Qualys (NASDAQ:QLYS) reported 11% revenue growth for the third quarter of 2026 and raised its full-year earnings outlook, as federal customer wins helped drive a second consecutive quarter of double-digit growth in calculated current billings.
Revenue rose to $188 million, while non-GAAP earnings were $2.12 per diluted share, Chief Financial Officer Joo Mi Kim said. Adjusted EBITDA was $89.9 million, or 48% of revenue, compared with a 49% margin a year earlier. Free cash flow was $100 million, representing a 53.2% margin.
The cybersecurity company now expects 2026 revenue of $736.9 million to $738.9 million, up from its previous range of $732 million to $738 million. It raised its non-GAAP earnings forecast to $8.07 to $8.14 per share from $7.74 to $7.88.
Federal Deals Lift Billings
Calculated current billings grew 14% in the third quarter, following 16% growth in the second quarter. Kim said federal business was the primary driver of the third-quarter outperformance, with new customer acquisitions contributing to growth. Several federal deals closed during the quarter that could have slipped into the fourth quarter, she said.
For the fourth quarter, Qualys expects approximately 8% calculated current billings growth as a base case and 11% growth for the full year. Kim said federal deals can be lumpy, and while another strong federal quarter could produce upside, the company is not assuming that in its forecast.
Asked whether the recent billings performance signaled a near-term acceleration in revenue growth, Kim pointed instead to the company’s more stable underlying indicators. Its overall net dollar expansion rate remained at 105%, unchanged from the second quarter. The rate for customers with prior-year ETM or CSAM subscriptions improved to 108% from 107% sequentially.
Kim said Qualys does not expect a material change in the overall expansion rate or a decline in the fourth quarter. She also said the company has not seen a material change in sales cycles or win rates.
Third-quarter revenue was affected by the timing of deals that closed near the end of the period, particularly new customer wins, Kim said. That left less time to recognize revenue during the quarter.
Automation and Patching Drive Product Strategy
President and CEO Sumedh Thakar said customers are increasingly interested in automating the process of detecting, prioritizing and fixing vulnerabilities. He cited the need for faster remediation as attackers use AI, while noting that customers often need time to align their security and IT teams before changing processes.
“The biggest blocker to faster patching is lack of confidence in operational outcome,” Thakar said.
Qualys introduced TruRisk Eliminate 2.0 with TruConfidence, which Thakar described as a remediation orchestration engine designed to assess existing security controls, extend coverage to assets that cannot run an agent and monitor systems after patches are deployed. He said the product also analyzes patch failures and recommends corrective action.
Over the past 12 months, customers deployed more than 180 million patches using TruRisk Eliminate with Agent Sara, with 60% running autonomously, up from 30% a year earlier, Thakar said. The company reported a rollback rate of fewer than one in 8,000 for those deployments.
Thakar said high-profile vulnerability disclosures are prompting more customer discussions, but do not typically lead to immediate purchases. Organizations must often change internal processes and bring IT teams into the decision, he said.
Large Customers and Partner Revenue Grow
The number of customers spending at least $500,000 with Qualys rose 15% from a year earlier to 243. Among the quarter’s wins, Thakar described a new low-seven-figure annual booking with a government agency and a seven-figure annual bookings upsell with an existing federal agency.
In the first full quarter after the general availability of Qualys’ QFlex purchasing model, participating customers increased their average annual bookings by more than 20% compared with their prior-year bookings, Thakar said. Kim cautioned that the early comparison involved a small group of customers.
Channel partners accounted for 55% of third-quarter revenue, up from 50% a year earlier. Channel revenue grew 24%, offsetting a 2% decline in direct revenue, Kim said.
Fourth-Quarter Outlook
Qualys expects fourth-quarter revenue of $191 million to $193 million, representing growth of 9% to 10%, and non-GAAP earnings of $2.05 to $2.12 per share. For the full year, it expects a 46% adjusted EBITDA margin and a free cash flow margin in the low 40% range.
The company repurchased 330,000 shares for $53.6 million during the third quarter. It had $176.1 million remaining under its repurchase program at quarter-end.
About Qualys (NASDAQ:QLYS)
Qualys, Inc provides cloud-based security and compliance software to help organizations identify and manage cybersecurity risks. Its platform brings together information about an organization’s IT assets and security posture to support vulnerability management, threat detection, and compliance activities.
Qualys offers products and services for vulnerability assessment and remediation, cloud security, endpoint protection, web application security, and policy compliance. Its solutions are designed to help customers monitor systems across cloud environments, on-premises infrastructure, and other connected assets.
Founded in 1999, Qualys is headquartered in Foster City, California, and serves customers around the world.
