Qualys (QLYS) Q1 FY26 earnings call: guidance and Q&A

Are frontier AI models (Anthropic, OpenAI) leading to more customer inquiries, and how will this translate into the financial model for 2026?

AI models will lead to more vulnerability disclosures and faster exploit development, increasing the need for rapid, autonomous remediation. Customers are reaching out to understand Qualys' patch management and exploit validation capabilities. While engagement is positive, it's too early to quantify the impact on pipeline and outlook, and current guidance does not assume a material change.

“But we are happy to see the engagement that we are seeing from the inbounds that we're getting from customers trying to understand how basically can respond to this.”

asked by Patrick Edwin Colville · answered by Sumedh Thakar

What is driving the strong new customer additions, and how are patch management and TruRisk Eliminate impacting new customer conversations and attach rates?

Strong execution and focus on agent AI and remediation capabilities are resonating with customers. The need for risk measurement and management, especially with ETM's hyper-prioritization and high-quality detection, is driving conversations. While ETM is still early, the company is encouraged by the discussions, and partners are helping drive new logos and upsells.

“And so I think definitely good execution by the team. Focused execution is key there. If you kind of recall our what we talked about at RSA, and a little bit before that, our focus on agent I agents as we went into last year.”

asked by Roger Boyd · answered by Sumedh Thakar

How important is access to models like Midos or GPT 5.5 Cyber for Qualys' business, and what is the future of integrating these generative AI solutions with agents for the platform?

Access to specific models is less important than the overall direction of AI. Qualys leverages various models (open-source, frontier) to enhance exploit creation, patch research, and mitigation strategies. These partnerships accelerate capabilities for safe exploit creation and identifying non-patch mitigations. Integration with LLMs/SLMs optimizes outcomes for AI agents taking action, making AI capabilities crucial for any solution.

“I think it's less about a particular model and more about the direction that these models are going, right? And so I think for us, it is -- we have been leveraging other open source models as well, and we're excited to now be part of the TAC program from OpenAI, which gives us access to 5.5 cyber, which is an equivalent model for the most parts to Midos as an example and also part of the verification program.”

asked by Unknown Analyst · answered by Sumedh Thakar

How does breach risk management differ from prior approaches, and what positions Qualys uniquely to offer this solution?

Qualys' ETM platform and Risk Operation Center (ROC) provide an end-to-end solution, going beyond traditional CSAM by integrating exploit validation and remediation. The ability to detect, validate, fix, and revalidate in under 15 minutes is a key differentiator. The platform also integrates with cyber insurance for risk quantification, allowing customers to make better prioritization decisions and potentially reduce premiums. The changing threat landscape is increasing customer interest in this integrated approach.

“I mean what's interesting is you look at our demo that we did at RSA agent well, Agent well went from finding the vulnerability, validating the exploit, applying a mitigation and then revaluating the exploit that it is fixed in under 15 minutes.”

asked by Jonathan Ho · answered by Sumedh Thakar

Are ETM sales achieving the full uplift? Clarify the 107% NRR for ETM/CSAM cohort. How is sales productivity trending, and where are sales and marketing investments going?

It's too early to comment on the full dollar uplift from ETM sales due to the small cohort size. The 107% NRR for the ETM/CSAM cohort includes total spend from customers who had CSAM or ETM subscriptions a year ago, tracking their overall revenue contribution. The goal is for this cohort to drive overall NRR. Sales and marketing investments are primarily in headcount (over 10% growth last year) to capitalize on market upside and support the shift to indirect business, leading to productivity not yet at its future potential.

“It's a little too early for us to comment on how much of the uplift actually is illustrative dollar uplift is based on more of a list price, the cohort of customers that have subscriptions to ETM is too small today.”

asked by Rudy Kessinger · answered by Joo Mi Kim

Given the 107% ETM NRR and flat overall NRR (104%), what is the timeline for total NRR acceleration, and what macro pressures might keep it flat?

Overall NRR is expected to remain flat this year because ETM adoption is still in early stages and not anticipated to materially impact total NRR. The baseline guidance considers macro factors and geopolitical conditions, which present both potential headwinds and tailwinds. While increased demand due to cybersecurity risks is a tailwind, potential disruptions and increased sales cycles due to macro volatility could offset gains, leading to a flat NRR assumption for the year.

“So for this year, our baseline is that taking into consideration the macro factors, geopolitical conditions today, we do see some potential headwinds could be fully offset by the tailwinds that Sumedh had mentioned earlier, with the increase in demand given that our customers are willing to spend more with us increase in cybersecurity risk that we can definitely help to remediate.”

asked by Joseph Gallo · answered by Joo Mi Kim

Where is foundation model expertise best placed for vulnerability discovery/exploitation, and how does this change customer risk profiles and platform utilization for mitigation across diverse asset types (OS, custom apps, OT)?

Foundation models excel at finding vulnerabilities in code, potentially reducing zero-day problems if developers patch quickly. They also can chain low-level vulnerabilities to create exploits, which Qualys' TruRisk platform addresses by identifying high-risk low-CVSS vulnerabilities early. For mitigation, ETM offers 'patchless patching' by providing compensating controls (e.g., deleting DLLs, registry changes) for assets that cannot be immediately patched, like OT environments. The platform helps customers determine if a vulnerability is truly exploitable in their context and offers multiple remediation choices.

“I think helping software developers find more vulnerabilities in their code is definitely one of the key things there that these models bring and which will definitely lead to more disclosure.”

asked by Brian Essex · answered by Sumedh Thakar