Summary
Qualys reported third quarter fiscal 2022 revenue of $125.6 million, up 19.7% from $104.9 million in the prior-year quarter. Gross profit rose 20.8% to $99.6 million, and gross margin was 79.3%, up 0.7 percentage points from 78.6%. Operating income increased 4.3% to $33.3 million, yet operating margin fell 3.9 percentage points to 26.6% from 30.5%, a sign that costs grew faster than sales. Net income was $27.7 million, flat compared with $27.8 million a year earlier, and diluted earnings per share were $0.71, compared with $0.70. The 10-Q attributed the revenue increase primarily to renewal and expansion business with existing customers.
The nine-month picture looks stronger. Revenue reached $358.9 million, up 19.1% from $301.4 million. Gross profit climbed 20.4% to $283.8 million, operating income jumped 70.3% to $99.9 million, and net income rose 62.1% to $79.7 million. Diluted earnings per share for the nine months were $2.01, compared with $1.22. The large operating income gain reflects a prior-year period weighed down by the accelerated vesting of equity awards in the first quarter of 2021.
Cash generation was the soft spot in the quarter. Operating cash flow was $42.2 million, down 13.1% from $48.5 million. Capital expenditures were $1.2 million, down 82.7% from $7.2 million. For the nine months, operating cash flow was $155.0 million, down 3.6% from $160.7 million, and capital expenditures were $12.4 million, down 38.3% from $20.1 million. Deferred revenue (current portion) was $278.9 million at September 30, 2022, up 17.4% from $237.5 million a year earlier. Remaining performance obligations were $259.2 million, up 4.3% from $248.5 million, a much slower pace than revenue.
Non-GAAP results also grew. Adjusted EBITDA rose 9% to $54.9 million from $50.3 million, while non-GAAP net income was $36.8 million compared with $34.2 million. Non-GAAP diluted earnings per share were $0.94, up from $0.86. Non-GAAP free cash flow for the nine months was $142.6 million, compared with $140.6 million a year earlier. Calculated current billings were $128.8 million, and the company reported 13% growth in that metric compared with 22% in the prior-year quarter.
Management guided fourth quarter 2022 revenue growth of 18% to 19% over the same quarter in 2021. Fourth quarter non-GAAP net income per diluted share is expected to be $0.89 to $0.91. For the full year 2022, Qualys raised its revenue guidance and now expects 19% growth over 2021, up from the previous range. Full year non-GAAP net income per diluted share guidance is $3.60 to $3.62, up from the previous range of $3.50 to $3.55, and the company also raised its full-year GAAP earnings per diluted share guidance.
Operationally, Qualys pointed to the launch of TotalCloud, which allows cloud-native VMDR scanning across cloud and container environments from build to run-time. The Blue Hexagon acquisition was framed as a way to extend the Qualys Cloud Platform into predictive analytics for real-time zero-day threat detection. VMDR was named Best Vulnerability Management solution in the SC Awards 2022. The company upgraded CyberSecurity Asset Management with External Attack Surface Management, and it worked with IBM to bring VMDR, policy compliance and asset management to IBM zSystems. Black Hat 2022 was another marketing moment, and Qualys says it serves more than 10,000 subscription customers worldwide.
The risks are largely macro and competitive. The 10-Q cites supply chain pressure, inflation, rising interest rates, labor shortages, global market volatility and geopolitical conflicts, any of which could push current and potential customers to cut spending on IT security. Qualys also flags a lengthy sales cycle, currency swings against the Euro and GBP, changes in its effective tax rate, and the chance that the market for cloud security and compliance does not grow as expected. A tax law change requiring capitalization of research and development expenses starting January 1, 2022 lifted near-term cash taxes, though the company expects lower cash taxes in later years as those costs amortize.
Forecast
Reported figures
GAAP, from SEC filings| Metric | Q3 FY2022 | Q2 FY2022 | QoQ | Q3 FY2021 | YoY |
|---|---|---|---|---|---|
| Revenue | $125.6M | $119.9M | +4.7% | $104.9M | +19.7% |
| Gross profit | $99.6M | $94.8M | +5.0% | $82.5M | +20.8% |
| Gross margin | 79.3% | 79.1% | +0.2 pp | 78.6% | +0.7 pp |
| Research & development | $25.5M | $24.8M | +2.8% | $21.3M | +19.4% |
| Sales & marketing | $25.0M | $23.7M | +5.5% | $18.6M | +34.9% |
| General & administrative | $15.7M | $13.3M | +17.7% | $10.6M | +48.5% |
| Total operating expenses | $66.2M | $61.9M | +7.1% | $50.5M | +31.2% |
| Operating income (loss) | $33.3M | $33.0M | +1.1% | $32.0M | +4.3% |
| Operating margin | 26.6% | 27.5% | -1.0 pp | 30.5% | -3.9 pp |
| Net income (loss) | $27.7M | $26.6M | +4.0% | $27.8M | -0.4% |
| Net margin | 22.0% | 22.2% | -0.1 pp | 26.5% | -4.4 pp |
| Diluted EPS | $0.71 | $0.67 | +$0.04 | $0.70 | +$0.01 |
Risks
The MD&A cites inflationary pressure, rising interest rates, recessionary fears, supply chain disruption and a global labor shortage, and says these could lead current and potential customers to reduce or eliminate overall spending on IT security.
The filing states the sales cycle for Qualys solutions typically ranges from six to twelve months and can exceed eighteen months, making large transactions hard to forecast; RPO increased 4.3% in FY2022 Q3 versus the prior-year quarter while revenue increased 19.7%.
Qualys competes with Broadcom (Symantec Enterprise Security), CrowdStrike, Palo Alto Networks, Rapid7 and Tenable, among others; larger competitors can bundle competing products and apply pricing pressure, which may reduce average selling prices and gross profits.
The filing describes the December 2020 Accellion FTA zero-day vulnerability that allowed attackers to illegally obtain information from a company server, and says Qualys may continue to incur costs and faces heightened nation-state cyber risk from Russia's invasion of Ukraine.
For the nine months ended September 30, 2022, approximately 42% of revenues came from sales through channel partners, and partner agreements are generally non-exclusive; loss of or reduced focus by large partners could adversely affect sales.
As of September 30, 2022, approximately 75% of employees were located outside the United States, with 66% in Pune, India, exposing Qualys to foreign labor laws, wage inflation, geopolitical tensions including India and China, and foreign exchange fluctuations.
The filing cites intense competition for highly skilled personnel, particularly in engineering and sales, and notes recent senior management hiring; failure to attract or retain key employees could delay product development and harm growth.
Qualys faces evolving privacy regimes including GDPR, CCPA and CPRA, whose enforcement is expected to commence July 1, 2023, plus uncertainty around EU-U.S. data transfer mechanisms after Schrems II, which may require altered practices and increase compliance costs.
The MD&A notes a tax law change requiring mandatory capitalization and amortization of research and development expenses starting January 1, 2022, which increased cash taxes, and the Inflation Reduction Act introduces a 1% excise tax on stock buybacks next year.
Headcount increased to 2,071 employees as of September 30, 2022, and the filing says Qualys must improve IT systems, financial infrastructure and processes to manage growth; failure could impair forecasting and internal controls.
Qualys acquired certain assets of Blue Hexagon on October 4, 2022, after the quarter, and the filing notes acquisition integration is complex, expensive and may divert management attention.
Physical scanner appliances are built by a single manufacturer, creating risk of supply shortages or delays in deployments if that manufacturer cannot meet requirements.
Qualys suspended services to customers in Russia and Belarus effective March 2022 due to sanctions; revenue from those operations was not material during the nine months ended September 30, 2022 or the year ended December 31, 2021, but sanctions changes could further affect sales.
SaaS KPIs
All quarters →Calculated Current Billings
Adjusted EBITDA
Non-GAAP Gross Margin
Subscription Customers
Calculated Current Billings Growth
Adjusted EBITDA Margin
Non-GAAP Operating Income (as % of revenues)
Summary, forecast, risks and KPIs are extracted from QUALYS, INC.'s SEC filings for Q3 FY2022 (10-Q / 10-K and the 8-K earnings release); GAAP figures in the summary are checked against the reported XBRL data. They can contain errors; the filings are authoritative. Processed Oct 2, 2026.