Qualys (NASDAQ:QLYS) reported second-quarter 2026 revenue growth of 11% to $182.2 million and raised its full-year outlook, citing improved upsell execution, growing channel contribution and customer interest in its enterprise risk-management platform and automated remediation capabilities.
Chief Executive Officer Sumedh Thakar said the company is positioning its Enterprise TruRisk Management, or ETM, platform as an “AI-native Risk Operations Center” designed to help organizations detect vulnerabilities, validate whether they are exploitable, quantify risk and remediate exposures across multi-vendor environments.
New AI Security and AI Infrastructure Offerings
At Black Hat, Qualys plans to showcase new capabilities spanning AI for security and security for AI. The company introduced InstaScan, powered by Agent Insta, which is intended to identify exposure findings within minutes of a vulnerability disclosure without requiring a new scan cycle. According to Thakar, the capability uses asset inventory, software-path and threat-intelligence data already collected by Qualys sensors.
InstaScan is designed to feed findings into TruConfirm and Agent Val, which the company said validate exploitability and prioritize the vulnerabilities that require action. Qualys also highlighted Agent Sarah, which is intended to coordinate remediation waves, prioritize risk and revalidate that an exposure has been closed.
Thakar said the company’s autonomous remediation workflow can determine whether to deploy a patch, stage a control rollout or use a compensating control, depending on the asset and operational risk. In live benchmarking, he said the platform reduced the exposure window from 21 days to minutes and automatically patched 60% of vulnerabilities. He also said Qualys has deployed 150 million patches during the past 12 months, including 40 million deployed autonomously.
For security of AI systems, Qualys announced TotalAI 2.0, which it said is designed to give organizations visibility into AI activity across employees, workloads, code and runtime environments. The offering includes sensors intended to identify shadow AI usage and production AI services across hybrid and multi-cloud environments, as well as posture-management coverage for SaaS platforms including Anthropic and OpenAI.
Customer Expansion and QFlex Rollout
Thakar said customers spending $500,000 or more with Qualys increased 8% from a year earlier to 229. He described a low seven-figure annual QFlex upsell with an existing Global 300 customer that adopted VMDR, ETM, TruRisk Eliminate, TotalAI and other modules. The customer was seeking to manage a data-intensive environment spanning on-premises systems, multiple clouds and growing large-language-model deployments, he said.
The company also cited a six-figure QFlex upsell with a European healthcare customer that adopted VMDR, ETM and TruRisk Eliminate. According to Thakar, the customer had relied on a managed service provider for much of its vulnerability-management program and sought more direct visibility and automation.
Qualys has expanded the availability of QFlex to enterprise customers. Chief Financial Officer Joo Mi Kim described QFlex as a premium offering that gives customers flexibility to adopt and shift among multiple Qualys solutions. She said it currently applies to a small percentage of customers and has not yet materially affected reported financial metrics, but the company believes it can support broader net dollar expansion over time.
Financial Results and Updated Outlook
Kim said channel partners accounted for 54% of second-quarter revenue, compared with 49% a year earlier. Revenue from channel partners grew 22%, while direct revenue was largely unchanged from the second quarter of 2025. Revenue outside the U.S. increased 15%, ahead of 8% domestic growth, with the U.S. representing 55% of revenue and international markets representing 45%.
- Net dollar expansion rate improved to 105%, from 104% in the prior quarter.
- Customers with prior-year ETM or CSAM purchases had a 107% net dollar expansion rate, unchanged sequentially.
- ETM and CSAM represented 12% of total trailing-12-month bookings and 14% of new bookings, compared with 9% and 10%, respectively, a year earlier.
- Patch management represented 9% of total trailing-12-month bookings and 16% of new bookings.
- Adjusted EBITDA was $83.8 million, or a 46% margin, compared with a 45% margin a year earlier.
- Non-GAAP diluted earnings per share were $1.98, while free cash flow was $55.9 million, representing a 31% margin.
Operating expenses increased 8% to $73.2 million, with sales and marketing expense rising 14%. Kim said the company plans further sales and marketing investment in the second half, supported by a partner-led go-to-market approach and increased headcount.
Qualys spent $76.8 million to repurchase 797,000 shares during the quarter and had $229.8 million remaining under its repurchase authorization at quarter-end.
For full-year 2026, Qualys increased its revenue outlook to a range of $732 million to $738 million, representing growth of 9% to 10%, from prior guidance of $721 million to $727 million. The company forecast third-quarter revenue of $185.5 million to $187.5 million, also representing 9% to 10% growth.
Qualys now expects full-year non-GAAP EPS of $7.74 to $7.88, up from its prior outlook of $7.44 to $7.65. It forecast third-quarter EPS of $1.91 to $1.98. The company expects full-year EBITDA margin in the mid-40% range, operating expense growth in the low teens and free-cash-flow margin in the low 40% range.
Management said strong second-quarter billings reflected a smaller group of customers already advanced in ETM and Risk Operations Center discussions. Kim said the company expects second-half current billings growth of 7% to 8%, as it has not yet seen material changes in sales cycles among customers renewing later in the year.
Thakar also pointed to a developing federal opportunity, saying Qualys’ FedRAMP High platform supports both detection and patching. While federal revenue is not currently a large part of the business, he said new government requirements around faster detection, exploit validation and remediation are creating additional customer conversations.
About Qualys (NASDAQ:QLYS)
Qualys, Inc (NASDAQ: QLYS) is a leading provider of cloud-based security and compliance solutions designed to help organizations streamline their IT security programs. Operating on a unified, modular platform, Qualys offers continuous visibility into global IT assets through a combination of lightweight cloud agents and on-premises scanner appliances. The platform supports an array of security and compliance use cases, enabling real-time detection of vulnerabilities, policy violations and misconfigurations across on-premises, cloud and hybrid environments.
The company’s flagship Qualys Cloud Platform delivers a suite of integrated applications, including vulnerability management, detection and response (VMDR), policy compliance, web application scanning, file integrity monitoring, asset inventory and container security.
