Qualys Reports Federal Demand for Automated Vulnerability Remediation

Qualys reported Q3 2026 revenue of $188 million, a 10.7% increase year over year, and said federal demand and adoption of automated, AI-enabled vulnerability remediation contributed to its performance. Revenue exceeded the cited analyst consensus of $186.6 million. Adjusted earnings were $2.12 per share, compared with the cited consensus of $1.96, while adjusted EBITDA was $89.93 million, representing a 47.8% margin. These are company financial results—not evidence of a government award or a disclosed contract value.

The procurement relevance is the operational pressure on federal agencies to identify and remediate vulnerabilities quickly. CISA Binding Operational Directive 26-04 sets a 72-hour remediation requirement, a timeline that may lead agencies to evaluate tools that support faster remediation, workflow automation, and assurance that actions have been completed. The source does not provide additional details about the directive’s scope or implementation, so agencies and vendors should assess the actual requirements and applicable agency guidance rather than infer a broader mandate from the company’s results.

Qualys management attributed growth to robust U.S. federal demand and increasing adoption of its AI-native risk management platform. CEO Sumedh Thakar connected the need for speed to emerging cyber threats, saying, “Events like the PHP2Shell disclosure are a warning of what lies ahead, and the need for speed from disclosure to remediation is clear.” The source also describes Qualys offerings including Autonomous RemOps and TruRisk Eliminate, which the company says can help customers meet tighter remediation timelines. The source reports that federal, state, and local demand contributed to growth, including large agencies consolidating security workflows; it does not name those agencies or identify associated procurements.

For federal procurement teams, the signal is best treated as market context for capability assessment rather than a near-term buying notice. Agencies can compare automated remediation tools against the 72-hour requirement, existing security and IT workflows, operational assurance needs, and integration considerations. Contractors providing vulnerability management or remediation capabilities may view the reported demand as an indicator of potential customer interest, while recognizing that Qualys’s results do not establish an agency requirement, acquisition schedule, or competitive opportunity. The source also cautions that federal momentum and billings can be uneven, and identifies agency implementation and timing of large deals as factors to monitor.

• Qualys Q3 2026 revenue: $188 million, up 10.7% year over year and above the cited $186.6 million analyst consensus.
• Adjusted EPS: $2.12 per share; management raised full-year adjusted EPS guidance to $8.11 at the midpoint, a 3.8% increase.
• Q4 revenue guidance: $192 million at the midpoint, described in the source as roughly in line with expectations.
• Billings: $212.1 million at quarter end, up 15.6% year over year; management cautioned that billings growth may be uneven.
• CISA BOD 26-04: The stated 72-hour remediation requirement may make rapid-remediation capabilities relevant to agency assessments.
• Company-described offerings: Autonomous RemOps and TruRisk Eliminate are identified as supporting automated remediation and risk management.
• Agency assessment: Evaluate remediation speed, integration with existing IT and security workflows, and operational evidence that remediation has been completed.
• Market monitoring: Track agency implementation and the timing of large deals; the source supplies no procurement deadline beyond the stated remediation requirement.
• Opportunity qualification: No specific solicitation, award, contract value, procurement contact, or named buying agency is identified.