Qualys Q3 2026 Earnings Call Transcript

Qualys (NASDAQ:QLYS) reported third-quarter financial results on Monday. The transcript from the company’s third-quarter earnings call has been provided below.

This transcript is brought to you by Benzinga APIs. For real-time access to our entire catalog, please visit https://www.benzinga.com/apis/ for a consultation.

View the webcast at https://edge.media-server.com/mmc/p/ij95ohfq/

Summary

Qualys reported a strong Q3 2026 with revenues growing 11% to $188 million, driven by increased channel contribution and robust international growth.

The company highlighted significant platform innovations, particularly in AI-driven autonomous remediation capabilities through its AI-native ROC and TruRisk Eliminate with TrueConfidence.

Strategic wins included notable federal contracts, demonstrating the effectiveness of Qualys’ unified, AI-powered risk management approach.

Future guidance projects Q4 revenues between $191 to $193 million, with full-year 2026 revenues expected to grow by 10%.

Management emphasized the shift towards proactive risk management and the critical need for rapid vulnerability detection and remediation in response to AI-accelerated threats.

Full Transcript

OPERATOR (Moderator)

Ladies and gentlemen, thank you for standing by. Welcome to Qualys third quarter 2026 investor call. At this time, all participants are in a listen-only mode. After the speakers’ presentation there will be a question-and-answer session. To ask a question during the session, you would need to press star 11 on your telephone. You will then hear an automated message advising your hand is raised. To withdraw your question, please press star 11 again.

Please be advised that today’s conference is being recorded. I would like now to turn the conference over to Blair King, Investor Relations. Please go ahead.

Blair King (Investor Relations)

Thanks, Michelle, and good afternoon, and welcome to Qualys third quarter 2026 earnings call. Joining me today to discuss our results are Sumedh Thakar, the President and CEO, and Joo Mi Kim, our CFO. Before we get started, I would like to remind you that our remarks today will include forward-looking statements that generally relate to product capabilities, future events, or future financial or operating performance. Actual results may differ materially from these statements. Factors that could cause results to differ materially are set forth in today’s press release and in our filings with the SEC, including our latest Form 10-Q and 10-K. Any forward-looking statements that we make on this call are based on assumptions as of today, and we undertake no obligation to update these statements as a result of new information or future events.

During this call we will present both GAAP and non-GAAP financial measures. A reconciliation of GAAP to non-GAAP measures is included in today’s earnings press release. And as a reminder, the press release, prepared remarks, and investor presentation are all available on the Investor Relations section of our website. So with that, I’d like to now turn the call over to Sumedh.

Sumedh S Thakar (President and CEO)

Thank you, Blair, and welcome to our third quarter earnings call. AI has fundamentally transformed the adversary’s playbook, graduating from accelerating existing ATT&CK techniques to autonomously operating inside live production environments. To put the scale of this shift in perspective, Microsoft’s recent Patch Tuesday disclosed 1,414 new vulnerabilities in a single release compared to 93 before the advent of Frontier AI. That’s a 15-fold increase in exposure volume within the last seven months alone that every enterprise must now absorb in real time.

Within 10 minutes of Microsoft publishing, Agent Insta, powered by InstaScan, posted scanless detections in a customer’s environment, giving them immediate view of their exposure. No scan cycle, no agent disruption, no days-long wait—the detection at AI speed. But detection alone changes nothing if what follows still takes weeks, still relies on manual handoffs, and still can’t prove the exposure is closed. Events like the PHP-to-shell disclosure and others are just a warning of what lies ahead. And the need for speed from disclosure to remediation is clear. Durable pre-breach risk management requires a vendor-neutral, agentic AI risk fabric that can autonomously transform detections into proven remediation of actual exploitable risk at the speed of modern attacks.

Against this backdrop, we delivered another strong quarter of revenue growth and profitability, alongside one of our most meaningful quarters of platform innovation to date. The execution reflects a clear shift in how customers evaluate and select their security platforms. The traditional CTEM model wasn’t built for this moment and it shows—more findings, more theoretical risk scores, more dashboards, and more handoffs, each one a gift of time to an adversary that now operates at machine speed.

When customers can’t patch fast enough to outrun autonomous exploitation, the last thing they need is another tool that tells them what’s wrong and passes the problem to someone else to fix. CISOs are looking to update their boards with their plan of action against autonomous exploitation—with a roadmap of autonomous remediation instead of more manual tools and processes. That architecture was already losing before the Frontier AI era. Today, against an AI-powered adversary, it’s indefensible.

We developed the vision and built the AI-native ROC powered by our ETM solution over three years ago to end that cycle entirely. Today, Agent Insta, powered by InstaScan, is detecting newly exposed vulnerabilities at customer systems in less than 60 minutes of disclosure on an average. Agent Val, powered by TruConfirm, has already performed approximately 9 million exploit validations across customer environments, and still 11% of those confirmed exploitable.

Eliminating 89% of that noise would have been otherwise consuming security and IT resources. And TruRisk Eliminate with Agent Sera has helped customers deploy over 180 million patches in the last 12 months alone, with 60% of those running autonomously, doubling from 30% a year ago, at a rollback rate of fewer than one in 8,000. Together they operate natively in a continuous closed loop that proves autonomous closure within hours, not weeks. The AI-native ROC isn’t a roadmap; it’s not a vision slide. It’s operational, measurable, and provable. And that’s nearly all enterprise and federal customer conversations are centered.

Carrying this momentum forward, we are further evolving our ETM and TruRisk Eliminate capabilities through an expanded ecosystem of remediation solutions. Over the last two quarters we introduced our AI-powered Patch Reliability Score, Agent Sera’s wave-based remediation, peer-to-peer patching, and AI-guided rollbacks. The cumulative effect of our TruRisk Eliminate agenda gives organizations confidence to deploy in production environments with rollback rates below 1/10 of 1% across well over half a billion patches delivered to date, including more than 200 million executed autonomously.

That customer confidence is translating into accelerating adoption, with patch deployments up 47% from the advent of frontier models in early April of this year, and autonomous deployments growing even faster. The biggest blocker to faster patching is lack of confidence in operational outcome. At our recent ROCon conference in Austin, we built on this foundation by announcing what we call autonomous RemOps, brought to life through TruRisk Eliminate 2.0 with TrueConfidence. TrueConfidence is a remediation orchestration intelligence engine delivered on a straightforward operating principle: fix the minimum, credit existing controls, choose the right remediation path, control the rollout, and prove that it helped. Three new capabilities represent meaningful new ground for Qualys.

First, before a corrective action is raised, TrueConfidence assesses the protection already provided by third-party security controls so customers don’t duplicate their efforts. Second, it extends coverage beyond endpoints to cloud applications, perimeter, and Azure assets including routers, switches, firewalls, and air-gapped infrastructure that historically sat outside response workloads because they cannot run an agent. And third, built on the rollback capabilities we introduced last year, post-deployment operational resiliency monitoring through partners like Dynatrace now tracks system health to confirm that the environment remains stable post-patch. When a patch doesn’t hold, AI-powered patch failure analysis explains the root cause in plain English and recommends corrective action. The result is an AI-native ROC that serves as both the system of record and the system of action for cyber risk reduction.

Other vendors entering the mitigation conversation are orchestrating a handoff for agent-based endpoints and passing a patching recommendation to a third-party tool without giving the operational confidence and no verification that the fix was successfully applied or that the environment remains stable afterward. The Qualys platform was purpose-built to eliminate that handoff entirely and delivers natively integrated autonomous RemOps with TrueConfidence at scale, rapidly proving closure across every domain and asset type.

With Qualys, no asset—whether it runs an agent or not—and no exposure—whether a patch exists or not—will be left without an immediate path to closure. Our continuous innovation and industry-leading capabilities are now garnering significant recognition from customers, partners, and independent analysts. In the 2026 Forrester survey for proactive security platforms, Qualys received the highest rating among all evaluated vendors on the key criteria including network visibility, exposure, business-driven prioritization, and remediation. Additionally, KuppingerCole named Qualys the highest-rated leader in the 2026 Leadership Compass for attack surface management, earning the top position in both product and market leadership.

Both underscore our customer-driven engineering and growing competitive differentiation across the platform. Moving to our business update, the number of customers spending 500,000 or more with us grew 15% from a year ago to 243. Let me now share a couple of recent wins which illustrate why organizations are turning to Qualys to help unify their security stacks, operationalizing the ROC, and put autonomous remediation to work. First, we closed a new low seven-figure annual booking deal with a large government agency. This agency had been running on an on-prem vulnerability management program for years, scanning with one vendor, manually triaging across disconnected dashboards, and handing patch cycles off to yet another vendor.

As the detection volume surged, the model was breaking down, response backlogs were growing, and the agency kept falling further behind. Seeking to streamline operations, the agency ran a highly competitive process and selected Qualys to help activate its ROC on a single FedRAMP High-authorized platform. In doing so, it landed with seven Qualys modules right out of the gate including ETM, ETM Identity, VMDR, TruRisk Eliminate, Policy Compliance, TotalCloud, and TotalAppSec.

The net result is that this agency has now consolidated a fragmented multi-vendor workflow into a unified, AI-powered risk fabric. A fabric that detects exposure within minutes of disclosure, validates actual exploitability so teams can act on real risk rather than theoretical scores, and automates response by natively applying patches and other compensating controls when patches are too risky to deploy or unavailable. What used to take weeks from detection to confirmed fix now takes hours, and a patch backlog that has been compounding security debt for years is now under control.

Given the success of this deployment, the customer is now actively evaluating TotalAI and planning to deploy agentic AI workflows across its operations. The second was an existing large federal agency which has struggled to manage its cloud and infrastructure security using siloed tools while manually consolidating findings with no unified view of risk. Prioritization relied on CVSS security scores rather than validated exploitability, and their security and IT teams were making critical decisions on incomplete data. Threat response had historically followed a pattern we hear too often: security operations identified a vulnerability, opened a ticket, and handed it to an IT team running a third-party patching tool, a cycle that averaged weeks from identifying threats to assumed fixed.

With the advent of the CISA BOD 2604, which requires agencies to operationalize risk-based remediation and address AI-accelerated threats that compress exploit timelines to hours, that cycle was no longer sustainable. Our own Threat Research Unit’s five-year analysis of more than 1.5 billion critical vulnerability instances shows that Qualys customers had already remediated approximately 173 million exposures before they were entered in CISA’s KEV catalog, which is exactly the kind of proactive posture this directive now demands.

In response, this customer evaluated several solutions and chose Qualys to operationalize its ROC automation. Where competing solutions aggregated data and continued to generate theoretical risk insights, Qualys was the only platform in the evaluation that could detect at AI speed across hybrid environments, hyper-prioritize millions of findings to exposure that genuinely required immediate action, and autonomously fix them. That translated into bringing third-party sources into the platform while consolidating several siloed tools in a seven-figure annual bookings upsell, adding ETM and TruRisk Eliminate while expanding the existing Qualys footprint.

This customer is now aligning with the agency’s risk tolerance across nine separate bureaus, unifying detection with Agent Insta, exploitability-based prioritization with Agent Val, and recognizing the operational efficiencies and speed of automation—wave-based zero-day remediation with Agent Sera. These wins, alongside several other six- and seven-figure federal and state wins in Q3, underscore the growing demand we see in our federal, state, and local government business, driven in part by agencies moving to meet these new operational requirements. They also reflect a consistent pattern we see across the business as more and more customers move from evaluating the AI-native ROC to operationalizing it. Complementing this momentum, QFlex is emerging as an effective lever for platform adoption and ETM expansion.

In the first full quarter following GA, QFlex customers increased their average annual bookings by over 20% compared to the prior year annual bookings, while many added new modules to their subscription. Both wins I just described were direct examples of QFlex in action. The new federal agency customer consolidated into a QFlex commitment spanning all seven modules from day one, while the existing agency added ETM and TruRisk Eliminate while expanding deployments at a footprint that already included seven Qualys modules.

In both cases, QFlex gave them the flexibility to commit more extensively across the platform while preserving the ability to shift investment as their risk priorities evolve. That’s the commercial pattern QFlex was designed to create. Customers commit at a higher level because the model removes the friction of predicting exactly what modules they might need four months from now, which in turn drives higher utilization across the platform and positions us for larger upsells over time.

Turning to strategic alliances, I’m pleased to announce that we recently delivered several new technology integrations spanning mobile identity, IoT, and OT systems. As more organizations adopt the AI-native ROC as their autonomous risk fabric for breach risk management, the value of that fabric grows with every new source of risk intelligence it can ingest, normalize, prioritize, and act on. These partnerships strengthen our multi-vendor architecture, extend the ROC’s coverage, and serve as a key differentiator for Qualys.

In summary, over three years ago we set out to transform Qualys from a company steeped in vulnerability management, detection, and response to a holistic, vendor-neutral pre-breach risk management platform defined by measurable, proactive, and automated risk reduction at scale. This quarter, with the AI-native ROC operational and gaining customer momentum, TruRisk Eliminate with TrueConfidence extending our reach to every type of asset, a growing federal customer business, strong product roadmap, and early QFlex adoption broadening how customers commit to the platform, we are seeing the clearest evidence yet that organizations are choosing Qualys because we don’t stop at just telling them what is wrong—we prove it’s fixed.

That’s now driving larger commitments, deeper adoption, and stronger competitive differentiation, while reinforcing our confidence in durable long-term growth. With that, I’ll turn the call over to Joo Mi to further discuss our third quarter results and outlook for fourth quarter and full year 2026.

Joo Mi Kim (Chief Financial Officer)

Thanks, Sumedh, and good afternoon. Before I start, I’d like to note that except for revenues, all financial figures are non-GAAP and growth rates are based on comparison to the prior-year period unless stated otherwise. Turning to third quarter results, revenues grew 11% to $188 million. As a result of our strategic emphasis on leveraging our partner ecosystem to drive growth, the channel continued to increase its contribution, making up 55% of total revenues compared to 50% a year ago. Revenues from channel partners grew 24%, offsetting a 2% decline in direct. By geo, 50% growth outside the U.S. was ahead of our domestic business, which grew 7%. U.S. and international revenue mix was 54% and 46%, respectively.

In Q3 our overall net dollar expansion rate remained unchanged from last quarter’s 105%. The net dollar expansion rate of customers with prior-year purchase of ETM or CSAM subscriptions improved to 108%, up from 107% last quarter. Moving on to product mix, ETM and CSAM combined made up 12% of total bookings and 14% of new bookings on an LTM basis in Q3, up from last year’s 10% and 11%, respectively. Next, Patch Management made up 9% of total bookings and 18% of new bookings on an LTM basis in Q3.

This compares to 8% and 16%, respectively, in Q3 of last year. Lastly, TotalCloud made up 5% of total LTM bookings in Q3, unchanged from a year ago. ETM and CSAM combined with Patch Management are driving a meaningful shift in our bookings composition toward higher-value solutions. We expect that trajectory to continue as customers deepen their engagement with the platform. TotalCloud remains an important growth lever for the business. We are focused on improving adoption within our customer base.

Reflecting our scalable and sustainable business model, adjusted EBITDA for the third quarter of 2026 was $89.9 million, representing a 48% margin compared to 49% last year. Operating expenses in Q3 increased by 11% to $72.2 million, driven by investments in sales and marketing, which grew 17%. With this strong performance, EPS for the third quarter of 2026 was $2.12 per diluted share and our free cash flow was $100 million, representing a 53.2% margin compared to 52.7% in the third quarter of last year.

In Q3 we continued to invest the cash we generated from operations back into Qualys, including $1.8 million in capital expenditures and $53.6 million to repurchase 330,000 of our outstanding shares. As of the end of the quarter, we had $176.1 million remaining in our share repurchase program. With that, let us turn to guidance. Starting with revenue, for the full year 2026, we now expect revenues to be in the range of $736.9 to $738.9 million, which represents a growth rate of 10%. This compares to prior guidance of $732 to $738 million. For the fourth quarter of 2026, we expect revenues to be in the range of $191 to $193 million, representing a growth rate of 9% to 10%.

Shifting to profitability guidance, for the full year 2026 we expect a 46% EBITDA margin, a low double-digit increase in operating expenses, and free cash flow margin in the low 40s. We expect full-year EPS to be in the range of $8.07 to $8.14, up from the prior range of $7.74 to $7.88. For the fourth quarter of 2026, we expect EPS to be in the range of $2.05 to $2.12. Our planned capital expenditures in 2026 are expected to be in the range of $9.5 to $11.5 million, and for the fourth quarter of 2026 in the range of $2.3 to $4.3 million.

With that, Sumedh and I would be happy to answer any of your questions.

OPERATOR (Moderator)

Thank you. As a reminder, to ask a question, please press star 11 on your telephone and wait for your name to be announced. To withdraw your question, please press star 11 again. And our first question will come from Jonathan Ho with William Blair. Your line is now open.

Jonathan Ho (Analyst at William Blair)

Hi, good afternoon, and congratulations on another set of strong results. Sumedh, I wanted to start with your comments around getting customers past some of their concerns around automated patch management and shifting that mindset away from the human in the loop towards full remediation. Can you talk a little bit about how that pathway works and ultimately what that can mean from a revenue or net retention standpoint?

Sumedh S Thakar (President and CEO)

Yeah, that’s a great question. And I think nothing reflects better the mood in terms of what people are looking for than the CISA BOD 26-04, which essentially requires within 72-hour remediation of critical vulnerabilities. And so if you look at vulnerability management, the three core components really are, you know, how quickly if you can detect it, then you have to prioritize the ones that need to be fixed, and then you have to actually get it fixed.

And so if you’re talking about three days to do that and your existing approach on scanning is taking anywhere from two to five days to just get the information first, then you are applying manual prioritization on top of that, and then if the remediation is taking you weeks to get that within IT tickets or it’s always an emergency, people are struggling with that. And so what we are hearing in terms of conversations with our customers is really at the end of the day to achieve that 72-hour or 24-hour remediation cycle that people are looking for, everybody has to sort of look at some sort of a role that takes you into fast detection, which we’re doing with InstaScan in less than 60 minutes; quick prioritization with Agent-based validation where you’re able to reduce significantly the number of things that need to be fixed because we are testing existing controls and saying we don’t need to fix it; and then the last piece, which is, as I mentioned in the earnings call, the only reason people don’t patch everything is because they don’t have enough confidence that it will not cause an outage. So with the advent, or with the release, of our Eliminate 2.0 with TruConfidence, what we have done is focused on remediation intelligence to be able to provide customers with AI-powered reliability scores, additional comfort in knowing that certain things, when they are deployed, we can actually tell them if the patch is going to be safe or not, and monitoring with somebody like Dynatrace that if there are any issues.

So the more we are providing in terms of having them see the value of that, they can actually do this in an automated way with the confidence, with something like TruConfidence and the intelligence built in, that’s really the only meaningful direction you can go. Now people are looking to say, how do I go back to my board and give them that roadmap on how we are going to go from 0% automation in remediation when we are fighting AI-based autonomous exploits? How do we put ourselves on a roadmap that over the next couple of years we can actually get to the point where more and more automation can happen in a much quicker period of time? And so if you look at the way we have aligned ETM and Eliminate, that’s sort of how it is, where ETM is helping you either pull data from VMDR or from other third-party scanning solutions and very quickly figure out which of those exposures are exploitable.

And then additionally, if you want to look at getting it remediated as well, then ETM, or rather TruRisk Eliminate 2.0 with TruConfidence, is the additional thing that they can purchase to get to that point. And so that’s really how we’re seeing customer conversations, as they’re looking to say, how do I go back to provide confidence back to my organization that we can actually meet these requirements that are coming up more and more, where you have to remediate within three days or 24 hours, given how many vulnerabilities and exploit paths we’re seeing coming out of these AI models that are being used by attackers.

Jonathan Ho (Analyst at William Blair)

That’s very helpful. You know, just in terms of the pipeline, Jeremy, can you maybe help us understand the sustainability of Qualys’ booking strength? I mean, I think the CCB number was a little bit down from last quarter, but still very healthy here in the mid-teens. How should we be thinking about the shape of the pipeline and maybe the sustainability of that over time? Thank you.

Jeremy

Yeah. If you take a look at our bookings trajectory, what we see in the business today is really a healthy 8% is approximately what we’re expecting for Q4 calculated current billings. And that stems from the fact that if you take a look at our beat in Q3, it was a really strong quarter—another double-digit current billings quarter at 14%, albeit, like you mentioned, slightly down from 16% last quarter. Part of it was due to we had a really strong federal quarter.

I think that the examples that we gave in the script kind of demonstrate our strength. We executed well, and this is something that we hope to continue. But with that said, it can be lumpy. We do have some in the pipeline for Q4, but right now, from a non-federal business perspective, we kind of expect that 8% as a base case for calculated current billings, ending the full year with full-year calculated current billings growth of 11%.

Jonathan Ho (Analyst at William Blair)

Thank you.

OPERATOR (Moderator)

Thank you. And our next question will come from Roger Boyd with UBS. Your line’s open.

Roger Boyd (Analyst at UBS)

Great. Thanks for the questions and congrats on the results. I wanted to double-click on Jonathan’s question. Sumedh, we all hear from CISOs that operational confidence is the biggest barrier to automated patching. I guess how is that product suite resonating with non-security buyers within enterprises, and is that at all changing your selling motion around the product? Are you bringing those non-security buyers into the sales process, and is that at all giving you access to additional budget?

Sumedh S Thakar (President and CEO)

Yeah, very good question. I think what we are seeing right now is, and you know, when we started with patch management a few years ago, sort of the first ones in the industry, we learned a lot from that, and there’s always had been a bit of that pushback from those IT teams because they might be using existing scanning solutions, etc. But we did pretty well over the years convincing those buyers of the value of Qualys and our ability from a cybersecurity patch management perspective.

And what we’re seeing now post the frontier AI model era, we are seeing that IT teams and security teams are actually coming together. We have been on calls where we have more conversations with the CIO teams as well now because they are all looking for some way for solutions that are focused on cybersecurity risk management. And now with True Confidence we do get into conversations with our IT teams to say, well, how are we giving higher confidence that we can separate patches that can be low impact but high value?

How do we help them understand which ones will not cause an outage? How do we help you mitigate instead of patching? So that level of intelligence and information is definitely giving higher confidence to the IT team. So what we do see is CIOs, CISOs are in certain conversations coming to the table. In some cases, right off the bat they are going into autonomous remediation for 20, 30% of the estate. In some cases they are saying let’s start consuming your intelligence first so that our IT teams can still fix things faster by leveraging the intelligence you’re providing, and over time we will move into a model where maybe we start by taking 15, 20, 30% of the stuff we can automate as we build the confidence.

But like I said, the whole point of releasing that True Confidence was it was very clear that the biggest blocker to patching is the lack of confidence it will not cause an outage. And if we can provide AI-powered intelligence to make that decision much smarter and quicker, then we are going to see more and more adoption of this going forward. And so conversations are very much driven by our ability to remediate. And that’s the starting point for many conversations is how can you help me remediate so I can go back to the board and give them a story about how we are going to do autonomous remediation against AI-based autonomous exploitation. And then that leads into conversations around ETM, how ETM can further reduce what you are remediating. And by using ETM and Eliminate together, you are reducing your operational risk while at the same time increasing the speed at which you are able to actually get the things that are important fixed quickly.

So we are pretty excited about the conversations that we are having right now. And like I said, things like subordinate in trying to ask people to remediate things in three days is definitely a driving force to say what’s an architecture that does not have siloed solutions that can really focus on getting that 1% fixed really quickly so I can meet these guidelines.

Joo Mi Kim (Chief Financial Officer)

Yeah, I think that primarily the beat was driven by the federal business. We haven’t seen this type of outperformance when it comes to this vertical. We have been focused on making sure that we’re building this pipe all throughout the year. And we were very pleased to see that the deals that we were working on actually ended up closing in Q3. And so that’s really reflected in the current billings. So if you take a look at our net dollar expansion rate staying the course at 105%, that hasn’t picked up.

And I think it kind of indicates that rest of the growth really came from the new logo acquisition which was primarily federal.

OPERATOR (Moderator)

Thank you. And our next question is going to come from Rudy Kessinger with DA Davidson. Your line’s open.

Rudy Kessinger (Analyst at DA Davidson)

Hey guys. Great. Thanks for taking my questions and congrats on the strong quarter. Look, I think the question on a lot of investors’ minds is really strong current calculated billings growth the last two quarters, 16%, 14%, your guidance only 8% for Q4. I guess should we take the mid-teens growth the last two quarters to be an indication that we might see an acceleration in revenue growth at some point near term, or should we look more towards that trailing 12-month figure that has improved a little bit but been relatively more stable?

I think that’s just what everybody’s asking here. Should we expect acceleration in revenue growth near term or not?

Joo Mi Kim (Chief Financial Officer)

I think it’s more of the latter based on what we were able to deliver to do with post missiles. A lot of the discussions that we were having with a small cohort of customers that we have in place. And then in Q3, the primary beat was from the federal, albeit we would love that to continue or continue to work on that, but it could be lumpy. And so from our perspective, the base case remains, of course, where we don’t see a significant change in the net dollar expansion rate, which is our key KPI.

So that 105% is healthy. It stayed the same from Q2. Right now we don’t see that materially changing. We are hoping that we continue to outperform the new logo acquisition, but this is based on the pipeline that we see for Q4 and kind of staying the course in terms of no material change in the sales cycle. So close, what we see right now is ending the year strong with current billings closing the year at 11% for the full year and then the revenue closing the year at 10%.

Rudy Kessinger (Analyst at DA Davidson)

Okay, super helpful. And then secondly, just could you talk about the competitive environment and just who you’re seeing there and how things have maybe changed versus a couple quarters ago or maybe even a year ago? Are you seeing more of the larger platforms in there that post mythos have really amped up how much they’re talking about patching and vulnerability scanning, things of that nature.

Sumedh S Thakar (President and CEO)

We have been talking about vulnerability management evolving for a few years now before this whole thing came about. And that’s why we started really focusing on patch management and remediation capabilities. And today we present a very compelling case for somebody who wants to actually do remediation in their production environment. With the half a billion patches deployed so far, with extremely low rollback rates, we have established ourselves as not just the vendor that is detecting tons and tons of new vulnerabilities, which as you saw with the patches, they’re going to get more and more findings.

So what we are seeing is the vulnerability management is evolving where it’s about not just about finding and detecting CVEs because it’s just unmanageable at this point, the number of CVEs being detected. It’s really about being able to do validation of those exploits like a hacker and then actually running into remediation and doing remediation with high confidence at a much faster speed. And so that’s where for us, even if a customer has some other detection capability for CVEs, with ETM what we are seeing is those customers, when they come and build a rock and they work with Qualys, they are pulling either using Qualys for fast detection or they’re pulling data from maybe some other solution they might have and leveraging the Qualys ETM license to then figure out if that thing is exploitable and then the Eliminate license to then go and run remediation so that they can actually get rid of that particular exposure in the three minutes or in the three days as said.

So I think for us we see that continuing—more conversation, less conversations about how many CVEs are you detecting; more about are you able to detect them fast than competing solutions which are taking two to three days for scanning. And then the last piece is, well, ultimately how can I build an automated workflow? The issue is that if you have a separate scanning solution, a separate prioritization capability and a separate remediation capability, that makes it a lot harder to really get to that three-day remediation or 24-hour remediation that people are looking for.

So the conversations are less about can somebody detect more CVEs. Really our conversations we’re seeing are more about how do you help me build a story that I can take back to the board that shows a roadmap for autonomous remediation as a response to autonomous exploitation.

OPERATOR (Moderator)

Thank you. And our next question will come from Brian Essick with JP Morgan. Your line’s open.

Brian Essick (Analyst at JP Morgan)

Hi, good afternoon. Thank you for taking the question. I’ll echo my congrats on a second quarter of pretty healthy billings growth. I guess, you know, Sumedh, a couple things stand out more from a trend perspective that I wanted to ask you about. One is, you know, the really nice growth in international business sustainably in the mid-teens, particularly when you compare it to domestic, which kind of had the tailwind of Fed as you noted this quarter, and then also the partner contributions also seem to be ramping nicely.

Is there a correlation between those two and how do we think about each of those in terms of your ability to win new logos outside of the Fed business, which I noted you had a strong new logo traction with this quarter. Thank you.

Sumedh S Thakar (President and CEO)

Yeah, that’s a great question. And we have been doubling down on working with our partners over the last few years and so we’re pretty, pretty happy with the way that contribution from partners has increased over time while maintaining our margins as well. So we do continue to see that as a way that we are going to see long-term impact. I think what we are also, our non-U.S. business always tends to be more partner-driven of course, but in general I think what we are seeing is that right now, and typically we don’t see that knee-jerk reaction from our customers for larger customers, enterprise customers.

Everybody’s sort of going through a cycle right now of this is a fundamental shift in the way vulnerability management has been done in the past. And to be able to do the exploit validation that’s now specifically required in the Sysbot as an example, or to do autonomous remediation, structurally they have to figure out within their organizations how they can bring IT teams along, what kind of changes they need to make in terms of the team, the structure, the processes, etc. So a lot of the conversations that people are engaged in right now with us are about how do we continue over the next few quarters and next few years on changing out how vulnerability management is done. And our partners are a key part of that. So they are turning to the trusted partners to say help me go back with a plan for autonomous remediation, and we are continuing to work with those partners.

So for us we do see that the more and more we work with our partners and you see the MROC partners program as well, our partners will be working with these customers to help them plan out their autonomous remediation capabilities and Qualys obviously is going to be a key part of that. So we do see this more as a continued long-term area of investment and we’re excited about building out these capabilities with our partners.

Brian Essick (Analyst at JP Morgan)

Got it. Is there anything to infer about the profile of the international customers and what might make them a little bit more, I guess, you know, ripe for accelerating, you know, better growth than domestically or, you know, how do we, how do we think about what you’re seeing in one geo versus, you know, United States?

Joo Mi Kim (Chief Financial Officer)

Nothing really, you know, to call out that’s different from what we have seen in the past.

Brian Essick (Analyst at JP Morgan)

Got it, got it. Thank you very much. I appreciate it.

OPERATOR (Moderator)

Thank you. And our next question will come from Joseph Gallo with Jefferies. Your line’s open.

Grant Darling (Analyst at Jefferies)

Hi, this is Grant Darling on for Joe Gallo. Thanks for taking the questions. You know, I wanted to start. The billings beat was really strong. Revenue beat a little bit narrower than usual just to start. Anything to call out with large deals or linearity and maybe how we should think about that going forward.

Joo Mi Kim (Chief Financial Officer)

Yeah, current billings tends to be not exactly a great proxy when you’re looking at how to recognize revenue ratably. But to call out the Q3 revenue, the linearity was worse than what we typically see in the quarter. So that did impact revenue that came in slightly lower at 10.7% versus the 11% growth rate in Q2.

Grant Darling (Analyst at Jefferies)

Got it. And then maybe just to unpack the expectations around, you know, that 8% billings in 4Q. As we’re hearing about PHP pipeline opportunity patching, you know, is there something from a renewal base size? Is there anything in 4Q that’s maybe making you more optimistic on the 2027 trajectory versus 4Q?

Sumedh S Thakar (President and CEO)

I would say, like I said in what I mentioned earlier, we do see customers engage when these kind of things happen. But even in the past when Log4J and stuff came, we don’t see that knee-jerk reaction immediately that’s like immediate in the quarter. Of course, those cohort of customers that are up for renewal that already are having conversations about ETM and Eliminate in that quarter, those conversations can be more fruitful at times. But overall, when you look at the customer base and the opportunity that we have, we see this as a continued conversation with these customers who are very engaged with us to figure out what’s the right way for them to make the changes internally within their teams, their processes, to be able to roll out and give their management a confidence in a new way of doing vulnerability management that is truly AI-driven and is able to do autonomous remediation with the confidence of not having operational outages.

And so those conversations are going to continue. We’re seeing good pipeline of conversations happening there and we’re excited to see how and when these conversations will end up closing once these guys are able to go back and make the changes and put the proposals in front of their management. That’s going to take some time. So I think right now we’re focusing on those conversations rather than some sort of a knee-jerk reaction immediately happening this quarter.

Grant Darling (Analyst at Jefferies)

Great, thank you.

OPERATOR (Moderator)

Thank you. And the next question will come from Mike Cikos with Needham. Your line’s open.

Mike Cikos (Analyst at Needham)

Hey, great. Thanks for taking the questions here, guys. I just wanted to come back to the QFlex customers that were adopting. The average annual bookings increase of over 20% versus prior year was an impressive statistic. I know it’s early here, but was that 20% plus similar to what you guys had seen in the prior quarter or is the prior quarter just too small to even start comparing and contrasting? I’d just love to get a sense of how that 20% plus tracked versus precedent as well as how we’re looking here in Q4.

Thank you.

Sumedh S Thakar (President and CEO)

Yeah, it was really too small. So we just went GA with QFlex last quarter. So what we wanted to do is just give you an indication, an anecdotal example of us. Even though it was a small quarter of customer that started with QFlex last year, to give you a sense of what we’re kind of expecting going forward. This is in line with our expectation, as in if you purchase QFlex, what it’ll enable our customers to do is try out other products, which makes it much easier when it comes to the annual renewal.

When they come, they’ll be able to convince themselves or just better justify the increase in spend with Qualys. So it was a great kind of a testament or validation of the whole point of QFlex, why it could be a win-win for both parties.

Mike Cikos (Analyst at Needham)

Terrific. I’ll keep it to one. Thank you so much.

OPERATOR (Moderator)

Thank you. And our next question will come from Meta Marshall with Morgan Stanley. Your line’s open.

Meta Marshall (Analyst at Morgan Stanley)

Great, thanks. As you’ve expanded the budget or the audience of budgets and interested buyers and that brings much more resiliency audience, has that changed kind of what partner channel you think will be the most successful or the ones that you’re making investments in?

Sumedh S Thakar (President and CEO)

I’m not sure I understood the question, it was hard to hear you. Sorry,

Meta Marshall (Analyst at Morgan Stanley)

Sorry. As we were kind of focused on more getting more CIOs and kind of resiliency budgets involved, is that changing kind of the overall what channel partners these are going to be most successful, the ones that you’re making more?

Sumedh S Thakar (President and CEO)

Yeah, that’s a good question. I mean, I think we are seeing more conversations that are with our managed service partners, our partners, because the CISOs are looking at less about like, you know, how can I more efficiently buy this particular tool? And more about guidance on how they can have a risk-based conversation with their boards and management. And so when those kind of conversations come up, we tend to see our large MSSP partners, our MROC partners that are, you know, authorized MROC partners are the ones that work with us closely because they’re able to go in and have conversations more around business risk rather than, you know, just because the number of CVEs and patches, they went up 15 times, doesn’t mean that the budget’s going to go 15 times, right.

So how are you going to work with that particular customer to be able to work with them and put a plan in place that allows them to find the right investment, optimize across the platform and have a risk-based conversation with the board? So I don’t know that it’s really changing the partner conversation, but it does end up becoming more strategic when it’s the conversations with the MSSP partners and the Amarok partners.

Meta Marshall (Analyst at Morgan Stanley)

Great, thanks. So helpful.

OPERATOR (Moderator)

Thank you. And our next question will come from Joshua Tilton with Wolfe Research. Your line’s open.

Joshua Tilton (Analyst at Wolfe Research)

Hey guys, thanks for taking my questions. Can you, can you hear me? Awesome. I just have two kind of clarification questions. My first one is I think a lot of us on the call are seeing two really solid quarters of current billings growth and there are a million different things I would call it in the cyber narrative that we can all want to and try to and hope to point that those, you know, two quarters of billings growth are coming from, whether it’s mythos or AI or whatever other awesome narrative that you want to point to today.

But it sounds like on the call you’re trying to tell us that these two quarters kind of seem to be pretty unrelated. Last quarter the outperformance was driven by just some outsized mythos spending. And this quarter it seems to be driven by a good Fed, a good Fed vertical quarter. I’m trying to just understand like, is that how we’re supposed to interpret it? And if that’s the case, like, you know, I guess, how do you, I guess how do you view your 8% base case for Q4 versus the last two quarters.

And you kind of also pointed that to us, to that same base case. And there now outperformed. Are there just less, you know, opportunities for outperformance in Q4 versus the last two quarters? Because we don’t have the Fed quarter closing and that mythos spending is behind us. Does that make sense?

Joo Mi Kim (Chief Financial Officer)

Yes. So the reason why we called out the primary drivers of the outperformance or the beat that we hadn’t necessarily expected was so that you understand how our business is performing. So I would say right now the base case is 8%. Not to say that these outperformance will not continue going forward. It could be due to different reasons. But like, for example, Q4, what we see in the pipeline is 8% based on this historical close rate, historical sales cycles.

But it could very well be the case that we have another strong federal quarter, right, which could explain the beat. So there is a scenario where you have the base case of 8%. There’s room for outperformance. But with that said, we’re not assuming that as a base case today. So what we talked about post nisos is at that point in time we had a small cohort of customers that we were talking to already about upgrading to ETM and purchasing patch management, Eliminate at that point in time and then they ended up executing. And since then of course we have other customers that we have continued to have discussions around and those set of customers could easily close in Q4 as well. So the reason why we called it out is so that you understand kind of what we expected.

And then the potential upside was greater in 2026 and I think it will be greater in Q4 based on the conversations that we have and the size of deals that we’re seeing today.

Joshua Tilton (Analyst at Wolfe Research)

Okay, super helpful. And then maybe just one other point of clarification is you did say that that linearity was a little worse this quarter, which is what drove the lighter revenue beat. I think those mechanics totally make sense. Can you just help us understand, like at least from your perspective, why was linearity worse? Like what, what do you have? Is there a reason as to why linearity came in below expectation?

Joo Mi Kim (Chief Financial Officer)

Yeah, it really has to do with the timing of the deals closing. So for example, Q3 was a strong new logo acquisition quarter and it ended near the end of the quarter. So it impacted the revenue recognition. So it really depends on the percentage of the deals coming from new as well as upsell versus the renewal and the timing of that close and how much we’re able to recognize in the quarter. That could have like couple hundred thousand impact on the revenue.

Joshua Tilton (Analyst at Wolfe Research)

Okay, super helpful. Thanks guys.

OPERATOR (Moderator)

Thank you. And our next question will come from Srinik Kothari with Baird. Your line’s open.

Zach Schneider (Analyst at Baird)

Hey guys, this is Zach Schneider. I’m from Schroding. Thanks for taking our question. So maybe to follow up to that last one, actually, you know, previously you talked about how the change you were seeing with customers was starting with a larger deployment and not materially shorter sales cycles. Curious to hear in Q3 if that remained the pattern or if you’re now seeing evaluations convert faster or purchases happen outside normal renewal windows.

Thank you.

Sumedh S Thakar (President and CEO)

Yeah, from a business closed sales cycle perspective, we don’t really see a material change or an improvement. That’s part of the reason why our base case in terms of what we’re expecting for the growth rate remains the same. From a sales productivity perspective, win rate, from all those traditional metrics perspective, it remains the course, as in we don’t see significant changes one way or the other. What we are seeing is some of the larger deals that we don’t necessarily are able to predict exactly when the deals will close are closing at different periods of time.

So for example, in Q3 with a really strong quarter, we had anticipated all these deals in the federal space to close in Q3. Some of them could have easily slipped into Q4, especially because they’re new logo acquisitions. But they ended up closing in Q3, which was great for us.

Zach Schneider (Analyst at Baird)

Got it. That’s great. And then maybe among customers that renewed the core subscription while continuing to evaluate ETM or TruRisk Eliminate, are the incremental purchases, or some of those at least, now closing and are they landing at the scope that you guys originally expected?

Sumedh S Thakar (President and CEO)

I think the conversations continue to be strong. I think we’re excited about what we are hearing from them around elimination and deploying that. Like we talked a few times earlier, it just really depends a little bit on how internally their organizations are able to move to make it happen quicker, or maybe taking a little bit more time, because they would have to sometimes bring along their dev team, sometimes they have to bring along their IT team so that when it comes to the eliminate capabilities, etc., that becomes a little bit of a thing where it might take a little bit longer.

At times it might move a little bit quicker. So some of that really impacts on, yes, do they have the runway now to make it part of the renewal itself, or they want to add a little bit, but then they want to add more once they get the broader teams onboarded. That timing sometimes can be really figured out by their IT team. I mean, one of the federal examples we gave was a new logo for us, but they didn’t have Qualys and they deployed Qualys. Within less than six weeks, they already had tens of thousands of agents deployed with no issues. And the CISO went in through the platform and said, hey, what’s this button do? And he said he could see a patch-all button. So he worked with his IT team to press the button and they have 300,000 patches deployed within, you know, going from no Qualys at all to within six weeks having deployed 300,000 patches with zero outages.

Right. So in their case, they were able to bring along the IT team and move fast. In some cases it takes a little bit longer. So it just depends a little bit on how they’re internally able to make—it’s not just adding the license of the same capabilities. So that’s where we are also working with these customers, where some of those deals might close a little bit sooner, some of them might take a little bit longer as they go through work with their internal teams to get this to happen.

OPERATOR (Moderator)

Thank you. And our next question is going to come from Luke Morrison with Canaccord. Your line’s open.

Luke Morrison (Analyst at Canaccord Genuity)

Hey guys, thanks for taking the question here. So, you know, we’ve had several high-profile AI-discovered vulnerability events this year. Most recently, obviously, PHP to Shell in October. Maybe just stepping back from any one of those incidents, what does an event like that do to your buying cycles and pipeline? Does it have a tendency to maybe pull decisions forward?

Sumedh S Thakar (President and CEO)

Yeah. So we’ve been consistent about this even all the way back to when SolarWinds and, you know, Log4j happened. What we see with our customer base is not a typical knee-jerk reaction where, you know, they’re just somehow suddenly buying in the same quarter just to show that they’re doing something. A lot of our conversations with customers tend to be, you know, when you take a step back, what are these celebrity vulnerabilities, as we like to call them, indicating.

And by the way, on the same day as PHP tutorial, there was a Node 4J vulnerability that was also pretty critical. But now when you have overlapping vulnerabilities like that, people don’t even know how to track so many of these coming out. So like I said, the conversations with our customers are less sort of knee-jerk, what can I do immediately, but more about the fact that overall approach towards vulnerability management cannot continue the way it has been, where it takes a week to scan, another week to import the data into a C10 solution which then gives you a dashboard, and then that dashboard is then reviewed by the IT team and then tickets are created and things are fixed in like three weeks or four weeks.

That has to fundamentally change across processes, across tools, across different teams. And so what we see is a pretty good increase in the number of conversations on how to do it when it comes to that. But that doesn’t necessarily mean immediately that, you know, this quarter or something that we’re going to see them buy just a bunch of things. I think it again goes back and depends on their ability a little bit to go and make that happen politically also within their own environment. And those who are able to bring their IT teams to the table quicker, we see them move faster. And others are still working through to say that they will need to work on making sure they get the right alignment, because this is not just the security and get—buy one tool and it’s going to be done, right?

There’s going to be a change in process. How do we go from one-week detection to 60-minute detection? How do we go from theoretical validation to actually running the exploits ourselves, and not having those exploits go crazy on us? And then how do we actually do some form of autonomous remediation? So a lot of these are less about just buying more of the tool and more about fundamental change. But the encouraging thing for us is those conversations about changes and how they’re going to do vulnerability management, exposure management moving forward, are happening. And so that excites us that over the next few quarters and years we are excited to see how that’s going to build up into our business.

Luke Morrison (Analyst at Canaccord Genuity)

Yeah, makes sense. And maybe just for my follow-up, if I look back over the last call it decade plus, I would think most incremental security budget has gone to detection and response, with response obviously being after an incident occurs. If I think about this new paradigm, you know, as AI shortens the time from disclosure to exploit, do you see budgets actually moving from that reactive s