Qualys, Inc. Common Stock 2026 Q2 Earnings Call

Good afternoon. Welcome to Qualys' second quarter 2026 earnings call. Joining me today to discuss our results are Sumedh Thakar, our President and CEO, and Joo Mi Kim, our CFO. Before we get started, I would like to remind you that our remarks today will include forward-looking statements that generally relate to product capabilities, future events, or future financial or operating performance. Actual results may differ materially from these statements. Factors that could cause results to differ materially are set forth in today's press release in our filings with the SEC, including our latest Form 10-Q and 10-K. Any forward-looking statements that we make on this call are based on assumptions as of today. We undertake no obligation to update these statements as a result of new information or future events. During this call, we will present both GAAP and non-GAAP financial measures.

A reconciliation of GAAP to non-GAAP measures is included in today's press release. As a reminder, the press release, prepared remarks, and investor presentation are all available on the investor relations section of our website. With that, I'd like to turn the call over to Sumedh.

Thank you, Blair. Welcome to our second quarter earnings call. The adversary's playbook has been fundamentally rewritten by AI, collapsing exploit timelines and making one thing undeniably clear. Durable pre-breach risk management increasingly requires a vendor-neutral agentic AI fabric that moves beyond theoretical exposure to autonomous quantification of actual exploitable risk and remediation. Demonstrating this conviction, we delivered another quarter of strong revenue growth and profitability. The urgency behind that conviction continues to intensify. Frontier and open source AI models are capable of discovering and weaponizing vulnerabilities faster than any human team can triage them, compressing exploit timelines to hours, and in some cases, turning disclosure into compromise before a patch even exists. AI is simultaneously becoming the greatest force multiplier and the most formidable challenge cybersecurity has ever faced. Where we part ways with the continuous threat exposure management, CTEM Solutions, is how we respond to it.

CTEM Solutions today respond by generating more findings, more theoretical risk scores, and more dashboards, and then pass along these findings off to siloed solutions that collect data and do the patching while losing critical time at every handoff. That approach was already failing before AI accelerated the threat landscape, and it is fundamentally inadequate now. We believe the defenders who win in this new era of AI will not be the ones who simply detect more and more vulnerabilities and produce dashboard tourism. They will be the ones who can autonomously detect vulnerabilities at AI speed, validate actual exploitability in production, quantify that risk in dollar terms, remediate it, and then prove the exposure is closed in multi-vendor environments, all before an adversary gets there first.

That is the design outcome of the AI native risk operations, ROC, powered by our Enterprise TruRisk Management, ETM solution. It is where nearly every customer conversation we are having is heading. Against this backdrop, I am pleased to announce major new capabilities on the platform we'll showcase at Black Hat later this week, spanning both AI for security and security for AI to address the post-Mythos threat landscape head-on. First, with respect to AI for security, we're pleased to introduce InstaScan, powered by Agent Insta, the newest addition to our Agentic AI marketplace and ETM solution for AI speed detection that is continuous, instantaneous, and scanless. Today, when a new vulnerability advisory is released, it takes 24 hours to a week for organizations to detect it through traditional scan cycles while adversaries weaponize the same vulnerability in minutes. Agent Insta is designed to collapse that timeline.

By converting the asset inventory software paths and threat intelligence our customers already collect with Qualys sensors into high-confidence exposure findings without a scan, new detections appear within minutes of disclosure and no rescan required and no agent disruption. The finding is then handed to Agent Val for instant exploit validation, and the risk impact is determined and quantified immediately. While competitors are still processing an advisory, writing signatures, and waiting for a scan to complete, our customers already know whether they are exposed and are taking action before a vendor patch exists. Because the finding flows straight into validation and remediation, detection is not a report. It is the first step of a continuous closed loop.

With last quarter's launch of TruConfirm and Agent Val safely validating actual exploitability across chain attack paths in live production environments and hyper prioritizing millions of findings to the fewer than 1% that require immediate action, the bottleneck is now shifting from identifying what to fix to actually fixing it before adversaries can act. This leads me to the next phase of our TruRisk Eliminate agenda, autonomous zero-day remediation at scale. Through AI-scored autonomous remediation waves, the AI native ROC now determines the right action for every asset in multi-vendor environments, deploying a patch, staging a control rolled out where caution is warranted or applying a compensatory control where operational risk demands it. Every action is gated by our AI-driven patch reliability score and resiliency snapshots, delivering rollback rates below 1.5%, below half of 1%.

The most critical assets remain human in the loop oversight while the platform autonomously remediates the rest. Orchestrating the cycle is Agent Sarah, who prioritizes exploitable risk, quantifies it in dollar terms, sequence continues waves, and revalidates closure with Agent Val, all without proportional headcount. Furthermore, with the introduction of peer-to-peer patching, we are accelerating the delivery across distributed environments while removing the dependency on centralized infrastructure. Put simply, these newest innovations make autonomous zero-day remediation wave-driven, vendor-agnostic, safe, and provable. In live benchmarking, this collapsed the window of exposure from 21 days to minutes and auto-patched 60% of the vulnerabilities. This is not incremental. It turns a massive surge in exploitable vulnerability volume from an impossible backlog into a continuously clear queue at the speed of modern attacks. You cannot solve a minutes problem with a month-long solution.

That's the gap the AI-native ROC was designed to solve with Agent Insta providing AI speed detections, Agent Val hyper-prioritizing validated exposures, and Agent Sarah performing autonomous remediation in a continuous closed loop. Turning to security for AI, as enterprises raise AI workloads into production, the AI infrastructure they are building is already the next attack surface. With the introduction of TotalAI 2.0, organizations can now see their full AI estate from workforce to workload and from code to runtime. Through new sensors that see AI activity at both the employee and workload level, security teams can now discover shadow AI activity across the organization. From what employees are doing with AI to which models, endpoints, and services are running in production across hybrid multi-cloud environments.

We have also extended our posture management coverage to SaaS platforms, including Anthropic and OpenAI, to help organizations enforce security and compliance policies across the AI platforms their teams are already using. Additionally, they can now identify security gaps in code before deployment, remediate with guardrails at runtime, and test model context MCP tool exploits across over 50 adversarial scenarios. Of equal importance, every AI risk across the entire stack from GPU to infrastructure to supply chain to the newest prompting injection attacks, is now scored and prioritized through the same TruRisk engine that powers the Risk Operations Center. For organizations seeking to secure the infrastructure powering their AI future, these new innovations become an increasingly strong differentiator for Qualys.

As the ROC adoption accelerates and these capabilities continue to compound, we remain laser-focused on driving ETM adoption throughout our VMDR customer base and positioning Qualys for larger upsell opportunities over time. Moving to our business update with customer spending $500,000 or more with us growing 8% from a year ago to 229. Let me share a couple of recent wins which illustrate why organizations are turning to Qualys to help unify their security stack and operationalize the ROC. The first is with an existing Global 300 customer managing a complex data-intensive environment spanning on-prem multi-cloud and rapidly growing LLMs in production. As the volume and velocity of vulnerabilities across the environment accelerated, their teams recognized that prioritization based on theoretical risk scores couldn't deliver the business context needed to act decisively.

With fragmented telemetry, disconnected tools, and little automation, their teams were spending more time documenting risk than reducing it, while unpatched assets and shadow IT were silently extending exposure windows by months. As a result, the customer chose Qualys to operationalize their ROC, adopting VMDR, ETM, TruRisk Eliminate, and TotalAI alongside several other modules in a low seven-figure QFlex annual upsell. By consolidating Qualys and third-party data into a unified risk fabric, this customer has aligned risk reporting to the board's tolerance level, shifted remediation from manual processes to autonomous workflows, and reduced its exposure window from months to hours while flattening the hiring curve and delivering better security outcomes. This is also an outstanding example of how we are leveraging our channel partners to activate the ROC to win new business.

The second is with a European healthcare company that has been a small existing scan-on-behalf Qualys customer but was relying on a managed service provider to run their broader vulnerability program across more than 140 locations. That model delivered people and process, but not autonomy. Scan operations, prioritization, and remediation guidance all flowed through the provider's team on the provider's timeline, leaving the customer dependent on external resources to understand and act on its own risk. As this environment grew more complex and vulnerability volumes surged, the limitation of that dependency became unsustainable. Costs for ballooning remediation cycles for the customer had limited visibility into the very data driving the decisions made on its behalf. This customer chose Qualys, consolidating its stack into the Qualys platform by adopting VMDR, ETM, and TruRisk Eliminate in a six-figure QFlex upsell.