Qualys (QLYS) Q2 2026 earnings review
Profitable Growth Accelerates; Guidance Raised Across the Board
Qualys delivered a strong beat-and-raise in Q2, with revenue growth accelerating slightly to 11% YoY ($182.2M). The standout narrative is immense operating leverage: Non-GAAP operating income surged 16%, driving a massive 45% margin, while operating cash flow skyrocketed 77%. The successful FedRAMP High authorization and momentum in the AI-native Enterprise TruRisk Management (ETM) platform gave management the confidence to raise FY26 revenue and EPS targets. Qualys is proving its platform consolidation strategy can win budget dollars even in a scrutinized macro environment.
🐂 Bull Case
TotalCloud achieved FedRAMP High Authorization, sponsored by the DEA. This fundamentally opens up a massive, previously inaccessible market of civilian, defense, and intelligence agencies for Qualys' Cloud-Native Application Protection Platform (CNAPP).
Calculated Current Billings surged 16% YoY in Q2, a sharp acceleration from the 8% growth seen in Q1. This points to strong underlying demand and validates the raised FY26 revenue guidance.
🐻 Bear Case
While channel partnerships are thriving, historical data from Q1 showed direct sales growing at an anemic 3%. If direct sales productivity does not improve, the company may struggle to sustain double-digit top-line growth over the long term.
The company's overall Net Dollar Expansion Rate has historically flatlined at 104%. Unless the new ETM platform drives massive cross-sell adoption, the ceiling on organic growth from existing customers is severely capped.
⚖️ Verdict: 🟢
Bullish. The combination of accelerating top-line leading indicators (16% billings growth), pristine margin execution, and a raised FY26 outlook makes this a compelling profitable growth story, anchored by real product innovation in AI and Federal markets.
Key Themes
FedRAMP High Authorization Unlocks Federal Spending
Qualys secured FedRAMP High Authorization, explicitly sponsored by the U.S. Drug Enforcement Administration (DEA). This is a critical growth driver, making TotalCloud (CNAPP) available on the FedRAMP Marketplace. Government agencies looking to consolidate legacy on-prem vulnerability scanners into a unified cloud platform now have Qualys as a cleared, high-security vendor option.
AI-Native Enterprise TruRisk Management (ETM) Adoption
The company continues to lean heavily into its ETM platform, framing it as an 'Agentic AI-driven Risk Operations Center (ROC).' The narrative is shifting customers from simple vulnerability detection (finding flaws) to autonomous remediation (fixing flaws). Integrations with frontier AI models (Anthropic, OpenAI) are accelerating this shift, creating C-level urgency that is driving pipeline expansion.
Partner-Led Go-to-Market Strategy
Qualys is strategically pivoting to a channel-heavy sales model. The introduction of the managed Risk Operations Center (mROC) allows partners to build high-margin services on top of the Qualys platform. This expands reach and drives new logos without proportional increases in direct sales headcount.
Stagnant Overall Net Retention Rate (NRR)
A persistent structural concern remains the company's total NRR, which has historically flatlined at 104% (as of Q1 26). This data point directly contradicts the highly optimistic narrative surrounding ETM upsells. While the specific ETM cohort retains at higher rates, it is not yet large enough to lift the consolidated metric, suggesting potential churn or down-sell pressure in the legacy core VMDR base.
Lagging Direct Sales Productivity
While channel sales are booming, direct sales efficiency is a notable laggard. In the preceding quarter, direct revenue grew a meager 3% YoY while channel grew 17%. Management is heavily investing in sales and marketing (GAAP S&M expenses were $41.0M in Q2, up 15% YoY), but the return on this direct investment remains questionable.
Macro Budget Scrutiny and AI Disruptions
The broader macroeconomic environment remains challenging for new logo acquisition. Furthermore, rapid announcements from frontier AI vendors (like OpenAI and Anthropic) risk stalling sales cycles as CISOs pause to evaluate shifting architectures rather than committing to immediate multi-year platform deals. This dynamic could cap upside potential.
Other KPIs
Accelerating significantly. CCB grew 16% YoY, a major jump from the 8% YoY growth recorded in both 25Q2 and 26Q1. This provides strong forward visibility and validates the decision to raise full-year revenue guidance.
Accelerating remarkably. OCF surged 77% YoY (up from $33.8 million in 25Q2). As a percentage of revenue, OCF expanded to 33% from 21% a year ago, showcasing immense cash-generation capabilities and efficient working capital management.
Guidance
Accelerating outlook. Management raised the full-year target from the prior $721.0-$727.0M range. The new midpoint implies a stable 9-10% YoY growth rate, showcasing confidence in second-half execution and pipeline conversion.
Accelerating profitability. Raised significantly from the prior $744-$7.65 range. This underscores the company's ability to drive top-line expansion while simultaneously wringing out operating efficiencies.
Decelerating slightly on a percentage basis. Implies 9-10% YoY growth, a slight step down from the 11% achieved in the current Q2, likely factoring in conservative macro assumptions and historical seasonality.
Key Questions
Net Dollar Expansion Rate Update
The earnings release omitted the specific Net Dollar Expansion Rate for Q2. Did this metric finally break out of the 104% plateau we saw in previous quarters, or is the core VMDR base still experiencing upsell friction?
Channel vs. Direct Mix
With the 16% surge in calculated current billings, what was the split between channel-led growth versus direct sales? Is direct sales productivity showing signs of improvement after lagging in Q1?
Converge Cyber Insurance Partnership
Regarding the new joint offering with Converge for reduced cyber insurance premiums, how are you modeling the monetization of this? Does it directly accelerate ETM adoption, or is it primarily a retention tool?