Qualys bets its future on an 'AI-native ROC' — and the tape finally votes yes
A +139% 90-day surge as the post-Mythos threat landscape validates — and accelerates — Qualys's two-year bet on autonomous remediation.
QLYS · Earnings Call · 2026-08-04
From scanner to sentinel
For most of its public life, Qualys was the quiet king of vulnerability scanning — a $3.5B company that found CVEs and let someone else fix them. The Q2 2026 call (reported August 4) draws a line under that era. The company's own keyword trajectory has flipped: the quarter is dominated not by scan volumes but by autonomous remediation, Agent Insta, Agent Val, Agent Sara, and native ROC adoption. This is company-unique vocabulary, not sector boilerplate. The thesis is blunt. AI has rewritten the adversary's playbook, collapsing exploit timelines from weeks to hours — and the old exposure-management model is structurally unable to respond.Sumedh Thakar names the foil explicitly: “CTEM solutions today respond by generating more findings, more theoretical risk scores and more dashboards” — Sumedh Thakar, President and CEO · 2026-08-04 — CTEM solution positioning that hands the problem off to siloed patching tools "while losing critical time at every handoff." This is a straw man built to sell a new architecture. Qualys's answer is an AI-native risk operations center (ROC) stacking three named agents: InstaScan (detection without rescanning — "it takes 24 hours to a week for organizations to detect it through traditional scan cycles"), Agent Val (safe exploit validation in production), and Agent Sara (wave-driven autonomous remediation gated by an AI patch-reliability score with sub-0.5% rollback rates). The old manual triage, Thakar argues, is obsolete: “You cannot solve a minutes problem with a month-long solution.” — Sumedh Thakar, President and CEO · 2026-08-04The adversary's playbook has been fundamentally rewritten by AI, collapsing exploit time lines and making one thing undeniably clear. Durable pre-breach risk management increasingly requires a vendor-neutral agentic AI fabric that moves beyond theoretical exposure to autonomous quantification of actual exploitable risk and remediation.
The tap is on, and the tape agrees
The pivot is not just rhetoric. Q2 delivered revenue of $182.2M (+11%), adjusted EBITDA margin of 46% (up a point), EPS of $1.98, and — critically — a full-year revenue guide raised to $732–$738M (9–10%), up from $721–$727M. Joo Mi Kim: “For the full year 2026, we now expect revenues to be in the range of $732 million to $738 million, which represents a growth rate of 9% to 10%.” — Joo Mi Kim, Chief Financial Officer · 2026-08-04 The net dollar expansion rate ticked from 104% to 105%, and LTM current billings growth accelerated to 10% from 8.5% last quarter — the first real acceleration after a year of "7% to 8% baseline" language. The fundamentals axis corroborates the story: Total Revenue stood at $176M in Q1 2026, up 10% YoY, on an 11-year ascent of roughly +357%, while operating margin reached 37%, and FCF margin (ex-SBC) holds at 42.3%. The market has noticed. The 90-day price tape is unambiguous — a +138.8% surge that peaked at $195.88 on August 13 before a ~7% pullback, leaving the stock in striking distance of — though still ~11% under — the December 2023 all-time high of $205.89. For a name that spent two years grinding down from that peak, this is a re-rating, not a bounce.The confluence — and the caveat
Qualys is not alone in sensing the AI-security wave. The global keyword universe shows frontier model, "Agentic AI offering," and "security for AI" themes crossing calls from AMZN, PLTR, CHKP, and ZETA — and the 90-day tape rewards "High performance computing" and "AI at scale" clusters. But Qualys's bet is bolder than a feature: it is betting the company on autonomous remediation, a thesis it has quietly built for two years. Prior calls show the groundwork — and the market has been circling it since before the post-Mythos rupture:Two quarters ago, Thakar was already describing the agent stack that now headlines Q2: “What Agent Val does is it leverages that decision-making, autonomous decision-making process to basically look at the findings, look at the scoring, but then actually the ability to run a very safe exploit against the asset” — Sumedh Thakar, President and CEO · 2026-02-05 — and its blunt corollary, “you cannot show up for the AI fight today with your Jira tickets and your ServiceNow tickets.” — Sumedh Thakar, President and CEO · 2026-02-05 The caveats are real. ETM/CSAM still represents just 12% of bookings and 14% of new bookings — roughly flat sequentially — and Joo Mi concedes the new-bookings mix "depends more on the customers who are onboarding." Pipeline conversion is early, the federal opportunity is "not a big part of the business," and leadership is in flux (a CISO/ETM GM departure, new product leader Shailesh Athalye and new CISO Nathan Smolenski). Kingsley Crane's question captured the setup precisely: “is it that the conviction in the business hasn't changed and the market has come towards you this quarter?” — William Kingsley Crane, Analyst · 2026-08-04 For now, the evidence leans toward the latter. A +139% 90-day tape, a raised guide, and net dollar expansion at a multi-quarter high say the market believes Qualys when it claims the post-Mythos era makes autonomous remediation a budget line, not a feature. The next two quarters — how much of that growing federal and ROC pipeline converts to $500K+ customers — will decide whether this is a re-rating or a genuine re-acceleration.it really becomes a game of how quickly can you apply the patch that the vendor is giving in a matter of hours and not wait for days and weeks as it happens right now?