WillItSurvive
Cloud and infrastructure providers · United States

Qualys

qualys.com ↗

Qualys sells cloud-based vulnerability scanning and compliance reporting to over 10,000 enterprises.

Protection under test
Assessed 21 July 2026 · Evidence as of 21 July 2026
Something worth protecting exists and is being tested right now.
On the recordSince 21 July 2026 · Checkable from early August 2026 · Every call on the record Checkpoint: Q2 2026 earnings call: watch NRR trajectory, free cash flow margin, and language on bundled-competitor losses
The call

Qualys still prints high margins and holds Fortune 100 accounts, but its core scanning function is getting bundled by CrowdStrike and Microsoft while AI tools commoditize raw vulnerability discovery.

Qualys sells software that scans computer networks for security holes and helps companies prove they are following rules. It makes a lot of money from ten thousand large customers who have locked into its reporting and processes over many years, which makes it hard for them to switch. But two forces are squeezing it at once: big tech companies like CrowdStrike and Microsoft are stuffing vulnerability scanning into software they already sell to customers at almost no extra cost, and new AI tools from Anthropic and Microsoft can find vulnerabilities automatically and cheaply, making Qualys's core scanning ability less special. The real test is whether companies stay loyal to Qualys because of its compliance reports and workflow habits, or whether the free or cheap alternatives pull them away.

Why
01
AI pressure: Anthropic Mythos and Microsoft MDASH AI vulnerability scanners. AI tools now find CVEs directly in open-source code, cutting into the raw scanning layer Qualys built its business on. Could AI do the core job? Only partly.
02
Bigger players: CrowdStrike Falcon Exposure Management and Microsoft Defender Vulnerability Management. Both bundle exposure scanning into EDR agents customers already run, undercutting Qualys on price and installation friction. Could a giant copy it? Probably.
03
What protects it. Compliance-audit-grade reporting and workflow lock-in across Fortune 100 accounts make ripping out Qualys costly even if scanning gets commoditized.
What would change this call
Qualys NRR reported in Q2/Q3 2026 earnings stays flat or falls below 104%. Would show customer expansion is stalling as bundled rivals gain ground.
Qualys free cash flow margin in upcoming quarters stays below the 53% level reported in Q1 2026. Would show margin erosion consistent with pricing or competitive pressure.
A named Fortune 500 account publicly switches to CrowdStrike Falcon Exposure Management or Microsoft Defender Vulnerability Management. Would confirm bundled competitors are converting Qualys's largest customers.
Key numbers
  • FY2025 revenue $669M, up 10% YoY (2025-12-31)
  • Free cash flow margin fell to 53% from 67% prior year (2026-02-05)
  • NRR flat around 103-104%, ETM/CSAM cohort near 107% (2026-Q1)
Named risks
  • Flat net retention and FCF margin contraction (53% vs 67% prior year) signal early retention erosion. Severity: high
  • Platform bundling by CrowdStrike and Microsoft at near-zero marginal cost could displace standalone scanning. Severity: high
  • AI-native discovery tools like Mythos and MDASH commoditize core vulnerability detection layer. Severity: high
  • Speculation of private-equity take-private given decelerating growth remains unconfirmed. Severity: low
  • Analyst Hold consensus with price targets well below trading price implies repricing risk. Severity: medium
Rivals, as read in July 2026
RivalDirectionEvidence
CrowdStrikecontestingFalcon Exposure Management bundles scanning into existing EDR agents, shipped by 2026
MicrosoftcontestingDefender Vulnerability Management bundled into E5 seats; MDASH AI found 16 CVEs in May 2026 Patch Tuesday
Anthropicgaining onMythos AI scanner confirmed 1,726 vulnerabilities across 1,000+ OSS projects, May 2026
TenablecontestingMost direct scanner rival, acquisitive (Ermetic, Vulcan Cyber, Apex Security) through late 2025
WizcontestingCloud-native CNAPP competitor in exposure management category as of 2026
Questions people ask
Is Qualys profitable in 2026?
Yes. Qualys reported Q1 2026 GAAP net income of $50.6 million on revenue of $175.6 million (up 10% YoY), with a 47% Adjusted EBITDA margin and 53% free cash flow margin, as of March 31, 2026.
Is Qualys doing layoffs?
No evidence of layoffs. Qualys headcount grew to 2,683 employees as of March 31, 2026, up 9.82% year over year from 2,443, per company-reported data.
Could AI replace Qualys?
Partially threatened. Anthropic's Mythos AI scanner confirmed 1,726 vulnerabilities across 1,000+ open-source projects by May 2026, spooking investors, but Qualys's compliance reporting and 10,000+ customer lock-in remain harder to replicate outright.
Who is Qualys's biggest competitor?
CrowdStrike and Microsoft are the biggest structural threats, bundling exposure management (Falcon Exposure Management, Defender Vulnerability Management) into already-deployed agents at near-zero marginal cost as of 2026, alongside direct rival Tenable.
Who owns Qualys?
Qualys is publicly traded on Nasdaq as QLYS, with about 99.31% institutional/hedge fund ownership and roughly 0.72-1.00% insider ownership as of May 2026. CEO and President is Sumedh Thakar.
What is Qualys's revenue guidance for 2026?
Qualys raised its FY2026 guidance in May 2026 to $721-727 million in revenue, representing 8-9% growth, following FY2025 revenue of $669.0-669.1 million.
Timeline
  • 2026-07-15Stock rallies ~7% intraday to new 12-month high near $164 after JPMorgan upgrade.
  • 2026-07-08Qualys joins Chainguard-led Athena coalition for open-source vulnerability defense via TruConfirm.
  • 2026-06-29Analyst consensus rated Hold; average price target $122-133, below trading price of $156-164.
  • 2026-05-05Q1 2026 results: $175.6M revenue, FY2026 guidance raised to $721-727M; TruConfirm launched.
  • 2026-04-11Stock falls sharply on fears tied to Anthropic's Mythos AI vulnerability scanner.
  • 2026-02-06Shares drop 13.4% after weak initial FY2026 guidance signaled slowing growth.
  • 2026-02-05Q4/FY2025 results reported; $200M buyback increase; agentic AI agent marketplace launched.
  • 2025-04-29Qualys expands TotalAI platform to address AI and LLM model risk.
Revision history
21 July 2026
First assessed. Protection under test. The text above is fixed as of this date and is not edited afterwards.
In the same band
BrowserStackDigitalOceanHashiCorp
More in Cloud and infrastructure providers →
Sources