Summary
Qualys reported fiscal 2023 third-quarter revenue of $142.0 million, up 13.1% from the prior-year quarter. GAAP gross profit rose 15.8% to $115.3 million, and GAAP gross margin was 81.2%, up 1.9 percentage points. GAAP operating income increased 30.7% to $43.6 million, with an operating margin of 30.7%, up 4.1 percentage points. GAAP net income was $46.5 million, up 68.2%, and GAAP diluted EPS was $1.24, up 74.6%. For the nine months ended September 30, 2023, revenue was $409.9 million, up 14.2%, and GAAP net income was $111.0 million, up 39.3%. The quarter's GAAP net income included a benefit from a change in tax estimates tied to IRS rule changes and interim guidance on research and development capitalization.
Cash generation was the standout. Operating cash flow for the quarter increased 119.3% to $92.4 million. For the nine months ended September 30, 2023, operating cash flow was $210.8 million, up 36.0%. Capital expenditures were $1.8 million, up 45.7%, leaving the company with modest capital needs. Current deferred revenue ended the quarter at $307.2 million, up 10.1% from the prior-year quarter. Remaining performance obligations, or RPO, rose 27.6% to $330.7 million. Calculated current billings, a non-GAAP metric, grew 14% to $146.7 million. The net dollar expansion rate was 106%, compared with 111% a year earlier.
Operationally, Qualys launched its first Environmental, Social and Governance report and introduced First-Party Software Risk Management for application security teams. Mazars integrated Qualys cybersecurity solutions into its Cybersecurity Managed Services offering. The Qualys Threat Research Unit received Pwnie award nominations for work on RenderDoc, the fifth consecutive year of recognition. The company hosted more than 600 attendees at its virtual Cyber Risk Series. Qualys says it has more than 10,000 subscription customers, including a majority of the Forbes Global 100 and Fortune 100. Revenue mix was steady: 57% of third-quarter revenue came direct and 43% through partners. Of the quarter's revenue increase, 96% came from customers existing before July 1, 2023, 66% came from the United States, and 54% came from partners.
Guidance points to management's expectations for the fourth quarter and full fiscal year. For the fourth quarter of 2023, management expects revenue of $144.1 million to $145.1 million, or 10% to 11% growth over the same quarter in 2022. GAAP net income per diluted share is guided to $0.77 to $0.87, and non-GAAP net income per diluted share is guided to $1.18 to $1.28. Those estimates assume a 22% GAAP effective tax rate and a 21% non-GAAP effective tax rate, with roughly 37.4 million weighted average diluted shares. For the full fiscal year 2023, Qualys raised revenue guidance to $554.0 million to $555.0 million, representing 13% growth over 2022, up from the previous range of $553.0 million to $555.0 million. Full-year GAAP EPS guidance was raised to $3.71 to $3.81 from $3.07 to $3.22, and full-year non-GAAP EPS guidance was raised to $5.04 to $5.14 from $4.50 to $4.65. The full-year GAAP tax rate assumption is 17%, the non-GAAP rate is 21%, and the share count assumption is about 37.6 million diluted shares.
Risks remain. Qualys flagged macroeconomic uncertainty from inflation, rising interest rates, financial institution failures, labor shortages, supply chain disruptions, volatility in foreign exchange rates, reduced spending and extended sales cycles, and geopolitical conflicts. Competition in cloud security and compliance could pressure pricing and demand. The company's results depend on retaining existing customers, adding new ones, and selling more solutions to them. Product defects, errors or vulnerabilities could hurt customer acceptance. Tax rate changes could swing GAAP results, and the company notes that its effective tax rate can move with tax legislation or shifts in the geographic mix of revenue and expenses. The company also points to seasonal buying patterns, currency fluctuations, and the need to manage rapid growth.
Forecast
Reported figures
GAAP, from SEC filings| Metric | Q3 FY2023 | Q2 FY2023 | QoQ | Q3 FY2022 | YoY |
|---|---|---|---|---|---|
| Revenue | $142.0M | $137.2M | +3.5% | $125.6M | +13.1% |
| Gross profit | $115.3M | $110.5M | +4.3% | $99.6M | +15.8% |
| Gross margin | 81.2% | 80.6% | +0.6 pp | 79.3% | +1.9 pp |
| Research & development | $27.8M | $27.4M | +1.3% | $25.5M | +9.0% |
| Sales & marketing | $27.9M | $26.2M | +6.2% | $25.0M | +11.3% |
| General & administrative | $16.0M | $14.1M | +13.8% | $15.7M | +1.9% |
| Total operating expenses | $71.7M | $67.7M | +5.8% | $66.2M | +8.2% |
| Operating income (loss) | $43.6M | $42.8M | +1.8% | $33.3M | +30.7% |
| Operating margin | 30.7% | 31.2% | -0.5 pp | 26.6% | +4.1 pp |
| Net income (loss) | $46.5M | $35.4M | +31.5% | $27.7M | +68.2% |
| Net margin | 32.8% | 25.8% | +7.0 pp | 22.0% | +10.7 pp |
| Diluted EPS | $1.24 | $0.95 | +$0.29 | $0.71 | +$0.53 |
Risks
MD&A cites uncertainty from inflationary pressure, rising interest rates, financial institution failures, labor shortages, reduced IT security spending and extended sales cycles. Risk Factors state economic weakness and constrained IT spending were experienced in 2022 and into 2023 and may reduce revenue and earnings.
Risk Factors state the sales cycle for Qualys solutions typically ranges from six to twelve months but can be more than eighteen months, especially for large transactions in the current macroeconomic environment. MD&A also flags extended sales cycles as a macroeconomic impact that makes forecasting difficult.
Qualys competes with Broadcom (Symantec Enterprise Security), CrowdStrike, Palo Alto Networks, Rapid7 and Tenable, as well as private vendors such as Wiz and Tanium. Larger competitors can bundle competing products, increase pricing pressure and cause average sales prices to decline.
Net dollar expansion rate was 106% as of September 30, 2023, compared with 111% as of September 30, 2022, indicating slower expansion from existing customers. Risk Factors state growth depends on renewals and additional subscriptions, and customers may not renew at the same or higher levels due to the macroeconomic environment or competition.
For the nine months ended September 30, 2023, approximately 43% of revenues came through channel partners, and these agreements are generally non-exclusive. Loss of one or more larger channel partners, or their greater emphasis on competitor products, could adversely affect sales and growth.
As of September 30, 2023, approximately 74% of employees were outside the United States, with 65% in Pune, India. For the nine months ended September 30, 2023, approximately 28% of expenses and 23% of revenues were in foreign currencies, exposing results to FX, regulatory and geopolitical risks.
The evolving GDPR, UK GDPR, CCPA and CPRA regimes, plus invalidation of the EU-U.S. Privacy Shield and uncertainty around SCCs and cross-border data transfers, could require additional safeguards and increase compliance costs or limit European sales.
Risk Factors disclose the December 2020 Accellion FTA zero-day incident, where attackers illegally obtained information and Qualys incurred response costs. The Russia-Ukraine conflict is also cited as heightening cybersecurity and privacy breach risks from nation-state actors.
Qualys hosts substantially all solutions on 12 third-party shared cloud platforms, some of which are not currently redundant and may not allow rapid customer migration. A facility disruption or failure to renew provider agreements could interrupt service delivery, reduce revenues and cause customer credits or terminations.
Q3 2023 income tax provision decreased 76% to $1.5 million due to IRS rule changes on foreign tax credits and interim R&D capitalization guidance, including a cumulative adjustment for prior periods. Future tax rules, including BEAT and OECD model rules, remain uncertain and could affect financial results.
SaaS KPIs
All quarters →Calculated Current Billings
Adjusted EBITDA
Subscription Customers
Non-GAAP Operating Income
Adjusted EBITDA as a Percentage of Revenues
Operating Cash Flow
Summary, forecast, risks and KPIs are extracted from QUALYS, INC.'s SEC filings for Q3 FY2023 (10-Q / 10-K and the 8-K earnings release); GAAP figures in the summary are checked against the reported XBRL data. They can contain errors; the filings are authoritative. Processed Oct 2, 2026.