Summary
Qualys reported $96.8 million in revenue for the first quarter of 2021, up 12.2% from $86.3 million in the same quarter a year ago. Gross profit rose 10.8% to $75.1 million, but gross margin slipped to 77.6% from 78.6%. Deferred revenue, current portion, reached $218.9 million, up 8.4% from $201.9 million. Remaining performance obligations climbed 62.7% to $220.9 million from $135.8 million, which points to longer contract commitments on the books.
Profitability was the weak spot. GAAP operating income swung to a loss of $2.7 million from $20.4 million of income a year earlier. Operating margin fell to negative 2.8% from 23.7%. Net income dropped 98.8% to $0.2 million from $18.7 million, and diluted EPS came in at $0.01 against $0.46.
The swing traces almost entirely to stock-based compensation, which hit $38.2 million in the quarter versus $10.0 million a year ago. General and administrative expense jumped 277.9% to $42.0 million, driven by a $29.0 million increase in stock-based compensation tied to accelerated vesting of the former CEO's equity awards and $1.4 million of higher legal fees. Management treats that as a non-cash, one-time event. Non-GAAP numbers strip it out: non-GAAP net income was $29.8 million, non-GAAP diluted EPS was $0.74, and Adjusted EBITDA rose 17% to $44.6 million.
Cash generation held firm. Operating cash flow rose 10.3% to $57.9 million from $52.4 million, and capital expenditures fell 13.9% to $6.3 million. Free cash flow, a non-GAAP measure, was $51.6 million against $45.1 million. The company ended the quarter with $458.2 million in cash, cash equivalents and marketable securities. Calculated current billings, another non-GAAP metric, grew 6% to $102.2 million, a step down from the 13% growth posted in the first quarter of 2020.
Operationally, Qualys leaned on VMDR. Paid Cloud Agent subscriptions grew roughly 58% year over year to 61 million deployed. The company counts over 19,000 active customers across more than 130 countries. It expanded its partnership with HCL Technologies, extended VMDR to Android and iOS/iPadOS, and rolled out SaaS Detection and Response for applications such as Microsoft Office 365, Google Workspace and Zoom.
Guidance points to steady top-line growth and a lower GAAP earnings base. For the second quarter of 2021, management guided revenue of $98.6 million to $99.2 million, or 11% to 12% growth, with GAAP EPS of $0.37 to $0.39 and non-GAAP EPS of $0.67 to $0.69. For the full year 2021, revenue guidance moved up to $402.5 million to $404.5 million, about 11% growth, from the prior range of $399.0 million to $402.0 million. Full year GAAP EPS guidance was cut to $1.06 to $1.11 from $1.39 to $1.44, mostly on a higher assumed effective tax rate of 28% versus 26%. Full year non-GAAP EPS guidance rose to $2.67 to $2.72 from $2.60 to $2.65.
The risks are the usual set for a security vendor. Qualys flags the ongoing COVID-19 pandemic, competition in cloud security, foreign exchange swings, customer budgeting cycles and retention, and unexpected moves in its effective income tax rate. It also notes the pandemic could raise its cost of capital. With billings growth slowing and GAAP profit now shaped by a large non-cash charge, the next few quarters will show whether VMDR momentum turns into faster reported revenue.
Forecast
Reported figures
GAAP, from SEC filings| Metric | Q1 FY2021 | Q4 FY2020 | QoQ | Q1 FY2020 | YoY |
|---|---|---|---|---|---|
| Revenue | $96.8M | $94.8M | +2.1% | $86.3M | +12.2% |
| Gross profit | $75.1M | $73.6M | +2.0% | $67.8M | +10.8% |
| Gross margin | 77.6% | 77.6% | -0.0 pp | 78.6% | -1.0 pp |
| Research & development | $17.7M | $18.6M | -4.8% | $18.0M | -1.3% |
| Sales & marketing | $18.0M | $17.9M | +0.5% | $18.2M | -1.3% |
| General & administrative | $42.0M | $12.6M | +232.8% | $11.1M | +277.9% |
| Total operating expenses | $77.8M | $49.2M | +58.2% | $47.3M | +64.3% |
| Operating income (loss) | -$2.7M | $24.4M | -111.1% | $20.4M | -113.2% |
| Operating margin | -2.8% | 25.8% | -28.6 pp | 23.7% | -26.5 pp |
| Net income (loss) | $228.0K | $23.8M | -99.0% | $18.7M | -98.8% |
| Net margin | 0.2% | 25.1% | -24.9 pp | 21.7% | -21.4 pp |
| Diluted EPS | $0.01 | $0.58 | -$0.57 | $0.46 | -$0.45 |
Risks
CEO Philippe Courtot took medical leave in February 2021 and resigned in March 2021 for health reasons; Thakar became interim CEO and then CEO in April 2021. The transition contributed to a 277.9% increase in general and administrative expenses in the quarter ended March 31, 2021, primarily from accelerated vesting and legal fees, and operating income swung to a loss of $2.70 million from $20.43 million in the prior-year quarter.
The company disclosed a December 2020 cybersecurity incident involving a zero-day vulnerability in an Accellion FTA server used for customer support, where attackers illegally obtained certain information. It incurred response costs and may continue to incur costs to enhance security measures.
The IT security and compliance market is highly fragmented and includes larger competitors such as CrowdStrike, Palo Alto Networks, Rapid7 and Tenable that can bundle or discount competing products. Gross margin declined 1.0 pp to 77.6% in the quarter ended March 31, 2021, and pricing pressure may reduce gross profits.
COVID-19 measures have impacted workforce, customer operations, and demand visibility. Management states it cannot accurately predict the full impact and that an economic slowdown or global recession could decrease demand for its solutions.
The sales cycle for subscriptions typically ranges from six to twelve months but can exceed eighteen months, especially for large transactions. This makes revenues difficult to forecast and can cause quarterly operating results to fluctuate.
For the three months ended March 31, 2021, approximately 40% of revenues were derived from sales through channel partners. Channel agreements are generally non-exclusive, and partners may favor competitors, so loss of a large partner could harm sales.
Noncompliance with GDPR can trigger fines of up to €20 million or 4% of global annual revenues. CCPA, CPRA, Brexit, and the invalidated EU-US Privacy Shield create compliance uncertainty and potential additional costs.
As of March 31, 2021, approximately 73% of employees were located outside the United States, with 63% in Pune, India. For the quarter ended March 31, 2021, approximately 22% of revenues and 19% of expenses were in foreign currencies, exposing results to foreign exchange and geopolitical risks including India-China tensions.
Solutions are delivered from eight data centers in multiple countries. Some facilities are not currently redundant and third-party providers have no obligation to renew agreements on commercially reasonable terms, so a disruption could interrupt service and reduce revenues.
Headcount increased to 1,535 employees as of March 31, 2021, adding complexity to the organization. Failure to improve systems, processes and controls could lead to inaccurate forecasts, increased costs, and difficulty integrating and training employees.
SaaS KPIs
All quarters →Calculated Current Billings
Adjusted EBITDA
Non-GAAP Gross Margin
Calculated Current Billings Growth
Non-GAAP Operating Income (as % of revenues)
Active Customers
Adjusted EBITDA (as % of revenues)
Paid Cloud Agent Subscriptions
Summary, forecast, risks and KPIs are extracted from QUALYS, INC.'s SEC filings for Q1 FY2021 (10-Q / 10-K and the 8-K earnings release); GAAP figures in the summary are checked against the reported XBRL data. They can contain errors; the filings are authoritative. Processed Oct 2, 2026.