Next Wave Portfolio Update—Qualys Added/Gigamon Removed
I am removing Gigamon (GIMO) from the Next Wave Portfolio and locking in the profit on that position because the risk/reward balance for the stock at these levels is no longer favorable. Since being added to the Next Wave Portfolio in March 2015, Gigamon shares have gained 49%.
Gigamon should be able to deliver a solid second quarter because the company is going up against an easy comparable from last year. But I am concerned the company may face increased competition down the road now that NetScout Systems (NTCT) beefed up its packet monitoring capabilities with the recently completed purchase of Danaher’s VSS Monitoring unit.
Qualys (QLYS), a leading provider of cloud-based enterprise security solutions, is added to the Next Wave Portfolio based on the company’s ability to drive accelerated revenue growth over the longer term thanks to a broadening product portfolio and an expanded sales channel. Revenue growth over the next two years is expected to average 24%.
The company has more than 8,000 customers (1,000+ were added last year), including eight of the top 10 banks, 60% of the Fortune 50 and 23% of the Global 2000. The renewal rate on enterprise accounts tops 95%, while the renewal rate for small and midsize customers is 85%+.
Qualys generates 79% of its revenue from its Vulnerability Management offering, which helps customers identify IT assets that are out of compliance or misconfigured, making them most susceptible to an attack. Instead of sitting around and waiting to be attacked, organizations now realize they need to be more proactive about security, using newer techniques (including vulnerability assessment) in combination with passive protection offerings.
The company’s Vulnerability Management solution makes things easy for customers by fully automating network auditing and vulnerability assessment throughout an organization—covering everything from network discovery and mapping to asset management and remediation tracking. Vulnerabilities are quickly found and fixed before hackers have the ability to mount an attack.
Last year, Qualys introduced Continuous Monitoring (CM), a cloud service that identifies threats and monitors expected changes across networks in real time in order to reduce the risk of breaches. With Continuous Monitoring, Qualys stands out from competing solutions that are focused mainly on periodic scanning, which offers less protection. Customers can control Vulnerability Management and Continuous Monitoring from the same console, setting up automated, targeted alerts for systems around the world.
The total addressable market for vulnerability management is estimated to be around $650 million and growing about 10% annually, according to research firm IDC. Qualys holds the #1 spot, with an 18% market share. The company has been taking share from the two largest competitors—the McAfee division of Intel (INTC) and the Internet Security Systems (ISS) unit of IBM (IBM). One interesting note: IBM in 2006 paid $1.3 billion for ISS only to basically end-of-life the unit’s security solutions in 2010 by merging them into the Tivoli brand. Qualys has been steadily winning accounts from the shelved IBM unit, including many that had been among the largest customers of ISS.
With vulnerability management now considered a core enterprise security functionality, demand is expected to remain solid over the coming years. Given that Qualys offers the newest technology in this segment and delivers its solutions most efficiently through the cloud, the company should be able to continue to gain share against legacy vendors.
On its platform, Qualys also offers solutions for policy compliance and Web application scanning (WAS). These smaller offerings are each growing more than 50% annually, with policy compliance (covering internal controls and external regulations) mainly a cross-selling opportunity and WAS (covering vulnerabilities on the application side, including malware) a new-business opportunity (10% to 15% of new customers are coming aboard via this solution).
Qualys offers a Web application firewall (WAF) to complement its WAS solution. Working in conjunction with the WAS, the WAF enables “virtual patching” to help reduce risks of a breach while code is being fixed. Used together, these two solutions help reduce the number of false positives, a common problem in the security segment. Qualys will soon release an analytics product (focused on log data) to go along with the WAS solution. In addition, a malware protection service is set to be introduced this summer.
Recently trading around $36.75, Qualys shares are down from their all-time high of $55.47 reached in early May because the company in the first quarter stumbled a bit with sales execution, delivering revenue of $37.5 million, below the consensus estimate of $38 million. For the June quarter, Qualys offered revenue guidance of $39.5 million to $40.5 million, below the consensus estimate at the time of $40.7 million.
When it comes to the near-term growth outlook, it appears Qualys management is being cautious because the number of sales force hires and level of channel expansion hasn’t been as great as expected. Looking ahead, the company plans to continue to build out its enterprise sales team, hire a VP of worldwide sales (the CEO currently runs the sales side), increase channel development (partners today account for just 40% of revenue) and expand its presence across the U.S. federal vertical, which currently accounts for just 1% of sales.
For 2015, Qualys expects revenue of $165 million to $166.5 million. The consensus estimate of $165.7 million represents growth of 24.1%. For 2016, the consensus estimate of $206 million indicates growth of 24.3%. At a recent market cap of $1.26 billion, Qualys trades at 7.6 times the 2015 consensus revenue estimate (down sharply from the forward multiple of 11.2 at the stock’s all-time high) and 6.1 times the 2016 consensus. The company is profitable, with earnings per share this year expected to grow 15% to 53 cents. My price target of $49.35 is generated by applying a forward multiple of 8 to a 2016 revenue estimate of $210 million.