Qualys Stock: A Cybersecurity Leader (NASDAQ: QLYS)

The following segment was excerpted from this fund letter.

Qualys (NASDAQ:QLYS): Cybersecurity Leader w/ Renewed Product Development Focus and Growing Sales Capacity

Summary Thesis

1. Cybersecurity software portfolio that is critical to cyber defense and well positioned to take advantage of an increasingly open architecture IT network.
2. Revenue growth acceleration from the rollout of new products combined with increased investment in sales and marketing.
3. Overall cybersecurity industry tailwinds from a heightened threat environment.
4. Multiple expansion in-line with peers as revenue growth accelerates. Multiple support from private equity appetite if revenue growth fails to accelerate.

Company Overview

QLYS was founded in 1999 and provides vulnerability management software to both SMBs and enterprise customers. Vulnerability management software provides a continuous view of security and compliance across all of a company’s assets including on-premise, end-points, cloud and mobile. The easiest way to think about QLYS’s original VM solution is that it provided a dashboard that monitored all potential threats to a network and helped IT departments prioritize which vulnerabilities were the highest risk.

QLYS was a pioneer in the industry as they were one of the first companies to offer a cloud-based software as a service (SAAS) solution as opposed to the traditional license offerings that proliferated at the time. While QLYS’ VM software has always provided an industry leading dashboard to monitor weaknesses, it provided limited functionality to respond to these vulnerabilities. More recently, QLYS has increased the functionality of its software through the rollout of Detection and Response capabilities (VMDR) and extended detection and response (XDR) capabilities in late 2021.

Cybersecurity Industry Overview

The cybersecurity space has been marked by a preference of customers for point solution expertise as opposed to a winner take all solution. This market structure is driven by the complex nature of assets that need protection, the dynamic nature of security threats and the critical nature of cybersecurity, which leads to a customer preference for quality over cost. Historically, cybersecurity was best served by firewalls, which provided a ring fence around assets that were physically located on a network.

Firewalls are increasingly becoming obsolete in the cybersecurity world as the network perimeter has effectively disappeared due to the growing adoption of SaaS solutions and new connected devices that connect to the network from multiple new endpoints. This trend has only accelerated following COVID. As more devices and software tools connect from outside of the traditional firewall perimeter, the importance of security monitoring tools such as VM, VMDR and XDR has increased.

In many ways, vulnerability management is the foundation of cybersecurity as it provides the dashboard for monitoring all potential security gaps. QLYS’ software can provide critical data about which assets are exposed to specific threats and can increasingly help IT departments prioritize and remediate these vulnerabilities.

Revenue Growth Acceleration

Understanding QLYS’s history is important to gaining confidence in QLYS’ ability to maintain revenue growth going forward. QLYS was almost perfectly positioned earlier this decade to take advantage of both the transition in the software market from license to SaaS solutions as well as the cybersecurity trend away from firewalls as devices increasingly moved beyond a physical perimeter. Given the large TAM, industry tailwinds and a market leading product, QLYS was able to growth revenues at a +20% CAGR from 2012-2018.

Even more impressive, QLYS was able to accomplish this growth with limited investment in R&D or its sales force. R&D as a percentage of revenues declined from 22% in 2012 to 16% in 2018 while S&M declined from 40% in 2012 to 22% in 2018. Consequently, QLYS operates with one of the highest EBITDA margins in the industry at 45%. The ability for QLYS to post such consistent revenue growth despite under-investing in product development and sales is evidence of the strong competitive positioning of QLYS’ software and the critical nature of the product.

However, QLYS’ focus on profitability eventually caught up with the company as revenue growth decelerated to 15% in 2019 and 13% in 2020. Over time, the cybersecurity market was becoming more competitive. QLYS saw increased competition from its top 2 competitors as Tenable (TENB) made a transition to a SaaS solution and Rapid7 (RPD) used IPO proceeds to aggressively pursue growth.

Additionally, customers began to expect a more comprehensive security offering beyond just vulnerability management as this solution was reaching maturity. It was no longer sufficient to only offer a dashboard of potential vulnerabilities, customers now expected products that detected, prioritized and responded to these threats.

QLYS’s VM product continued to be well positioned in the market, it just needed to be enhanced with detection and response capabilities (VMDR). QLYS also recognized the need to offer an extended detection and response (XDR), which ingests data from all of QLYS’ endpoints to provide better analytics for network threat prevention. QLYS began re-investing in R&D in 2019 and R&D as a percentage of sales has increased from 16% in 2018 to a projected 18% in 2022.

QLYS’ VMDR solution was rolled out in early 2020 and the XDR solution was introduced at the end of 2021. With new products being added to the portfolio, QLYS had plans to invest heavily in growing its sales force in 2020. However, COVID delayed this investment, yet to company remains focused on growing its sales force in 2021 and 2022.

With product development complete and sales force investment ramping, QLYS’ revenue growth has accelerated from +13% in 2020 to a projected +18% in 2022. QLYS should be able to maintain at least a mid-teens growth rate as a broader product portfolio enables cross-selling into existing customers and investment in sales and marketing supports new customer wins.

QLYS also maintains a net cash balance and continues to generate strong free cash flow given industry leading margins and minimal CAPEX. Historically, management has not been aggressive with capital deployment, but there are signs that this is changing. QLYS’ new CEO made his first acquisition in Q3 2021 and has stated that he intends to make more targeted acquisitions going forward. Inorganic growth can serve as another tool to help accelerate revenue growth as the company can acquire companies with additional functionalities that can be sold on top of the core VMDR solution.

Valuation

I expect QLYS to grow FCF at a low teens rate over the next 5 years as revenue growth is partially offset by margin compression due to the investments discussed above. Given QLYS’ healthy cash balance and strong free cash flow generation, FCF/share growth could exceed this rate if management utilizes cash for acquisitions or share repurchases (buyback also provides a nice backstop for shares during any market weakness).

I believe QLYS should trade at a 10% premium to the market given its competitively positioned product and attractive growth outlook. Based on these assumptions, QLYS should compound investor capital at a +14% CAGR over the next 5 years.

To the extent that my expectations for growth at QLYS are overstated, a healthy appetite from private equity for software assets with strong cash flow could provide an alternative way for shareholders to benefit. Thoma Bravo’s acquisition of Proofpoint in April 2021 provides an almost perfect comp for QLYS and the potential private equity bid. PFPT provides email security software and, like QLYS, saw its stock price lag the broader tech sector as revenue growth slowed and its multiple compressed as the market viewed email security as a mature industry.

Assuming similar multiples for QLYS implies a private equity bid that could represent 70% upside. I don’t expect QLYS to pursue a private equity transaction in the near term as I believe management is confident in the revenue growth acceleration from new products and sales force investments. However, the private equity appetite does provide good downside protection.

Investment Summary

QLYS sells a competitively advantaged cybersecurity offering that can continue to maintain market leadership given the company’s renewed focus on R&D. When combined with growing investment in the company’s sales force, revenue growth should sustain in the mid-teens range. Additionally, the company’s cybersecurity end market should see continued strong growth as corporations prioritize cybersecurity spend in an increasingly hostile threat environment.

FCF is expected to grow at a +12% CAGR over the next 5 years as revenue growth acceleration is offset by investments in sales and marketing. A fortress balance sheet with a large cash balance provides optionality for M&A and/or share repurchases to grow FCF/share at an even faster rate. Unlike many other software companies that trade on revenue multiples, QLYS has valuation support based on both public and private market free cash flow multiples. To the extent that revenue growth does not materialize as expected, an active appetite from private equity for software assets could provide an attractive exit for shareholders.

Editor's Note: The summary bullets for this article were chosen by Seeking Alpha editors.

Comments are closed.