According to IDC, the global security and vulnerability management market grew 14.2% to $6 billion in 2016. Qualys’ revenue grew at a much faster rate of 20.3% to capture 10.1% of the market and fifth position behind IBM, HPE, Dell, and Splunk. Qualys (Nasdaq: QLYS) leads the Worldwide Device Vulnerability Assessment Market with a 17% share. Not only is it growing at the fastest rate, it is also one of the most profitable SaaS companies out there.

Qualys’ Financials

In the recent fourth quarter results, Qualys reported revenue of $62.9 million, up 20%. GAAP net income was $2.9 million, or $0.07 per diluted share, compared to $5.9 million, or $0.15 per diluted share a year ago. Non-GAAP net income was $13 million, or $0.32 per diluted share. Analysts expected earnings of $0.28 per share on revenue of $62 million.

Revenues for 2017 increased by 17% to $230.8 million compared to $197.9 million for 2016. GAAP net income for 2017 was $40.4 million, or $1.01 per diluted share, compared to $19.2 million, or $0.50 per diluted share a year ago. Non-GAAP net income for 2017 was $43.5 million, or $1.09 per diluted share.

It ended the year with 869 full-time employees, up 30%.

For the first quarter, Qualys expects revenue in the range of $63.4 million to $64.1 million, representing 19% to 21% growth. It expects GAAP net income per diluted share in the range of $0.13 to $0.17 and non-GAAP net income per diluted share in the range of $0.32 to $0.34.

The company expects revenues for the full year 2018 to be in the range of $275.5 million to $278.5 million, representing 19% to 21% growth. GAAP net income per diluted share is expected to be in the range of $0.71 to $0.76. Non-GAAP net income per diluted share is expected to be in the range of $1.39 to $1.44.

Qualys’ Offerings

Redwood City-based Qualys offers cloud-based security and compliance solutions that enable organizations to identify security risks to their IT infrastructures and help protect their IT systems and applications from cyber-attacks.

Its Qualys Cloud Platform has a unique, private cloud architecture that enables the company to provide scale, accuracy, and immediacy through its solutions. It consists of a suite of IT security and compliance solutions such as Vulnerability Management, Continuous Monitoring, Cloud Agent, AssetView, ThreatPROTECT, Policy Compliance, Payment Card Industry Compliance, Security Assessment Questionnaire, Web Application Scanning, and Web Application Firewall.

In 2017, the company launched several new solutions into General Availability (GA) including File Integrity Monitoring (FIM), the detection of Indication of Compromise (IOC), and Security Configuration Assessment (SCA). In 2018, the company plans to launch into GA solutions such as Container Security, Cloud Inventory, Cloud Security Assessment, Certificate Inventory, and Certificate Assessment.

Its solutions are used by over 10,300 customers in over 100 countries, including Forbes Global 100 and Fortune 100 companies. It recently added Adventist Health System, Brigham Young University, Celestica, London Metal Exchange, Penguin Random House, Progressive Insurance, Qatar Petrochemical Company (QAPCO), Quanta Services, and Western Digital Corporation to its client list.

Its competitors include large and small public companies, such as Barracuda Networks, Hewlett-Packard Company, Imperva, IBM, Symantec, and Rapid7 as well as privately held security providers including BeyondTrust Software, Tripwire, NetIQ, Tenable Network Security, and Trustwave.

Qualys’ Acquisitions

Qualys recently announced the acquisition of Virginia-based NetWatcher to beef up its cybersecurity and real-time threat intelligence offerings. NetWatcher offers Security Information and Event Management (SIEM), log management and continuous threat intelligence in an all-in-one solution that looks for anomalous behavior 24×7 and provides businesses with a real-time view of the security posture of assets, including weak passwords, unsafe behavior, and outdated software.

Last year, Qualys completed the purchase of certain assets of Pune-based Nevis Networks for its domain expertise in passive scanning or deep packet inspection technologies. This acquisition allowed the company to expand into the adjacent market of mitigation and response at endpoints, where ForeScout is a leading player.

During the quarter, Qualys announced its plans to acquire another Indian company whose solutions enable enterprises to prevent, detect, and respond to potential malware in both corporate-owned as well as BYOD, iOS, Android and Windows mobile devices. Qualys plans to integrate its well-architected and comprehensive agent technology for mobile platforms into the Qualys platform.

It continues to expand in Pune, India where it has about 58% of its R&D, operations, and customer support employees.

During the earnings call, CEO Phillippe Courtot said that acquisitions will continue to be a part of its strategy as the company seeks to accelerate its product development and expand into adjacent markets. It has also designated $25 million for venture investing in early stage opportunities in related security and compliance technologies.

Questions for the Board

As Europe gets ready to enforce General Data Protection Regulation (GDPR) from May this year, it would be a big driver for Qualys’ solutions. How well prepared is Qualys to tackle this opportunity?

Overall, I am impressed with the strategy and the architecture of the company to tap the unprecedented opportunity in SaaS. It resonates well with what I envision for the industry. Qualys is also making a big bet on India, starting to acquire Indian companies. It has decisively gone from a one-produtct company to a three-product company to now a ten-product company. It’s ambition is to leverage its razor-blade architecture to scale to a 20-product company through internal innovation and acquisitions. If it succeeds, the profitability will be enviable.

So, which companies are on its radar for acquisitions and venture investments, and what is their methodology for corporate innovation?

Its stock is trading at $73.15 with a market cap of $2.7 billion. It has a 52-week low of $33.75 and a 52-week high of $73.8, which it hit after its recent results.