Qualys, Inc. (NASDAQ:QLYS) is a leading provider of vulnerability management solutions. Vulnerability management solutions are used to help companies detect security holes in their computer networks. Qualys deploys their solutions either through a private or an external cloud. The IDC estimates the vulnerability management market grew at a CAGR of 10.9% from 2009-2013. During the same period, Qualys' revenue grew at a CAGR of 15.5%. Qualys has been able to outpace the industry without sacrificing profitability. Although not high, operating and net income margins were 1.9% and 1.5% in 2009, respectively. In 2013, operating and net income margins have remained low but still positive at 2.1% and 1.5% respectively. Management's balanced approach has resulted in rapid net income growth. From 2009-2013, net income grew at a CAGR of 17.3%. Management's growth plan has produced even better results in 2014. In Q2 2014, revenue grew 23.4% y/y and net income grew 95.4% y/y. In the first half of 2014, revenue has grown 23.3% y/y and net income has grown 368.9% y/y.
The vulnerability management industry has grown rapidly and is expected to continue its rapid growth over the next several years. The IDC estimates the vulnerability management industry will grow at a CAGR of 14.2% until 2018. Vulnerability management is a vital part of Qualys' revenue. In Q2 2014, vulnerability management accounted for 82% of revenue. This is a significant amount but has been trending downward. This is due to Qualys increasing their product offerings which target new and sometimes faster growing markets. They have entered the web application firewall or WAF industry which is expected to grow faster than vulnerability management. Additionally, the company's WAF offering can be used to compliment their existing products. Qualys has entered the policy and compliance industry which is expected to grow slower than vulnerability management but they have a competitive advantage. This competitive advantage should help them gain market share and outpace the industry's growth. The company's future growth will depend on their new product offers but also on maintaining or growing their current vulnerability management market share.
Maintaining Market Share
The vulnerability management market isn't as concentrated as other technology industries. The IDC estimates International Business Machine Corp. (NYSE:IBM) is the only company with a double digit (16.0%) market share. Additionally, the vulnerability management market doesn't require significant resources to be competitive which has helped Qualys rise to the top. The IDC estimates Qualys has a market share of 9.1% which is third right behind Hewlett Packard (NYSE:HP) who has a 9.3% market share. Qualys has risen to the top of the vulnerability management market because of its top quality solutions. In 2014, Frost & Sullivan awarded Qualys with their Global Market Leader Award for vulnerability management. Qualys has now won this award three years in a row. The company's vulnerability management solutions have help create a vast network of customers. Qualys represents an estimated 40% of fortune 500 companies, according to Frost and Sullivan. This network gives management the ability to cross sell their new WAF offering. Qualys market share hasn't been solely the result of selling the best products. Qualys has also been able to gain market share because of their low prices. Gartner writes about their web applicant scanning solution "Qualys offers aggressive list pricing at $495 per application per year, and customers report high levels of discounting." Additionally, they also offer a low cost of deliver through the cloud. The cloud has less upfront costs than an on premise solution. The company's new WAF solution will help compliment Qualys' vulnerability products but should be able to sell well on its own.
Web Application Firewall Market
The web application firewall market is growing fast. Gartner estimates that the WAF market grew 30% in 2013 reaching $337 million. Additionally, Tech Navio estimates the global web application firewall market will grow at a CAGR of 18.34% from 2012-2016. The WAF market is not only growing rapidly but is expected to move into the cloud. Cloud based web application firewalls will protect 50% of public web application protected by a WAF solution by 2020, according to Gartner. This is up from less than 10% today. The company's cloud based WAF solution should help grow revenue and Qualys' customer base. Management's expansion into the web application firewall segment gives them access to a fast growing market which they are positioned well to exploit. Yet, management's entrance into the policy and compliance industry which isn't growing as fast will require a competitive advantage in order to maintain double digit growth. Qualys is well suited for the policy and compliance market because of their low cost focus and deployment.
Policy And Compliance
Qualys' venture into the policy and compliance industry was a natural extension of its product offerings. Although, the policy and compliance industry is growing slower than vulnerability management. The policy and compliance industry is expected to grow at a CAGR of 8.6% until 2018. Despite the industry's slower growth, this growth should remain in the high single digits due to new and existing regulations. For example, the Payment Card Industry or PCI has a set of security standards and requirements which have to be met in order to accept credit card payments or store credit cardholder data. PCI requirement 6 states companies need to develop and maintain secure systems and applications. This section requires companies to test their security systems for vulnerabilities using third party sources. This requirement along with a myriad of other regulations have increased the demand for compliance related vulnerability testing. These regulations have resulted in a relatively high growth rate and should help maintain the industry's growth going forward. Since entering the market, Qualys has performed well and should continue to performed well because of their focus on low cost delivery.
On the Q2 conference call, Philippe Courtot CEO was asked if their Policy and Compliance and Web Application Scanning segments grew 50% y/y. He said "Yes, they did. Our Policy Compliance application has measured very well and we see the big uptake as well of our Policy Compliance application." Second quarter results were a continuation of the company's rapid growth in this segment. Like vulnerability management, Qualys makes an award winning compliance solution. They won the Best Risk/Policy Management solution which was presented by SC magazine. Yet, their low cost delivery system is more important in this market. Kelly Kavanagh reports in Gartner's Market Scope for Vulnerability corporations are unwilling to spending significant resources on compliance related vulnerability. As a result, this has put significant downward pressure on prices. Qualys can deliver a cheap and award winning solution through their cloud and increasingly their private cloud offering. This gives Qualys a competitive advantage in this market. Additionally with their private cloud solution, they have reduced the drawbacks of only supplying an external cloud. The private cloud is very important to international and some domestic market segments.
Private Cloud Matters To Compliance And International Markets
Regulation has resulted in the increased growth of policy and compliance vulnerability testing. This market requires cheap and easy to deliver testing applications. Qualys' cloud offering delivers on this goal. However, there are regulations which require data to remain on premises. According to Forbes, HIPAA and the European Union have strict data protection laws. European laws are especially strict with some penalties in the hundred million euro range, according to IT Pro Portal. These laws and penalties make it unfeasible to use an external cloud solution. This is where Qualys' private cloud can help target these enterprise customers.
The private cloud is especially important in Europe where a combination of regulation and slow cloud adoption is present. On the Q2 conference call, Philippe Courtot stated "Oh, yes, in fact, the private cloud is really becoming very strategic in Europe, where we see a very - we have a lot of private clouds in negotiation... So they really prefer in a way to have the data locally, so the combination of, if you prefer, local regulation or local mentalities makes that the private cloud is very appealing." Although, Qualys generates most of its revenue in the United States. International markets still make up about 30% of total revenue. The combination of an external and private cloud help Qualys better target and serve the compliance industry. Management has done a great job of growing profits and the company but this hasn't gone unnoticed.
Data: Reuters- Financials
Management has pursued a balanced approached to growth. This balance approach has resulted in rapidly revenue and net income growth. This growth hasn't gone unnoticed. Since earnings were released, Qualys stock has increased 6%. The 6% appreciation has increased the company's already high valuation. Qualys' stock is trading at a significantly higher P/E and P/FCF compared to both the industry and sector. The company has a positive profit margin but this margin is still well below both the industry and sector. They do have significantly higher sales growth which should continue in the future. Yet, investors are pricing in a significant amount of this future growth. While the company should continue its rapid growth, the current valuation doesn't offer a significant appealing risk reward.
Diversification Isn't Slowing Down Growth
Qualys has grow rapidly over the last several years. They have been able to outpace the vulnerability management industry's growth due to a solid product offering and a focus on low cost delivery. The vulnerability management industry is expected to continued its rapid growth. Management has position the company well by adding to their top quality products. The introduction of a WAF solution will increase sales due to cross selling opportunities and entering a rapidly growing market segment. The WAF market is expected to grow faster than the vulnerability management market. This should help Qualys gain customers and maintain their high growth rate. Additionally, management venture into the policy and compliance market which although slower growing shouldn't slowdown overall growth.
The policy and compliance industry is growing in the single digits which will require Qualys to gain market share in order to maintain double digit growth. They need and have a competitive advantage through their low cost delivery system. Their cloud based delivery system has lower upfront cost than on premise solutions. Additionally, Qualys' private cloud reduces the limitation of their external cloud. The private cloud allows Qualys to better target companies unwilling or unable to move to an external cloud. Qualys is well positioned in several fast growing market segments. The company is growing fast and should continue. However, the company's success hasn't gone unnoticed. The stock is trading at a significantly high premium to the industry and sector. Although growth shouldn't be an issue, Qualys' current stock price doesn't offer a significant risk reward profile.
Disclosure: The author has no positions in any stocks mentioned, and no plans to initiate any positions within the next 72 hours.
The author wrote this article themselves, and it expresses their own opinions. The author is not receiving compensation for it (other than from Seeking Alpha). The author has no business relationship with any company whose stock is mentioned in this article.