was: Composite fair value: $150.09 → signal-adjusted: $153.02 vs current price $109.90 (+39.2%). Methods disagree — mixed signals. Treat the composite with caution. RED FLAG: Sector in contraction — demand weakening across the industry. Market prices in less growth than projected — potential for re-rating if growth materialises.

now: Composite fair value: $153.70 → signal-adjusted: $196.69 vs current price $138.55 (+42.0%). Methods disagree — mixed signals. Treat the composite with caution. RED FLAG: Sector in contraction — demand weakening across the industry. Market prices in less growth than projected — potential for re-rating if growth materialises.

was: —

now: Modestly undervalued mature compounder — fair value $150-165 vs $128 today; starter position justified, but the Q1'26 sequential stall ($176.6M vs $175.3M) means wait for the next print before adding.

was: I align with Opus's assessment of the company being reasonably priced but propose a slightly more conservative fair value range of $120-$130, considering competitive pressures and sector dynamics that could temper future growth.

now: I diverge from Opus's valuation—while they suggest a fair value of $150-165, I perceive a fair value closer to $140-150, reflecting cautious optimism given the sequential stall and competitive landscape.

was: The market is pricing Qualys as a mature security SaaS company trading at a discount to high-growth security peers (CRWD, S at 15-20x P/S) but at a premium to traditional enterprise software (5-8x P/S). The current 6.4x P/S multiple implies the market expects continued margin expansion and stable double-digit growth, but not breakout growth. The 29% drop from 52-week high suggests either profit-taking after strong run or concerns about growth deceleration in a consolidating security market.

now: The market is pricing Qualys as a stable, mature cybersecurity infrastructure play with predictable mid-single-digit revenue growth and gradual margin expansion. At ~30x FCF ($4.5B market cap / $300M FCF run rate), the stock implies investors expect continued compounding but no reacceleration. The 15% decline from 52-week highs suggests concern that next-gen endpoint players (CrowdStrike, SentinelOne) are winning mindshare, and that Qualys' vulnerability management platform may be commoditizing despite strong financials.

was: Platform consolidation risk: Large vendors (Microsoft, CrowdStrike, Palo Alto) bundling vulnerability management into broader platforms could compress standalone pricing power · Growth deceleration: 10-15% growth is respectable but below security sector average; any slowdown to high single digits would trigger multiple compression · Customer concentration/churn: SaaS model depends on net retention; any deterioration in upsell/cross-sell motion would impact growth trajectory · Competitive intensity: Vulnerability management is crowded (Tenable, Rapid7, traditional players) with low switching costs once customers standardize on a platform · Macro sensitivity: While security is defensive, vulnerability management can be deprioritized in budget cuts vs. threat detection/response tools

now: Platform commoditization: Cloud-native competitors (Wiz, Orca) are attacking Qualys' core VM/DR market with faster, cheaper solutions. If enterprises view vulnerability scanning as a commodity feature rather than a platform, pricing power erodes. · Best-of-breed vs platform risk: Enterprise security buyers may prefer specialized point solutions (CrowdStrike for EDR, Tenable for VM, Wiz for CSPM) over Qualys' integrated but potentially 'good enough' approach. This is the classic platform dilemma. · Customer concentration and churn: SaaS companies can appear healthy on revenue growth while underlying cohort economics deteriorate. Need to watch for any signals of renewal rate compression or increased customer acquisition costs. · R&D treadmill risk: Security requires continuous innovation to stay relevant (new attack vectors, cloud architectures, compliance regimes). If R&D intensity must increase from current 19-20% of revenue, margin expansion story breaks. · Private equity/strategic takeout risk: At $4.5B with strong FCF and no debt, Qualys is an obvious LBO or strategic acquisition candidate. This caps upside but provides downside support—material for valuation assumptions.

was: Margin expansion acceleration: Moving from 83% to 85%+ gross margin and 30% to 35%+ net margin would significantly improve FCF and valuation · Module attach rate improvement: Evidence of customers adopting 3+ modules (vs. core vulnerability management) would validate platform strategy and increase LTV · Strategic M&A or partnership: Integration with major cloud providers (AWS, Azure, GCP) or security platforms could expand TAM · Enterprise wins: Landing Fortune 100 logos or large government contracts would signal competitive strength vs. newer entrants · Share buyback acceleration: With $300M+ FCF run rate and no debt, aggressive capital returns could support multiple expansion

now: Platform consolidation proof points: Customer case studies or public statements about replacing 3+ security tools with Qualys would validate the platform thesis and support multiple expansion. · Margin inflection: If gross margins continue expanding toward 85%+ and operating leverage kicks in (SG&A as % of revenue declining), could drive FCF growth above 15% annually and force multiple rerating. · New module traction: Evidence that TotalCloud, CSPM, or container security are gaining enterprise adoption and contributing meaningful ARR would signal Qualys is evolving beyond legacy VM platform. · Strategic acquisition or partnership: Qualys acquiring a next-gen endpoint or SIEM player, or partnering with major cloud provider (AWS, Azure), could accelerate growth and validate competitive positioning. · Activist involvement or buyback acceleration: With $300M+ FCF and no clear M&A strategy visible, aggressive capital return could surface value. Activist could push for strategic alternatives given the LBO-friendly profile.