Early this month, Qualys (Nasdaq: QLYS), a pioneer and leading provider of cloud-based security and compliance solutions, reported a strong quarter that blew past market expectations.

Qualys’ Financials

In the recent first-quarter results, Qualys reported revenue of $64.9 million, up 22%. GAAP net income was $9.1 million, or $0.22 per diluted share, compared to $21.9 million, or $0.56 per diluted share a year ago. Non-GAAP net income was $15 million, or $0.36 per diluted share. Analysts expected earnings of $0.33 per share on revenue of $63.86 million.

Adjusted EBITDA was $24.6 million, which translates to a 38% margin as compared to 32% a year ago. This is one of the highest margins in Security and SaaS industry that includes rivals Veeva, Paycom, Medidata, CyberArk, and Sailpoint.

During the quarter, the percentage of enterprise customers with three or more Qualys solutions rose to 34%, up from 27% a year ago. The percentage of enterprise customers with four or more Qualys solutions rose to 16% this quarter, up from 9% a year ago. The average deal size continued to increase in Q1 growing 17% year-over-year.

The company saw good growth from new products including Cloud Agent and ThreatPROTECT. New products released since 2015 contributed approximately 15% of total bookings in the quarter, up from 8% in Q1 2017.

For the second quarter, Qualys expects revenue in the range of $66.8 million to $67.3 million, representing 21% to 22% growth. It expects GAAP net income per diluted share in the range of $0.11 to $0.13 and non-GAAP net income per diluted share in the range of $0.33 to $0.35.

The company now expects revenues for the full year 2018 to be in the range of $276.8 million to $278.5 million, or 20% to 21% growth, up from the previous guidance range of $275.5 million to $278.5 million. GAAP net income per diluted share is now expected to be in the range of $0.74 to $0.79, up from the previous guidance range of $0.71 to $0.76. Non-GAAP net income per diluted share is expected to be in the range of $1.43 to $1.48, up from the previous guidance range of $1.39 to $1.44.

Qualys’ Offerings

At the RSA conference 2018, Qualys showcased CertView and CloudView, two new free services to help organizations gain visibility of their digital certificates via CertView, and track and monitor public cloud assets and resources via CloudView.

Qualys recently announced the integration of its platform with Illumio to deliver the industry’s first vulnerability-based microsegmentation and with the Cloud Security Command Center (Cloud SCC) for Google Cloud Platform (GCP).

For its Web Application Security app, the company released out-of-the-box Jenkins integration, Swagger support, and new Chrome Browser Recorder extension, enabling further automation and streamlining REST APIs for the DevOps teams.

Qualys also demonstrated its forthcoming passive scanning technology that delivers near real-time network profiling and monitoring for continuous asset discovery of all devices that appear on the network, including mobile and IoT devices. The passive scanner monitors network traffic in a non-intrusive manner to discover and fingerprint devices to determine topology, services, and network threats.

Apart from these, the company has four apps in beta for the second half of 2018. These include Cross-platform unified Patch Management, Secure Access Control, Certificate Management, and Cloud Security Management.

Qualys’ Acquisitions

In April, Qualys announced its acquisition of Enterprise Mobility Management (EMM) SaaS platform 1Mobility for an undisclosed sum. 1Mobility was founded in 2011 by Smita Yedekar and Rohit Jain. It was incorporated in 2014 with its headquarters in Singapore. 1Mobility subsequently set up a Development Center in Pune, India.

The acquisition enables Qualys to provide enterprises, discovery, inventory, security, compliance, and response on both enterprise-owned as well as employee-owned endpoints. 1Mobility assets will be integrated into Qualys cloud services and will be made commercially available in 2019.

Questions for the Board

Overall, I am impressed with the strategy and the architecture of the company to tap the unprecedented opportunity in SaaS. Last quarter, CEO Phillippe Courtot said that acquisitions will continue to be a part of its strategy as the company seeks to accelerate its product development and expand into adjacent markets. It also designated $25 million for venture investing in early stage opportunities in related security and compliance technologies.

So, what are the adjacent markets it is exploring? Which companies are on its radar for acquisitions and venture investments? What is their methodology for corporate innovation?

Qualys went public in June 2012 at a list price of $12. It ended up raising $90.9 million at a valuation of $451.5 million. Since then, it has steadily improved its profitability and the market has rewarded its performance. Its stock is trading at $77.3 with a market cap of $3.02 billion. It has a 52-week low of $39.25 and a 52-week high of $85.

Qualys has been around for a long time and was one of the first cloud companies. It was founded in 1999. However, it took them a long time to find their stride. It would be interesting to see if they can keep up the momentum and continue to deliver 20% growth with improving profitability.

There is also the option of a larger Security company acquiring them. For example, Fortinet is a larger Security company that comes more from the hardware side. It would need a software strategy, and may consider Qualys a good acquisition.