The Bull Rankings scorecard — our quality-growth score is 70.8 / 100, built from three pillars scored 0–100: Quality 95, Growth 83, Value 45 (valuation is judged against sector peers). At today's price, our reverse-DCF read says the market is implicitly betting on free-cash-flow growth of about 2% a year next year, fading to 3% a year by year ten — a gauge of how much optimism is already in the stock.
The thesis
Qualys sits on a Quality‑growth score of 70.8/100 that is anchored by a Quality pillar of 95. That number is not a vanity metric; it reflects a 29.4 % profit margin and a 36.7 % ROE that are hard to match in a software‑infrastructure shop, while carrying almost no debt at a debt‑to‑equity of 0.09. The market has already priced in a reverse‑DCF implied growth of roughly 2 % in year 1, easing to 3 % by year 10—a trajectory that is below the 10.4 % revenue growth the company just delivered. In other words, the price is already pessimistic about the pace of expansion. That leaves room for upside if the business can sustain its current momentum.
The single sharpest argument for owning QLYS today is that its free‑cash‑flow of $314 m and $6.4 b market cap make it a cash‑generating, low‑leverage platform that can buy back stock—a signal our model flags as “Buying back stock.” With a beta of 0.62, the stock is less volatile than the broader market, but it trades at a P/E of 31.7, above the sector average — which is why the Value pillar sits at 45. The PEG of 2.97 says the multiple is high relative to the earnings growth analysts expect. If the company can keep its profitability high and continue to add customers in its core segments, the low bar in the reverse‑DCF leaves room for upside, even though the multiple is not cheap.
What the business actually is
Qualys delivers a cloud‑based platform that bundles IT, security, and compliance solutions for enterprises worldwide. Its core offerings include Qualys Cloud Apps—a suite that covers cybersecurity asset management, enterprise TruRisk management, vulnerability management, detection, and response, total application security, patch management, custom assessment and remediation, multi‑vector endpoint detection and response, policy audit, and file integrity monitoring. The company also markets TotalCloud, a cloud‑native application protection platform that spans cloud workload protection, cloud detection and response, cloud security posture management, and infrastructure as code. These products target large‑scale IT and security teams that need a single, continuous‑inspection platform across on‑prem, hybrid, and multi‑cloud environments.
Revenue growth of 10.4 % YoY in the trailing twelve months is modest for a security software company, though it arrives at a high margin. The high‑margin nature of these services—evidenced by the 29.4 % profit margin—shows that the company can scale without eroding profitability.
Why it can (or can't) keep compounding
The moat is built on continuous, cloud‑native data collection and automated remediation. Once a customer’s assets are scanned, the platform generates a data lake that feeds into every product line, creating cross‑sell opportunities that are difficult for competitors to replicate without a similar breadth of services. The high operating leverage—evidenced by the $314 m free‑cash‑flow—means that incremental revenue translates almost directly into cash, reinforcing the ability to buy back shares and return value to shareholders.
Margins remain robust at 29.4 %, and the ROE of 36.7 % indicates that the company is efficiently deploying capital. The low debt‑to‑equity of 0.09 gives management flexibility to invest in product development or pursue strategic acquisitions without diluting earnings. The strongest model signal, “Durable high returns,” underscores that its return on capital has stayed far above our bar in each of the last five years.
The valuation question
The price implies a free‑cash‑flow growth of 2 % in year 1, easing to 3 % by year 10. That is well below the 10.4 % revenue growth the company just posted. The market has therefore priced in a pessimistic view of future expansion. The P/E of 31.7 and PEG of 2.97 sit above the sector average, which is the main argument against the stock. The Value pillar of 45 signals that, relative to peers, the stock is on the expensive side of the sector, but not prohibitively so. If the company can maintain its high margin and free‑cash‑flow generation, the price could justify a higher growth assumption.
In short, the cash‑flow bar set by the price is low relative to the business’s recent performance, even if the multiple is not. The upside comes from the difference between the implied growth and the actual revenue growth—a gap that suggests the market has not fully absorbed the company’s ability to compound.
The bear case
The weakest pillar in the model is Value at 45, indicating that the stock is expensive relative to sector peers. If the company’s profit margin were to slip—say, falling below 25 %—the free‑cash‑flow would shrink and the buy‑back signal would weaken. A debt‑to‑equity rise above 0.2 would also erode the low‑leverage advantage. The most concrete trigger would be a drop in the 10.4 % revenue growth to below 5 %; that would confirm the market’s pessimistic view and justify a lower price.
What would change our mind
- Revenue growth falling below 5 % YoY would confirm that the market’s pessimism is warranted and would shift the thesis toward a neutral stance.
- Profit margin dipping below 25 % would erode the high‑margin moat and reduce free‑cash‑flow, making the buy‑back signal less credible.
- Debt‑to‑equity climbing above 0.2 would introduce leverage risk and diminish the company’s ability to deploy capital efficiently.
If any of these thresholds were crossed, the current thesis would need to be revisited. Until then, the case rests on high quality, durable returns, and a low implied‑growth bar, set against a multiple that is expensive relative to peers.