In my opinion, it is likely for Qualys (NASDAQ:QLYS) to achieve alpha in the near term because it has recently lost a significant portion of its Microsoft (MSFT) partnership, which, among other catalysts, has reduced Wall Street EPS estimates for the next two full years, 2024 and 2025. As a result, the recent ~30% pullback in price seems to present somewhat of a buying opportunity, as the contraction in valuation multiples for the company is unlikely to last because its fundamental growth is likely to improve toward 2026. This means that the potential value opportunity is likely to be able to deliver alpha over 2.5 years despite growing competition and consolidation from advanced players like Palo Alto Networks (PANW) and CrowdStrike (CRWD). That being said, over a long-term horizon I think alpha is somewhat less likely if broader growth catalysts cannot sustain the company’s continued advance. For investors holding for 5-10 years, some moderate alpha is possible because the company is likely to stabilize its growth rates in due course again, and the valuation multiples should re-expand toward historical averages as a result, but most of the alpha is likely to be gained in a few years, rather than many, due to the present favorable valuation. My personal opinion is that over the long term, this investment will underperform the market.
Operational Analysis
Qualys is a leading provider of cloud-based security and compliance solutions. It offers vulnerability management, continuous monitoring, compliance management, web applications security, cloud security, data analysis and reporting, and scanners and agents, among other offerings. Qualys serves over 10,300 companies in over 130 countries, including a majority of the Forbes Global 100. Some of its major partners include BT (OTCPK:BTGOF), Dell (DELL) SecureWorks, IBM (IBM), and Verizon (VZ).
Qualys competes with multiple other firms, many of which are much larger than it. For example, Tenable (TENB) is a direct competitor in vulnerability management and risk analysis, CrowdStrike is a direct competitor in endpoint protection but more acutely competes with Qualys in broader security management, and Palo Alto Networks emphasizes proactive threat prevention and comprehensive network security; PANW is notably more hardware-centric than Qualys.
The cybersecurity market is expanding rapidly, especially as trends in AI, automation, robotics and cloud infrastructures scale. As a result, while the larger competitors like CRWD and PANW seem daunting to the smaller Tenable and Qualys, it is fair to state that the market is large enough for long-term growth to be achieved by mid-cap and even small-cap firms if the offerings are differentiated enough and priced effectively. That being said, growth expectations for mid-cap firms like Qualys should be moderate in comparison to larger firms like CRWD due to the latter’s outsized capabilities in moat consolidation and economies of scale.
Crucial to the lower market sentiment for Qualys stock at the moment is that Microsoft and Qualys have mutually decided to sunset their embedded integration within Microsoft Defender for Cloud. Qualys will continue to be available as a Bring Your Own License (‘BYOL’) model for servers. In addition, the strategic partnership between MSFT and QLYS continues in other areas, such as Qualys remaining a participant in Microsoft’s Security Copilot Partner Private Preview. Revenue and earnings have dropped significantly since the announcement, implying a considerable knock-on effect from the close of the embedded integration. However, it might be likely that the market has overreacted, and as a result, the valuation has become more appealing and could improve over the long term due to other future growth catalysts.
Qualys has strengthened its partnership with Oracle, integrating VMDR (Vulnerability Management, Detection and Response) and TotalCloud solutions with Oracle (ORCL) Cloud Infrastructure (‘OCI’). In addition, management has strengthened its partnership with Orange Cyberdefense, incorporating Qualys VMDR into Orange’s managed Vulnerability Intelligence Service. Furthermore, management has decided to launch a new Managed Security Services Partner (‘MSSP’) Portal in an effort to streamline client, subscription, and security services management for partners. The company also plans to introduce a “modernized” partner program in 2024, and management has unveiled new innovations like TotalCloud 2.0 and TruRisk Insights, providing a unified view of risk across multi-cloud environments. All of these developments are highly indicative that management has been taking a proactive approach to drive growth despite the recent MSFT setback. Despite the current forecasted contraction in earnings and revenue growth, the company is well-positioned to recover based on the investments and partnerships it has been cultivating, in my opinion.
Financial & Valuation Analysis
Qualys has been growing slowly and steadily, and I don’t expect this to change over the long term despite the 2025 and 2026 lower growth projections from Wall Street. Therefore, I think that in the short term (2.5 years), alpha is highly likely to be gained from Qualys. I think toward the end of 2025, the valuation multiples should begin to expand as higher growth forecasts near. Therefore, I think in the very near term, alpha is unlikely, but over 2.5 years, decent alpha could be achieved. Therefore, my rating is a Buy, and I aim to revisit this stock when it nears my estimated price target to likely downgrade it to a Hold because, over the long term (5+ years), I do not expect this investment to achieve any alpha reliably.
As we can see in my second chart here, Qualys is definitely cheap compared to historically. I do not think it is unreasonable for the PE ratio to expand from the current circa 32.5 toward 40 again nearer 2026. If the company manages an EPS CAGR of 9.9% from the current TTM basic EPS of $4.40, its basic EPS will be $5.56 in December 2026 after a period of 2.5 years. Therefore, if the PE is 40 at the period end, the stock price will be $222.29, implying a price CAGR over 2.5 years of 19.4% from the present stock price of $139.50.
There are obvious risks with this coming to fruition, and the main one from a valuation standpoint is that the multiples do not expand as much as I anticipate in the timeframe I have allotted (2.5 years). In a more bearish instance, the market may only expand the PE ratio to 36 by December 2026. The result of this, in line with the Wall Street consensus for EPS estimates, would be a stock price of $200 in December 2026, implying a price CAGR over 2.5 years of 14.6%. Therefore, even in this more pessimistic outcome, I expect Qualys to outperform the S&P 500 (SP500) over the next 2.5 years if the index returns only 10% per annum in price, which is what I expect as a baseline.
There are other benefits that the company commands, which strengthen my thesis, including a low level of debt, indicated by a debt-to-equity ratio of 0.09, which includes lease obligations, and an equity-to-asset ratio of 0.47. In addition, the company’s margins have been expanding over 10 years, and I think this bodes very well for my thesis playing out due to the higher potential for YoY EPS growth boosting market sentiment.
Risk Analysis
I mentioned in my operational analysis above that there are several developments management is working on to sustain long-term growth. However, there are also risks that these strategies will not work as planned.
The Oracle partnership involves significant technical complexity and a shared security model in a cloud environment, which can lead to complexities, and Qualys customers may struggle with the change, leading to security gaps and unintended reputational losses for the company. Similar risks also apply to the Orange Cyberdefense partnership. The complexity of these deals will also increase as the partnerships scale, so I think management will likely need to continue to invest in its infrastructure, which could pressure margins in the short term, to remain competent in capabilities related to partnership, ease of use, and customer satisfaction.
Furthermore, with Microsoft developing its own Defender Vulnerability Management (‘MDVM’) solution, Qualys faces increased competition from this former major partner, and I think these larger firms should not be underestimated. Technology ecosystems seem to be becoming ever more unified and consolidated, and I think Qualys may even be approached for acquisition by larger firms like PANW or CRWD as they scale and build out their moats. There could be periods where Qualys is negatively impacted by competitive pressures, and there is no guarantee of a buyout, although that is what one would be hopeful for if cybersecurity consolidation becomes more acute.
I also think that because Qualys is relatively smaller than larger firms, it may have trouble dealing with high-profile attacks, including from new capabilities arising in quantum-computing malware and AI-led cyber threats. I think it is not unlikely for Qualys to face increasing reputational hazards as the threat landscape evolves and becomes more advanced, potentially with nascent malware that only the most developed cybersecurity large-caps can be adequately prepared for.
Due to the fact that the risk landscape is quite broad for Qualys and the fact that its long-term alpha is unlikely from a pure growth standpoint, I think Qualys deserves a Buy rating for near-term alpha, and not a Strong Buy, as achieving long-term alpha seems much less likely.
Conclusion
Based on my analysis, Qualys is very cheap, which is made evident by its much lower valuation multiples compared to historically. As a result of this, I think investors are likely to achieve alpha over 2.5 years, and my baseline CAGR estimated over the period is roughly 19.5%. However, once the company is more fairly valued again, which I believe will be around December 2026, I think long-term alpha is unlikely because the fundamental growth of the firm is unlikely to beat the S&P 500 without buying it at the present low valuation. I think investors would be wise to sell their stake if buying now near to when my price target is met. Partly, I think this shorter-term thesis is supported by the fact that market consolidation is becoming more apparent for large-cap cybersecurity firms, and the risk landscape is evolving to become more severe for Qualys over the long term. Therefore, this investment works better as a 2-3 year value play.
Read the full article here