Summary
Qualys opened fiscal 2025 with revenue of $159.9 million for the first quarter, up 9.7% from $145.8 million in the same quarter a year earlier. Gross profit was $131.0 million, up 10.4%, and operating income of $51.8 million rose 15.6%. Net income of $47.5 million rose 19.6%, and diluted EPS of $1.29 rose 22.9%. Gross margin came in at 81.9% versus 81.3%, while operating margin was 32.4% versus 30.7%. Management credited new product initiatives and customer demand for natively integrated cyber risk management. The revenue increase came mostly from the existing base rather than from new logos.
The non-GAAP picture moved in the same direction. Non-GAAP net income was $61.4 million, or $1.67 per diluted share, against $54.7 million, or $1.45, a year earlier. Non-GAAP gross profit was $133.7 million and non-GAAP operating income was $71.2 million, with non-GAAP gross margin of 84% versus 83% and non-GAAP operating margin of 45% versus 44%. Adjusted EBITDA increased 8% to $74.8 million. Cash generation was the loudest line in the release. Operating cash flow was $109.6 million, up 28.2% from $85.5 million, equal to 69% of revenue versus 59%. Free cash flow, a separate measure that subtracts capital spending, was $107.6 million versus $83.5 million. Capital expenditures were $2.04 million, down 0.6%.
Backlog indicators held up. Current deferred revenue was $366.8 million, up 10.4%, and remaining performance obligations were $427.6 million, up 13.5%. The softer spot was calculated current billings, a non-GAAP figure, at $155.3 million, up 7% from $144.7 million, which trails reported revenue growth. The net dollar expansion rate slipped to 103% from 104%. The MD&A breaks down the $14.1 million revenue increase: 96% came from customers that existed before January 1, 2025 and 4% from customers added during the quarter. Foreign customers produced 66% of the increase and partners 89%. Direct sales accounted for 51% of total revenue.
Product news centered on consolidation and managed services. Qualys introduced the Managed Risk Operation Center, which lets select partners sell a unified managed service built on Enterprise TruRisk Management. It launched TotalAppSec, an application risk offering that combines API security, web application scanning and malware detection. GigaOm named TotalCloud a leader and outperformer in its cloud workload security radar and named CyberSecurity Asset Manager a leader in attack surface management. Container security was integrated with ServiceNow. Qualys says it serves more than 10,000 subscription customers worldwide, including a majority of the Forbes Global 100 and Fortune 100.
Guidance moved higher. For the second quarter, management expects revenue of $159.7 million to $162.7 million, representing 7% to 9% growth, with non-GAAP net income per diluted share of $1.40 to $1.50. For the full year, revenue guidance was raised to $648.0 million to $657.0 million, or 7% to 8% growth over 2024, from a prior range of $645.0 million to $657.0 million. Full-year non-GAAP net income per diluted share guidance rose to $6.00 to $6.30 from $5.50 to $5.90. The non-GAAP ranges assume a 21% non-GAAP effective income tax rate.
Risks remain macro and competitive. The 10-Q lists inflation, high interest rates, significant volatility of global markets, reduced spending, extended sales cycles, tariff and non-tariff trade barriers and geopolitical conflict, any of which could lead customers to cut IT security budgets. Competition, foreign exchange swings and the effective tax rate are also named. Qualys repurchased $39.7 million of stock during the quarter and added $200.0 million to its buyback authorization in February, leaving $303.8 million available as of March 31, 2025. It also extended its Foster City headquarters lease through April 30, 2034, with aggregate base rent of $30.4 million.
Forecast
Reported figures
GAAP, from SEC filings| Metric | Q1 FY2025 | Q4 FY2024 | QoQ | Q1 FY2024 | YoY |
|---|---|---|---|---|---|
| Revenue | $159.9M | $159.2M | +0.4% | $145.8M | +9.7% |
| Gross profit | $131.0M | $130.2M | +0.6% | $118.6M | +10.4% |
| Gross margin | 81.9% | 81.8% | +0.1 pp | 81.3% | +0.6 pp |
| Research & development | $29.2M | $28.3M | +3.0% | $27.5M | +5.9% |
| Sales & marketing | $32.7M | $34.1M | -4.1% | $29.4M | +11.1% |
| General & administrative | $17.4M | $18.4M | -5.3% | $16.9M | +2.9% |
| Total operating expenses | $79.2M | $80.7M | -1.9% | $73.8M | +7.3% |
| Operating income (loss) | $51.8M | $49.4M | +4.7% | $44.8M | +15.6% |
| Operating margin | 32.4% | 31.0% | +1.3 pp | 30.7% | +1.7 pp |
| Net income (loss) | $47.5M | $44.0M | +8.1% | $39.7M | +19.6% |
| Net margin | 29.7% | 27.6% | +2.1 pp | 27.3% | +2.5 pp |
| Diluted EPS | $1.29 | $1.18 | +$0.11 | $1.05 | +$0.24 |
Risks
MD&A highlights inflationary pressure, high interest rates, global market volatility, reduced spending, extended sales cycles, tariff and non-tariff trade barriers, and geopolitical conflicts as potential material adverse effects. Risk Factors state adverse economic conditions or reduced IT spending have resulted in longer sales cycles since 2023.
The sales cycle for solutions typically ranges from six to twelve months but can be more than eighteen months, and MD&A cites extended sales cycles in the current macro environment. This can cause revenues to vary from period to period and make forecasting difficult.
Risk Factors name CrowdStrike, Palo Alto Networks, Rapid7, Tenable, Invicti, Tanium, and Wiz, which has announced a pending acquisition by Google, as competitors. Larger competitors with broader product suites can bundle competing products and increase pricing pressure on Qualys solutions.
The company and its service providers have experienced and may continue to experience security incidents, and because Qualys provides IT security solutions it has been targeted for cyber-attacks. Geopolitical conflicts in Eastern Europe and the Middle East and the use of AI/machine learning heighten these risks.
For the three months ended March 31, 2025, Qualys derived approximately 49% of revenues from sales through channel partners, and the percentage may increase. Channel partner agreements are generally non-exclusive, and the loss of one or more larger partners could adversely affect sales.
Qualys expects to rely on AI/machine learning to help drive future growth, but competitors may incorporate AI/machine learning into their offerings more quickly or more successfully. Failure to properly implement or market AI features could impair its ability to compete effectively.
Growth depends on recruiting and retaining qualified sales personnel, and competition for highly skilled personnel is intense. Failure to hire or retain sufficient productive sales personnel could harm sales growth and negatively impact operating results due to upfront expenses.
Privacy, data protection, and cybersecurity laws such as GDPR, CCPA, CPRA, UK GDPR, and the EU Artificial Intelligence Act impose evolving compliance obligations and potential fines. Cross-border data transfer mechanisms have been subject to legal challenge, increasing compliance costs and uncertainty.
Selling to government entities is highly competitive, expensive, and time-consuming, and demand may be impacted by public sector budgetary cycles and funding delays. Government audits could result in reduced purchases, fines, or civil or criminal liability.
SaaS KPIs
All quarters →Calculated Current Billings
Adjusted EBITDA
Non-GAAP Gross Margin
Subscription Customers
Operating Cash Flow
Calculated Current Billings Growth (YoY)
Non-GAAP Free Cash Flow
Non-GAAP Operating Income (as % of revenues)
Adjusted EBITDA (as % of revenues)
Summary, forecast, risks and KPIs are extracted from QUALYS, INC.'s SEC filings for Q1 FY2025 (10-Q / 10-K and the 8-K earnings release); GAAP figures in the summary are checked against the reported XBRL data. They can contain errors; the filings are authoritative. Processed Oct 2, 2026.