3 2026 revenue is expected to be $185.5 to $187.5 million, representing 9% to 10% YoY growth, with guidance assuming net dollar expansion remains at current 105% levels. - Full year 2026 adjusted EBITDA margin is expected to be in the mid-40s, with low-teens operating expense growth, and free cash flow margin is expected in the low 40s. - Full year 2026 diluted EPS guidance was revised upward to $7.74 to $7.88, up from the prior range of $7.44 to $7.65. Q3 2026 EPS is expected to be $1.91 to $1.98. - Full year 2026 capital expenditures are expected to be $8 to $12 million, with Q3 2026 capex of $1 to $2.5 million. - Second half 2026 current billings growth is expected to be 7% to 8% YoY, bringing full year 2026 current billings growth in line with the 9% to 10% revenue growth guidance.

Segment performance

Total Q2 2026 revenue grew 11% year-over-year to $182.2 million. Channel partner revenue accounted for 54% of total revenue (up from 49% year-over-year) and grew 22% year-over-year, while direct revenue remained flat year-over-year. Geographically, 55% of revenue came from the US (8% YoY growth) and 45% came from international markets (15% YoY growth). By product segment (on an LTN booking basis): - ETM + CSAM: 12% of total bookings, 14% of new bookings, up from 9% and 10% YoY respectively - Patch Management: 9% of total bookings, 16% of new bookings, up from 7% YoY for total bookings and flat for new bookings vs. last year - Total Cloud: 5% of total LTN bookings, unchanged YoY Overall company net dollar expansion rate was 105%, up from 104% last quarter. The net dollar expansion rate for ETM/CSAM customers remained 107% quarter-over-quarter. Adjusted EBITDA was $83.8 million, with a 46% margin (up 1pp YoY). Diluted EPS was $1.98, and free cash flow was $55.9 million with a 31% margin.

Risks & headwinds

- Forward-looking statements around future product adoption, revenue growth, and pipeline conversion are subject to material risks that could cause actual results to differ, including slower-than-expected customer budget allocation, extended enterprise sales cycles, and competitive pressures. - AI-driven acceleration of vulnerability discovery and exploitation creates market pressure that may not translate to expected near-term revenue increases, as enterprise customers typically take multiple quarters to approve and deploy long-term security program changes. - While the federal market represents a large growth opportunity, it is currently not a material part of Qualys' business, and there is no guarantee that expected pipeline opportunities will convert to meaningful revenue. - The shift to AI-accelerated threat landscapes increases the burden on security teams, and Qualys' ability to capture additional market share depends on customers successfully adopting its autonomous remediation model, which may be slower than expected.

Analyst Q&A

• Q: How has rising AI-generated vulnerability volume affected Qualys' pipeline, and how does Qualys' pro-asset pricing capture upside if CVE volumes double? /

  A: Rising AI-driven vulnerability volumes have dramatically increased customer urgency for autonomous remediation, as manual processes cannot keep pace with AI-accelerated threat timelines. Qualys' end-to-end ETM platform combines AI-speed detection (Agent Insta), exploit prioritization (Agent Val), and autonomous remediation, creating a complete solution that addresses this new threat landscape. Post-Mythos, pipeline conversations and POC activity have accelerated significantly, with many customers now actively evaluating feasible autonomous remediation roadmaps that Qualys enables. The strong current pipeline momentum positions Qualys to capture upside as these opportunities close.

• Q: Why haven't ETM and CSAM shown larger increases in new booking percentages yet, and should we expect this share to increase in H2 2026? /

  A: Quarterly new booking share percentages naturally fluctuate based on the specific mix of customers onboarding in a given quarter, so flat sequential share for ETM/CSAM is not surprising and not a sign of weak demand. The current 14% share of new bookings for ETM/CSAM is already healthy and up 4pp year-over-year, which validates strong market demand for these innovative solutions. As more customers move through their enterprise evaluation and budgeting processes, Qualys expects the contribution from these higher-growth products to increase over time.

• Q: How does Qualys balance the tradeoff between investing to accelerate long-term growth and maintaining current profit margins? /

  A: Qualys is already investing appropriately in sales and marketing, which grew 17% YoY in Q1 and 14% YoY in Q2, with a partner-led growth model that supports top-line acceleration without disproportionate incremental investment. Most investment is currently focused on headcount for GTM and product teams, plus demand generation to build quality pipeline for H2 2026. Management will continue to evaluate incremental investments as pipeline opportunities mature, while maintaining a focus on ROI to balance growth and profitability.

• Q: How does TrueConfirm exploit validation fit into the ETM sales motion, and how often does it expand into broader deployments? /

  A: TrueConfirm is a key differentiator for Qualys against competing CTEM solutions, which only provide theoretical risk scores that do not confirm actual exploitability. TrueConfirm reduces millions of theoretical vulnerability findings to the <1% of actual exploitable risks that require immediate action, making autonomous remediation a plausible solution for customers. For existing VMDR customers, TrueConfirm validation almost always expands into broader ETM adoption and purchases of Qualys' autonomous remediation (Eliminate) module, forming a natural up-sell motion that drives net dollar expansion.