Qualys turned 53% of its quarterly revenue into free cash flow, and the stock fell 15% in three days

Qualys produced about $100 million of free cash flow on $188 million of revenue in the third quarter, a 53% margin, and raised its 2026 guidance again. The stock opened at $182.50 the next morning against a $202.46 close, and it trades at $172.51 today, about 15% below that close. The numbers did not disappoint. The expectation did: calculated current billings grew 14% in the quarter, and management guided about 8% for the fourth.

My Base value is $148.70 a share, the Bear value $113.30 and the Bull value $182.67. The price of $172.51 sits between the Base and the Bull, so the market is paying for growth above what the guidance supports. I count stock-based compensation (SBC, shares paid to employees) as a real cost, which takes about $78 million out of the free cash flow the company reports. After that cost and a tax adjustment, the Base case earns about 6.9% a year over five years, below the 9.5% I require. I could not find out why the stock fell 5.75% today.

Valuation route: profitable software company with positive free cash flow, valued with a ten year discounted cash flow model of free cash flow after stock compensation at a 9.5% cost of equity, cross-checked with enterprise value over that same cash flow. The $808 million of cash and investments is added once, and operating leases are not deducted because the lease cost is already in cash flow.

What Qualys is

Qualys sells a cloud platform that finds security weaknesses in a customer's computers, cloud services and applications, ranks them by risk and, increasingly, fixes them. The company says more than 10,000 organizations use it, including most of the Fortune 100. The pitch this year is automated repair: management says customers deployed more than 180 million patches through the platform in the past year, 60% of them autonomously.

The sales mix is moving. Channel partners produced 55% of third quarter revenue, up from 50% a year earlier, and channel revenue grew 24% while direct revenue fell 2%. The quarter was also what management called an unprecedented federal quarter, and it said a few federal deals could have slipped into the fourth quarter. Net dollar expansion, the growth in revenue from existing customers, was 105% and unchanged from the second quarter. That is a loyal base, not a fast-expanding one.

The latest results

Revenue grew 11%, adjusted EBITDA (earnings before interest, taxes, depreciation, amortization and stock compensation, as defined by the company) grew 9%, and the margin eased from 49% to 48%. Sales and marketing spending grew about 17%, faster than revenue, as the company leans on partners, and non-GAAP operating margin slipped to 46% from 47%. Earnings per share grew faster than profit because diluted shares fell 2.7%, which is the buyback at work.

Guidance for the fourth quarter is revenue of $191 million to $193 million (9% to 10% growth) and non-GAAP earnings per share of $2.05 to $2.12. For the year, revenue of $736.9 million to $738.9 million is up from $732 million to $738 million three months ago and from $717 million to $725 million in February, when the company guided to 7% to 8% growth. Full-year non-GAAP earnings per share is $8.07 to $8.14, up from $7.74 to $7.88.

Free cash flow and what it leaves out

Qualys defines free cash flow as cash from operations less capital spending. It is large and it is real, but it does not deduct the shares the company hands to employees, and it flatters a year in which customers pay in advance. Management guided a full-year margin in the low 40s; I use 43%, or about $318 million.

The jump from $231.8 million in 2024 to $304.4 million in 2025 was a step, not a trend: the 2026 estimate is 4.5% higher than 2025, not 30%. I could not verify cash taxes paid against the tax charge, so I assume part of the step came from timing and move cash flow toward a full tax rate with a $10 million adjustment. That figure is my estimate.

Free cash flow is also well above GAAP net income, about 1.5 times the roughly $217 million implied by GAAP earnings guidance. Deferred revenue explains part of that: customers prepay, billings grew faster than revenue, and the balance is $426 million. If billings slow to the guided 8%, that support shrinks.

Cash, shares and capital allocation

The balance sheet lines I read show no borrowings, so the $808 million of cash and investments is net cash, about $22.76 a share or 13% of the market value. Deferred revenue is prepaid service rather than debt, so I do not subtract it.

The company had 34.9 million shares outstanding on October 23 and guides about 35.5 million diluted shares for the fourth quarter. It repurchased 330,000 shares for $53.6 million in the third quarter and $185.6 million in nine months, which is 74% of nine-month free cash flow and more than three times the $58.4 million of SBC. About $176 million remains under the current program. Since 2018 it has retired 10.7 million shares for more than $1.2 billion. The buyback is why SBC does not cost shareholders a growing share count, but it is also cash that does not go to the balance sheet, and buying at $160 to $200 earns less than buying at the $100 of last spring.

Primary valuation: free cash flow after stock compensation

I project revenue for ten years, with growth starting at 8.5% in 2027 and fading to 3%, and set the owner free cash flow margin to move from 31.2% today to 31.5% in the Base by 2031. Each year's cash flow is discounted at 9.5%, my assumption for a mid-sized software stock, and the value after year ten grows at 3%. The cash and investments are added once at the end. Growth starts below the 10% guided for 2026 because billings are slowing and the federal quarter may not repeat.

The terminal value is 56% of the Base equity value from cash flow (Bear 49%, Bull 60%), below the 75% level that would need a closer look for a ten year model. The growth path assumes a software business that keeps expanding from a loyal base without winning many new customers, and the margin assumes that rising sales and marketing spend is absorbed by growth, not by a lower margin. The 3% terminal rate assumes the platform holds its share in a market where AI tools are changing how weaknesses are found and fixed.

Sensitivity

One point of margin is worth about $3.73 a share and one point of cost of equity about $18 to $24, so the discount rate matters more than the margin. SBC is the largest single judgment: if you ignore it, as the company's free cash flow does, the same model gives $196.41, which shows how much of the headline free cash flow belongs to employees rather than shareholders.

Secondary valuation: enterprise value over owner free cash flow

The second method values the business at a multiple of 2026 owner free cash flow and adds the net cash. I use 18.5 times for the Base, which is 13.4 times the company's own free cash flow. That sits above Check Point (11.2 times, with forecast growth of about 4%) and below Tenable (20.6 times, before stock compensation). I judge that multiple consistent with owner free cash flow growing 7% to 8% a year with high durability and almost no reinvestment need.

The peer figures come from a screener, use company-defined free cash flow before stock compensation, and carry different dates, so they bracket the multiple and do not set it. Each turn of the multiple moves the value by $6.48 a share and each $1 million of net cash by $0.03.

Cross-check against the stock's own range

In late May the stock traded near $102, and on October 26 it closed at $225.15 on a business that grew at about the same rate in both months. That is a 120% move in five months. Today's $172.51 is where the market has stopped between the two. The business did not change by 120%; the multiple did. A holder of this stock is mostly exposed to how much investors will pay for cybersecurity software cash flow, and my Base multiple of 18.5 times sits below the 23.1 times the stock trades at now.

Valuation triangulation

The two methods differ by 6.9% at the Base, far inside the 20% limit. They share one driver, owner free cash flow, so their agreement does not make me more confident than I would be with one method. The weights are 60% for the DCF, because it captures the fade in growth, and 40% for the multiple, because it reflects what buyers have paid.

On a common basis the two methods value the same business at 20.1 and 18.5 times owner free cash flow, against 23.1 times in the market. The probability-weighted value, with 25% Bear, 50% Base and 25% Bull, is $148.34, which is 14.0% below the price. I treat it as a cross-check, not a target.

Two diagnostics sit beside the valuation. Free cash flow growth is slowing: +31% in 2025 and about +4.5% in 2026, so a multi-year growth rate calculated from 2024 would overstate it. The growth-adjusted check gives a price over non-GAAP earnings of 21.3 against guided earnings growth of about 14.6%, a ratio near 1.5. I use it only as a flag: non-GAAP earnings exclude stock compensation, and the growth rate is helped by a 2.7% lower share count.

What is the market already pricing in?

At $172.51 the market wants revenue growth of about 30% in 2027, fading to 3%, with the Base margin, or a margin near 60% with Base growth. Revenue is guided to grow about 10% this year and 9% to 10% in the fourth quarter, and billings growth is guided down, so the price leans on the favorable end of what the guidance supports. A price drop of 15% in three days did not bring the stock to the Base.

Bear, base and bull scenarios

• Bear: revenue growth of 4.5% in 2027, fading to 2%, as the federal quarter reverses, AI-driven competition slows new sales and net expansion drifts below 103%. The owner free cash flow margin falls to 27% because sales spending keeps outgrowing revenue. The exit multiple is 15 times.
• Base: 8.5% growth in 2027 fading to 3%, a margin of 31.5% by 2031, and a multiple of 18.5 times. The company keeps buying back stock at about the pace of its stock compensation plus a little more.
• Bull: 11% growth in 2027, the platform wins on automated repair, the margin reaches 34.5% and the exit multiple is 23 times, close to where the stock traded last month.

The Bear sits 34% below the price and the Bull 6% above it, so the range leans to the downside. The price needs most of the Bull to deliver a return above the cost of equity.

These returns are my arithmetic, not forecasts. They assume all owner free cash flow is returned to shareholders and the net cash is still there at the end. The difference between the first two rows, 3.8 points a year, is what a lower multiple costs: even at 7.5% growth, the stock earns about 7% unless investors keep paying 23 times.

How the buy price is set

The required margin of safety follows the confidence grade, and grade B starts at 30%. I add nothing: the slowing billings and the federal pull-forward are in the Bear case and the growth path, SBC is in the cash flow, and I do not charge them a second time. $148.70 times 0.70 is $104.09. The two methods give $99.83 and $106.92 separately.

Yahoo shows a 52-week range of $74.51 to $235.55, so a price near $104.09 has traded within the past year, but before the autumn run. If you prefer a return target, the price at which the Base earns 10% a year is $151.23 and 11% a year is $145.08.

For an existing holder the price is above the Base, so I would not add. I would review the holding above the Bull value of $182.67, which is only 6% higher.

Capital return

Qualys returns cash through buybacks, not a regular payout. In nine months it spent $185.6 million, which is 74% of free cash flow, and about $176 million remains authorized. The test of this policy is the share count, which fell 2.7% in a year. At today's valuation a dollar of buyback retires fewer shares than it did at $100, so the effect on per-share value will be smaller than the past suggests.

Reasons to own Qualys

• A 53% free cash flow margin in the third quarter and about 43% for the year, with $808 million of cash and no borrowings that I could find.
• A record of beating its own guidance: the 2026 revenue range started at $717 million to $725 million and now stands at $736.9 million to $738.9 million.
• A shrinking share count, 2.7% fewer diluted shares in a year, funded from cash flow.
• Channel partners now produce 55% of revenue and grew 24%, which gives the company reach without a larger direct sales force.
• Automated repair of security weaknesses could deepen the product beyond scanning, which is the area competitors and AI tools are attacking.

What could go wrong?

• Growth is slowing: billings grew 16% in the second quarter, 14% in the third, and about 8% is guided for the fourth. Revenue follows billings with a delay.
• The federal quarter: management called it unprecedented and said some deals could have slipped into the fourth quarter. If they did, the fourth quarter benefits; if they did not, the third quarter pulled sales forward.
• Customer expansion is flat: net dollar expansion of 105% is stable but modest. Revenue growth depends on new customers.
• Direct sales are shrinking: direct revenue fell 2% in the quarter while channel revenue grew 24%. The shift lowers selling cost per sale but also lowers control over the customer.
• Competition and AI: the filings list both. Security software stocks have sold off together this year on AI concerns, and I cannot estimate how much of that risk remains.
• Valuation: the multiple moved 120% in five months. A return toward the spring level would put the stock near or below my Bear value.
• Accounting basis: free cash flow before stock pay and a possible tax timing benefit overstate what belongs to shareholders. I adjust for both, but cash taxes are an estimate.

Management execution

Management guided 2026 revenue growth of 7% to 8% in February and is now heading to about 10%, which makes the guidance conservative by roughly two points. Free cash flow reached 45% of revenue in 2025 and has been held near that level. The weaker side is spending: sales and marketing grew about 17% against revenue growth of 11%, and the non-GAAP operating margin slipped a point. The company has also bought back more than $1.2 billion of stock since 2018.

Stock Analyza scorecard

Business quality is high because the company holds net cash, has a 35% GAAP operating margin and converts sales to cash at rates few software companies match. The growth runway is the weak part. Net expansion of 105%, slowing billings and a shift away from direct sales support only three to five years of clear opportunity, so that component scores 2 of 4. I did not compute invested capital, so the return component is graded conservatively.

The valuation score is low because the price is 16% above the Base and the Bear is 34% below the price, both in the second-lowest band. A price of $155 or lower would have moved the first component up a grade.

Confidence score

The score rests on filings: the third quarter release and the 10-Q give a nearly complete bridge from reported numbers to owner free cash flow. The gaps are cash taxes paid, which I estimate, the borrowings check, which was partial, and the live price. A closing price and the fourth quarter report would close most of them.

What I would watch from here

The fourth quarter report and the 2027 guidance are the first real test of whether the slowdown in billings is a pause or a trend.

The three most important thesis breakers

1. Billings growth stays near 8% or lower and revenue growth falls below 6%, turning the Base into the Bear.
2. Sales and marketing growth keeps outrunning revenue, and the owner free cash flow margin falls toward 27%.
3. The sector multiple falls toward 15 times owner free cash flow, which would take about $23 off the secondary Base value even if the cash flow arrives.

Stress test and independent check

The model was built from the third quarter 2026 release, the 10-Q for September 30, 2026, the call summary and Qualys releases for 2024 and 2025. The primary value, the secondary value, the triangulation, the buy price, the reverse tests, the sensitivity grids and the returns were recalculated in a separate script, and the numbers in the tables come from that script.

The weakest point is the owner free cash flow itself. Full-year free cash flow, SBC and the tax adjustment are my estimates from nine months of results and a margin guide, and each is worth a few dollars a share. The conservative choices are a growth path below the 2026 pace, a multiple below today's, and stock compensation fully deducted. The generous choice is a 31.5% margin after a year in which sales spending outgrew revenue. I did not use analyst price targets in the model.

Final verdict: hold at $172.51

Qualys has shown that it can turn a quarter of software sales into cash at a rate most companies cannot. The price after the drop still pays 23.1 times what is left after stock compensation, for a business that has guided its next billings quarter to about 8% growth. The Base earns 6.9% a year, which is less than I require, and a return to 23 times is needed to earn about 11%.

Verdict: HOLD at $172.51, do not add. Base $148.70, -13.8% against the price, Bear $113.30, Bull $182.67, Confidence B (18.75/25). Required margin of safety 30%, maximum buy price $104.09, range $99.83 to $106.92 under the two methods.

The buy zone can come to the stock in two ways: a price near $104.09, or evidence that billings and owner free cash flow are growing 8% to 10% with the margin intact, which would lift the Base. A fourth quarter that includes the deferred federal deals and still guides 2027 revenue growth near 8% would be the cleanest version of that. At 23 times owner free cash flow you are paying for the federal quarter to repeat, and management has already said it may not.

Sources

Primary sources are Qualys's third quarter 2026 results (8-K, November 9, 2026) and the 10-Q for September 30, 2026. The call details (billings guide, channel mix, federal quarter, patches deployed) come from a MarketBeat call summary, and the sales spending and margin comparisons from Earnings Whispers. The February 2026 guidance and the May price come from Trefis.

Prices: the November 9 close and the November 10 opening from MarketBeat, the October 26 close and peer multiples from StockAnalysis (Tenable, Check Point, Rapid7), the 52-week low from Yahoo Finance, and the live $172.51 quote from the XTB platform.