According to a Research and Markets report, the global security and vulnerability management market is expected to grow 9.3% over the next few years to $13.7 billion by 2026. Earlier this week, cloud-based security player Qualys (Nasdaq: QLYS) reported its upbeat fourth-quarter results. Qualys also recently announced the acquisition of a 1Mby1M company, Adya.

Qualys’s Financials

Qualys saw its fourth-quarter revenues grow 18% over the year to $74.2 million, in line with the market’s estimates. Earnings of $14.4 million for the quarter were significantly better than the previous year’s $2.9 million. Adjusted earnings of $0.51 were significantly ahead of the market’s expected $0.40 for the quarter.

Qualys ended the year with revenues growing 21% to $278.9 million. It reported earnings of $57.3 million, or $1.37 a share.

For the current quarter, Qualys is expecting revenues of $74.5-$75.2 million and adjusted earnings of $0.41-$0.43 a share. The market was looking for revenues of $77 million with an EPS of $0.42. Qualys expects to end the current fiscal with revenues of $320-$323 million and an EPS of $1.84-$1.89. The Street had forecast revenues of $330.17 million with an EPS of $1.85 for the year.

Despite the upbeat performance, analysts are worried about Qualys’s outlook as topline growth appears to be slowing down. Even at the higher end of its outlook, Qualys is looking for a 15% growth next year, compared with the 21% growth it delivered in the previous year. Qualys has been adding products and expects to release several new ones this year as well such as Patch Management and Secure Access Control. But these products are not growing fast enough to counter the slowing growth of its core vulnerability management offering. Analysts expect Qualys to invest more in its sales and marketing efforts to drive additional business.

Qualys’s Acquisition

Meanwhile, Qualys has been steadily building its portfolio with acquisitions. Recently, it announced the acquisition of the software assets of Adya, Inc. Adya is a SaaS data security platform that helps enterprises manage and secure their SaaS apps. It enables Google’s G Suite admins to get visibility into what data has been exposed, what third-party apps have been installed along with their degree of risk, which external users have access to internal data, and which internal users have been exposing data. Besides identifying security risks, Adya’s tools help manage these threats as well.

Adya was founded when its co-founder Deepak Balakrishna realized that while cloud-based applications like G Suite and Office 365 make it easier for employees to collaborate, they also make it easy for sensitive data to be exposed by malicious employees or by employees whose credentials have been compromised.

Adya was bootstrapped initially with the founders investing nearly $80,000 into the company. Later, they secured an angel funding round of $220,000. Adya’s revenue details are not disclosed, but the company has been shipping its product. Qualys plans to leverage Adya’s capabilities to provide companies of all sizes with the ability to consolidate the administration of their SaaS applications into one console, manage license costs across SaaS applications, enforce security policies in one place, and report and audit on all activity with a single tool. Terms of the acquisition were not disclosed.

This is not the first time that Qualys has gone for smaller, capital efficient start-ups to build its portfolio. Last year, Qualys made two other such acquisitions. In October, it had announced the acquisition of the Container-Native security player Layered Insight for an undisclosed sum. Layered Insight’s solutions provided visibility into applications running inside containers, thus enabling organizations to set policies, automate enforcement, and detect breaches during runtime. Qualys planned to integrate its technologies in its solution to offer its customers coverage of inventory, vulnerability management, and compliance. Layered Insight hasn’t disclosed its financial details, but the company had over 24 customers as of early last year.

Earlier last year, Qualys had announced the acquisition of Second Front Systems, cybersecurity and advanced intelligence analytics solution provider that focused on the government sector. Second Front Systems worked with government agencies to address specific national security needs and build state-of the-art cybersecurity solutions for federal authorities to deliver their digitization efforts. The acquisition was aimed at strengthening Qualys’s federal division and expand the reach of the Qualys Gov Platform to various government sectors including military and defense. Financial details of Second Front Systems are not disclosed.

It is interesting to see Qualys focus on these smaller players to get to the next level of growth. Qualys claims to have an architecture that allows the company to add additional products easily to its stack. It would be interesting to see how Qualys leverages its architecture to integrate these acquisitions. In addition, we would be watching how Qualys trains its sales and marketing teams to sell the newly acquired products to improve the top line growth rate which seems to be sagging right now.

Its stock is currently trading at $84.00 with a market capitalization of $3.3 billion. It touched a year high of $98.30 in July last year. Last year’s market turbulence had sent the stock falling to a year low of $65.94 in December. It shot back up earlier this month and has now come down a bit. If Qualys succeeds in acquiring products and turning those into revenues in a repeatable fashion, the stock will see tremendous momentum in the future.