A 40% Cash-Margin Security Name the Market Is Only Half Pricing In

This security veteran is up about 50% this year and still trades at half the hot names' multiple.

October 14, 2026

Today we’re covering one of the oldest pure-play cybersecurity companies out there. The stock is up about 50% this year after a beat-and-raise August, and it still trades at roughly half the multiple you pay for the hot security names.

Forgotten Mine (Sponsored)

Washington ordered it shut. October 8, 1942, War Production Board, Order L-208: stop producing gold. The war needed miners for copper.

One of the mines forced shut was then the second-largest lode gold producer in the U.S. It has been silent for about 70 years.

Gold was $35 at closing. Today it is $4,000+. A small company owns the whole thing, and drilling began again this summer.

This ad is sent on behalf of Guardian Financial Publishing LLC, doing business as Stable Financial Publishing, 1013 Centre Road Suite 403-D, Wilmington, DE 19805. Nothing here is investment, financial, legal, or tax advice, and it is not a recommendation or solicitation to buy or sell any security. Investing involves substantial risk, including loss of principal. Mining stocks are speculative and can lose most or all of their value. Gold-value figures are estimates based on the current gold price and on gold already mined; they are not a resource estimate or company guidance. Past performance (including the gold price figures cited) does not guarantee future results. Privacy: https://guardian.pub/privacy-policy/ · Terms: https://guardian.pub/terms-of-service/

Qualys (NASDAQ: QLYS) is one of the oldest pure-play cybersecurity companies out there, and it's still one of the cheaper ones you can buy. Over the last 18 months, security software has belonged to CrowdStrike, with Palo Alto, Zscaler, and SentinelOne fighting over whatever headlines were left.

Qualys got skipped until August. A beat-and-raise second quarter sent the stock up about 20%, and it's now up roughly 50% this year and sitting near its 52-week high.

Even so, it trades around 22 times forward earnings, about half what you pay for Zscaler. Free cash flow margins sit north of 40%, the buyback keeps chewing through the share count, and Q3 earnings land November 4.

Action: Start building a position in the current range ahead of the Q3 print on November 4. After a run like this, scale in; don't chase it all at once.

Operational Overview and Recent Developments

Here's what Qualys actually does, in plain English. If you run IT at a Fortune 500, you've got tens of thousands of servers, laptops, cloud workloads, and connected devices scattered across the planet. You need to know which ones have unpatched vulnerabilities, which ones are misconfigured, and which ones a hacker could pivot off tomorrow.

Qualys scans everything, ranks risk, and tells your security team what to fix first. Boring work.

Not optional, either. Every public company and every federal agency has to do it, and once Qualys agents are deployed across your infrastructure, pulling them out for a competitor is a multi-year project no team signs up for. That's the moat.

Growth isn't the headline. Q2 revenue rose 11% to $182 million, and management raised its full-year guide to $732 million to $738 million, or 9% to 10% growth. Look under the hood and the story gets better for you.

The Enterprise TruRisk platform, the company's attack surface management and risk-scoring product, has become the fastest-growing piece of the business.

Free cash flow margins are above 40%, putting Qualys in the top tier of all software, period. And management keeps retiring shares, about $131 million worth in the first half of 2026 alone.

Action: Snag some shares before the Q3 print. On the call, listen for TruRisk ARR commentary and any step-up in buyback pace, which has quietly driven EPS for two years running.

Seven Stocks Primed (Sponsored)

A newly released report highlights seven stocks chosen for their near-term potential.

Selections are based on a mix of technical and fundamental indicators.

While past picks have performed well, future results are uncertain.

The report is available for a limited time.

Access the free report.

*This free resource is being sent by Zacks. We identify investment resources you may choose to use in making your own decisions. Use of this resource is subject to the Zacks Terms of Service.
*Past performance is no guarantee of future results. Investing involves risk. This material does not constitute investment, legal, accounting, or tax advice. Zacks Investment Research is not a licensed dealer, broker, or investment adviser.

Qualcomm derives a substantial share of its profit not from selling chips, but from:

Login or Subscribe to participate in polls.

TruRisk and AI Prioritization Are Your Real Growth Story

The core scanner business is mature and growing single digits. The Enterprise TruRisk platform, which bundles asset management, attack surface mapping, and prioritized risk scoring, is where you'll find the growth.

It targets a larger share of the CISO's budget and is the main driver of multi-year contract expansions.

Every security vendor pitches an AI story. What Qualys actually built is risk prioritization that weighs exploit activity, asset importance, and business context, then tells you which 20 vulnerabilities to patch today instead of the 20,000 your scanner surfaced.

Saves you hours. In this budget climate, that's the one pitch your CFO is still signing off on.

Qualys also fits the profile private equity hunts for in cybersecurity: 40%+ FCF margins, no debt, sticky recurring revenue, and a digestible take-out size. You don't buy for that, but it's a free call option sitting on top of the thesis.

Action: Watch the Q3 call for formal TruRisk ARR disclosure, which would give you a new growth narrative to anchor to.

Prepare For Turbulence (Sponsored)

America’s debt burden is climbing fast, and Elon Musk has warned that the country needs a major productivity breakthrough to change the trajectory.

A free guide breaks down the warning, the pressure it could put on traditional retirement assets, and one alternative strategy designed to reduce exposure to future turbulence.

See How to Prepare Your Retirement for America’s Debt Problem

The Financials Behind the Thesis

Qualys turns roughly 40 cents of every revenue dollar into free cash flow. That puts it ahead of nearly every peer in security software. Growth is slower than the hyper-growth names, sure, but the cash this business kicks off is doing real work for you every quarter.

The buyback has retired a meaningful chunk of the float over the past three years. Fewer shares, same net income, higher EPS.

That tailwind compounds for you even when revenue growth is stuck around 10%, which is exactly where we are right now.

Zero debt, healthy cash and investments pile. That gives management the flexibility to lean harder on buybacks if the stock drops, or to pull off a tuck-in acquisition without ever touching the equity markets. For a company this profitable, that's a strong defensive posture you want to see.

At about 22 times forward earnings, Qualys trades at roughly half Zscaler's multiple. Tenable and Rapid7 trade even cheaper, because the market still worries CrowdStrike is bulldozing into the vulnerability management lane.

If the moat holds, that's your opportunity. If the moat is leaking, you're catching a falling knife.

Bear Case

CrowdStrike has been aggressive on vulnerability management with its Falcon Exposure Management product, and its sales reach is unmatched. More head-to-head wins squeeze the land-and-expand motion Qualys relies on, and you'll see it in the numbers.

If you're a CISO, you want fewer vendors in your stack. If you're already paying for Palo Alto, CrowdStrike, or SentinelOne, the pressure to drop a point solution like Qualys grows at every renewal. Multi-year contracts have masked this, but it compounds.

A real chunk of the business comes from federal agencies and large enterprise accounts. Budget delays or scope cuts show up in bookings a quarter or two before they hit revenue.

A run like this raises the bar. After a roughly 50% gain this year, the market no longer prices Qualys as a forgotten cash cow. If management can't show steady growth and another guide raise on the Q3 call, expect the stock to give back part of the run, so make that call your decision point before adding.

A big piece of EPS growth is coming from the shrinking share count, not organic growth. Strip the buyback out and the underlying business looks less exciting. Your valuation case holds together only if organic growth stays near 10%.

Action: Hedge with a larger security name like Zscaler (NASDAQ: ZS) or a broad cybersecurity ETF to shield against share loss to the mega-cap platforms. If you can stomach more risk, pair Qualys with a faster-growing peer like SentinelOne (NYSE: S) for extra beta on any category re-rating.

Q3 Setup Positions Qualys as an Overlooked Compounder

A clean beat and raise on November 4 is what forces sell-side coverage to redo their models higher. Management already raised its full-year guide once in August, and you're watching for a second raise. Watch for a beat on revenue and billings, plus any guide-up for Q4, as the catalyst.

A fresh buyback authorization, or a visible step-up in the pace of repurchases, would signal that management thinks shares are undervalued here. It also directly accretes to EPS, giving you a second lever beyond organic growth.

How I'd frame a position: build an initial stake in the current price range ahead of the Q3 print. Don't go all in. Keep dry powder to add on weakness. If the stock sells off on a decent report, that tells you short-term money just doesn't care, which is your signal to double up, not panic out.

If you already own it from lower levels, sit tight. The buyback is grinding the share count down every quarter, which effectively lowers your cost basis without you lifting a finger.

Setup Scorecard

Entry Zone: $188–$202

Target: $228

Stop Loss: Reassess below $182

Catalyst Timeline: Q3 2026 earnings November 4 (after the close), then Q4 guide and 2027 outlook in February

Confidence Level: Medium-High. The valuation and FCF profile protect the downside. The upside depends on a growth reaccel showing up in the next one or two prints.

That's our coverage for today; thanks for reading! Reply to this email with feedback or any tech stocks you want me to check out.

Best Regards,
—Noah Zelvis
Tech Stock Insider