QUALYS, INC. Q1 FY2026 earnings

MD&A and Risk Factors both flag macroeconomic uncertainty, including inflationary pressure, high interest rates, reduced spending, extended sales cycles, tariff and non-tariff trade barriers, and geopolitical conflicts, which could cause current and potential customers to cut IT security budgets. The company notes it has experienced longer sales cycles since 2023 and that tariff uncertainty and potential retaliatory measures could raise costs and reduce customer purchasing power.

Qualys has incorporated AI/machine learning into its solutions and expects to rely on it to drive future growth, but warns that competitors or third parties may incorporate AI/ML into their products more quickly or successfully. The company also cites the European Union's Artificial Intelligence Act and other emerging AI regulation as potentially requiring significant changes to its use of AI/ML at material time and expense.

Qualys competes with CrowdStrike, Palo Alto Networks, Rapid7, Tenable, Invicti, Tanium and Wiz (which was acquired by Google in March 2026), and warns that larger competitors with broader product suites can bundle competing offerings or discount them, pressuring pricing and gross profit. It expects additional competition as it expands into Cybersecurity Asset Management, Patch Management and Enterprise TruRisk Management.

The company states its sales cycle typically ranges from six to twelve months and can exceed eighteen months, with growing buyer-side complexity from IT departments managing increased user and compliance demands. Because subscription revenue is recognized ratably, any bookings shortfall may not fully appear in results until future periods.

For the three months ended March 31, 2026, approximately 52% of revenues came from sales through channel partners, and MD&A reports 86% of the $15.7 million revenue increase came from partners. Channel agreements are generally non-exclusive and many partners have more established relationships with competitors, so loss of or reduced emphasis by a large partner could hurt sales.

MD&A attributes 96% of the $15.7 million increase in revenues for the three months ended March 31, 2026 to customers existing prior to January 1, 2026 and only 4% to new customers, and the company reports a net dollar expansion rate of 104% as of March 31, 2026 versus 103% as of March 31, 2025. Growth therefore depends disproportionately on renewals and upsells to the installed base rather than new customer acquisition.

As of March 31, 2026, approximately 79% of employees were located outside the United States, with 71% in India, exposing the company to foreign employment, wage, privacy and payroll tax rules. Qualys also states growth depends on recruiting and retaining qualified sales personnel and that recent and planned hires may not become productive as quickly as expected, with upfront sales expense pressuring operating results if revenue does not follow.

Because it sells IT security solutions, Qualys states it may be and has been targeted by cyber-attacks, and that incorporating AI/machine learning technologies may create additional cybersecurity risks, including technical error and breaches. A significant incident could also cause loss of FedRAMP authorization, which the company says could inhibit or preclude contracting with certain U.S. federal customers and breach public sector contracts.

Qualys delivers substantially all solutions from 15 third-party shared cloud platforms across the United States, Canada, Switzerland, the Netherlands, United Arab Emirates, Australia, United Kingdom, Italy, Kingdom of Saudi Arabia and India. It notes some platforms are not currently redundant, that it may not be able to rapidly move customers between platforms, and that provider agreements have no renewal obligation on commercially reasonable terms.

The company is subject to an expanding privacy and data protection regime including GDPR fines up to the greater of four percent of prior year annual revenue or EUR 20 million, NIS2 fines of up to EUR 10 million or 2% of worldwide revenue, the CCPA and CPRA, UK GDPR, and the EU Data Act which became applicable on September 12, 2025 and may require contract and data portability changes. Cross-border transfer mechanisms such as the EU-U.S. Data Privacy Framework and SCCs have been subject to legal challenge.

For the three months ended March 31, 2026, approximately 26% of revenues were generated in foreign currencies while approximately 27% of expenses were incurred in foreign currencies, primarily the Euro, British Pound and Indian Rupee. The company hedges with foreign currency forward contracts but notes hedging activities may themselves contribute to increased losses from volatility.

Operating cash flow was $95.29 million for the quarter, down 13.0% versus the prior-year quarter, which MD&A links to timing of billings, collections and payments rather than a change in demand. Continued swings in working capital timing could make cash generation more variable even as revenue, gross profit and operating income all increased versus the prior-year quarter.