Qualys: An Interesting Player In Cybersecurity Sector, But At A Rich Valuation (QLYS) | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #ransomware

Investment Thesis

In an increasingly interconnected world, cybersecurity has become paramount for individuals and businesses alike. Among the industry leaders, Qualys (NASDAQ:QLYS) stands out as one of the companies with the largest customer base, so it is worth thinking about it to seek exposure to the sector.

In this article, we will discuss the business model and its importance for clients, explore the characteristics that make companies in this sector interesting options for investment, and conduct an assessment to draw conclusions about whether it can be a good investment at the current price.

Business Overview

Qualys specializes in cybersecurity for IT assets and has combined all its services into a cloud-based platform, providing a unified view of IT asset inventory and security-related aspects. This platform is called Qualys Cloud Platform and allows its clients to do different actions, including:

1. Identify and manage IT assets in local, cloud, and mobile environments.
2. Collect and analyze large amounts of IT security data.
3. Discover vulnerabilities in your systems.
4. Implement remediation actions against vulnerabilities.

Basically, Qualys helps organizations to protect their systems and software applications from cyberattacks and since it is cloud-based, no hardware installations are required, which reduces costs and makes installation and maintenance easier. To better understand what type of IT assets a company might want to protect, I will give you some examples of these:

• Data centers and physical servers of the company.
• Software and apps developed internally by the company.
• Software licenses.
• Digital data of operations.
• Devices for end users, such as desktop computers, monitors, printers, phones, among others.

As can be seen, most of these assets are essential for the company’s operations. We can consider that the Qualys platform is of critical importance, making it difficult to do without. This generates very high customer loyalty, recurring and predictable revenue, and incurs certain switching costs. Once a client entrusts their cybersecurity to Qualys, it wouldn’t make sense to take a risk with another provider, even if they offer the service at a lower price.

Qualys Cloud Platform

Within this platform, Qualys clients can subscribe to one or more applications according to their needs. There are more than 20 applications in total, and they are segmented for the functions of IT Security, Policy Compliance, App Security, Cloud Security, IT Asset Management, and VMDR.

You could say that it is like an App Store or Google Play Store for companies seeking to protect and manage their IT assets.

Customers and Monetization

The way Qualys makes money is through these subscriptions, which gives it predictable revenue, as I mentioned previously.

As for clients, there are currently more than 10,000 and none represents more than 10% of revenue, which mitigates risks of client concentration. Furthermore, 61% of the customers are in the United States and are blue chip companies like Apple, Amazon, Ford, Home Depot or Netflix.

Key Ratios

The evolution of Qualys revenue and Free Cash Flow is what we would like to see in any company. It has been stable growth in the top line accompanied by profitability. In the last decade, revenues grew 18% annually, while EBITDA grew 34%, similar to FCF. This shows that the company has managed to improve its margins noticeably.

This is clearer in the following image, where the Free Cash Flow Margin went from 10% in 2013 to the current 35%. Currently, the margin has been compressed because the company is dedicating a large part of its investments to improving the platform and management commented that they could spend one or two years with lower margins than usual.

“Given that, we anticipate operating expenses to increase as we expand our sales organization and our channel efforts, as well as focus on digital marketing and demand generation initiatives … innovation remains a top priority. So incremental investment in our platform is anticipated … We believe these planned investments will position us to further accelerate our growth and maximize shareholder value.”

I find it very positive that the board is not afraid to put short-term returns aside to focus on investing heavily and becoming a leader within the sector.

The growth has been accompanied by average returns on invested capital of 15%. This is quite positive and indicates that the company uses its capital efficiently, achieving returns above the market average.

In terms of debt, although it is true that the graph shows a clear increase in the level of leverage, it currently remains at an extremely positive ratio of -1.05x Net Debt/EBITDA. That is, with the current EBITDA they can pay their entire debt. This is because the company has total debt of $34M; however, it owns Cash and Cash Equivalents of $186M. With pure cash on the balance sheet, they could pay off all their debt.

Valuation

For the valuation, I will use a Reverse DCF Model to know the growth that the market expects from the data we already know. Considering FY2022 numbers:

• Shares Outstanding 39M
• Cash $173M
• Debt $42M
• FY2022 FCF: $182M
• Expected CAGR Return: 15%
• Terminal Growth Rate: 4%

With this data, Free Cash Flow would have to grow 22% annually so that investors could obtain an approximate return of 15% CAGR in the share price. For my part, I think that a realistic FCF growth would be 10-15% per year, so assuming 15% per year growth in FCF, we could expect a share price return of 11%, which is unattractive even for the quality of the business.

Qualys has a YTD return of 35%, so it is normal that the valuation has been adjusted and offers little return. To obtain a 15% CAGR with 15% FCF growth, we would have to buy at close to $100 USD, similar to the values at which the company started the year

Risks

Although cybersecurity is an anti-crisis and recurring business, there are also risks that must be considered:

Cybersecurity Threats: As ironic as it may seem, as a cybersecurity company, Qualys is itself a target for cyberattacks. The company must continuously defend against hacking attempts, data breaches, and other cybersecurity threats that could compromise its systems and the security of its customers.

Competition: The cybersecurity market is highly competitive, with many companies offering similar products and services. Qualys faces the risk of losing market share to competitors who may offer more innovative solutions. The key here is to maintain good treatment of its large customer base and maintain a good reputation in the sector. This will help you keep its existing customers but also make it easier to acquire new ones.

Technology Advancements: Rapid advancements in technology can make existing cybersecurity solutions obsolete. Qualys needs to stay at the forefront of technological developments to remain relevant and this implies resources to invest in innovation, knowledge to know where the market will go and, above all, an agile directive with ease to adapt to change.

Final Thoughts

Despite the company’s great qualities, it could be said that Qualys is relatively small within the sector. Its $490M in revenues during FY2022 doesn’t seem like much compared to (FTNT) $4,400M or (PANW) $6,890M. This can be seen as a weakness because it has a smaller scale, but it also seems like a great opportunity for the company to continue growing through stealing market share.

Another positive aspect is that the sector has many qualities to generate successful businesses. A market resistant to crises, with recurring revenues because customers tend to be quite loyal, and businesses with large profitability margins. Qualys is no exception to the norm, however, due to the unappealing valuation, I will assign it a “hold” rating for now until we observe better stock prices.