Qualys vs Rapid7: Revenue, Profit and Business Model
Qualys had $590M of annual revenue in FY2024 and $175M of net income. Rapid7 had $835M of annual revenue in FY2024 and a net loss of $98M.
Latest financial snapshot
Financial summary
Qualys
Qualys's financial performance represents the pinnacle of SaaS profitability and operational efficiency in the cybersecurity industry. In fiscal year 2024, Qualys generated consolidated net revenue of $590.0 million, representing a 13% year-over-year increase compared to $522.3 million in FY2023. Annual recurring revenue (ARR) was propelled by widespread customer adoption of VMDR with TruRisk and Patch Management. GAAP gross profit reached $475 million, resulting in an industry-leading gross margin of 80.5%. GAAP net income reached $160.0 million, delivering an extraordinary net profit margin of 27.12% and diluted earnings per share (EPS) exceeding $4.10. Operating cash flow stood at $245 million, representing a cash flow conversion rate of over 150% of net income. Supported by $455 million in cash, cash equivalents, and marketable securities, zero long-term debt, and consistent double-digit return on invested capital (ROIC), Qualys maintains one of the cleanest and most resilient balance sheets in technology.
Rapid7
Rapid7's financial profile illustrates steady cloud subscription growth, disciplined operational expense containment, and strong free cash flow generation. In fiscal year 2024, Rapid7 delivered consolidated net revenue of $777.0 million, representing a 14% year-over-year increase compared to $685.1 million in FY2023. Annualized Recurring Revenue (ARR) expanded to $796 million, propelled by double-digit expansion in Managed Detection and Response (MDR) and Cloud SIEM/XDR bookings. GAAP gross margin stood at 70%, while Non-GAAP gross margin reached 74%, benefiting from cloud infrastructure efficiencies on Amazon Web Services. Non-GAAP operating income surged to $95 million, reflecting successful margin optimization and corporate restructuring initiatives. The company generated over $90 million in free cash flow. Rapid7 maintains a solid balance sheet with approximately $415 million in cash, cash equivalents, and marketable securities, ensuring strong financial resilience and self-funded growth.
Revenue and profit by year
Qualys
| Year | Revenue | Net income | Margin | Growth | Source |
|---|---|---|---|---|---|
| FY2024 | $590M | $175M | 29.7% | +6.4% | |
| FY2023 | $554.5M | $151.6M | 27.3% | +13.2% | |
| FY2022 | $489.7M | $107.9M | 22.0% | +19.1% | |
| FY2021 | $411.2M | $71.4M | 17.4% | +13.3% | |
| FY2020 | $363M | $92.1M | 25.4% | +12.9% | |
| FY2019 | $321.6M | $69.4M | 21.6% | +15.3% | |
| FY2018 | $278.9M | $57M | 20.4% | +20.8% | |
| FY2017 | $230.8M | $35.9M | 15.6% | +16.6% | |
| FY2016 | $197.9M | $21.1M | 10.7% | +19.4% | |
| FY2015 | $165.7M | $12.7M | 7.7% | — |
Rapid7
| Year | Revenue | Net income | Margin | Growth | Source |
|---|---|---|---|---|---|
| FY2024 | $835M | -$98M | -11.7% | +7.4% | Source |
| FY2023 | $777.6M | -$132.4M | -17.0% | +13.5% | Source |
| FY2022 | $685.1M | -$123.5M | -18.0% | +28.0% | Source |
| FY2021 | $535.4M | -$144.3M | -27.0% | +30.1% | Source |
| FY2020 | $411.5M | -$99.6M | -24.2% | +25.9% | Source |
| FY2019 | $326.9M | -$61.9M | -18.9% | +33.9% | Source |
| FY2018 | $244.1M | -$51.6M | -21.1% | +21.5% | Source |
| FY2017 | $200.9M | -$57.1M | -28.4% | +27.6% | Source |
| FY2016 | $157.4M | -$33.9M | -21.5% | +42.6% | Source |
| FY2015 | $110.4M | -$45.3M | -41.0% | — | Source |
Where the revenue comes from
Qualys
- Vulnerability Management, Detection & Response (VMDR)56.0%
Flagship unified application for continuous asset discovery, vulnerability scoring with TruRisk, risk-based prioritization, and remediation orchestration across global IT environments.
- Cybersecurity Asset Management & Patching20.0%
CyberSecurity Asset Management (CSAM) with external attack surface management (EASM) and integrated, automated patch management across hybrid enterprise endpoints.
- Policy Compliance & File Integrity14.0%
Cloud-based CIS and DISA benchmark compliance, PCI DSS validation, regulatory posture assessment, and real-time file integrity monitoring (FIM).
- Cloud Security & Container Runtime Protection10.0%
TotalCloud Cloud-Native Application Protection Platform (CNAPP), infrastructure-as-code scanning, and containerized workload defense across multi-cloud environments.
Rapid7
- Managed Detection & Response (MDR & InsightIDR)46.0%
24/7 managed security operations center (SOC), cloud SIEM, user entity behavior analytics (UEBA), and incident response.
- Vulnerability Risk Management (InsightVM)34.0%
Continuous network asset scanning, vulnerability remediation prioritization, and live endpoint agents.
- Cloud Security & Application Testing (InsightCloudSec & InsightAppSec)12.0%
Multi-cloud security posture management, container compliance, and dynamic application security testing (DAST).
- Professional Security Advisory & Incident Response8.0%
Elite penetration testing, Metasploit Pro commercial tools, and emergency breach forensics.
Business model and strategy
Qualys
How it makes money
Qualys operates a pure-play multi-tenant cloud Software-as-a-Service (SaaS) subscription business model characterized by exceptional software gross margins, high operating profitability, and predictable annual recurring revenue: (1) Qualys Cloud Platform Subscriptions (~95% of revenue), billed annually in advance based on the number of monitored IT assets, IP addresses, web applications, and cloud workloads.
Growth strategy
Under CEO Sumedh Thakar, Qualys is pursuing four clear corporate growth pillars: (1) Scaling Qualys TruRisk Risk Quantification: Expanding TruRisk adoption to translate technical vulnerabilities into quantified monetary risk scores that corporate boards and CISOs can understand and prioritize;
Competitive advantage
Qualys' sustained competitive advantage stems from four structural pillars: its pure multi-tenant cloud architecture, its lightweight unified Cloud Agent, the TruRisk prioritization algorithm, and unmatched corporate operating profitability. 1.
Rapid7
How it makes money
Rapid7 operates an enterprise Software-as-a-Service (SaaS) subscription and managed services business model with strong recurring revenue and high customer lifetime value: (1) Insight Platform SaaS Subscriptions (~80% of revenue), billed annually on a per-asset, per-user, or data-ingestion basis across InsightVM (vulnerability management), InsightIDR (cloud SIEM/XDR), InsightCloudSec (cloud security), and InsightConn…
Growth strategy
Under CEO Corey Thomas, Rapid7 is executing a four-pillar growth strategy: (1) Expanding MDR Market Leadership: Scaling Managed Detection and Response services to mid-sized enterprises facing severe cybersecurity talent shortages, delivering enterprise-grade 24/7 SOC protection at a fraction of internal build costs;
Competitive advantage
Rapid7's foundational competitive moat combines deep attacker-centric threat intelligence with integrated human-in-the-loop security operations.
Questions about Qualys vs Rapid7
Which company has higher revenue — Qualys or Rapid7?
Qualys had $590.0M (FY2024), while Rapid7 had $835.0M (FY2024). By latest annual revenue, Rapid7 is the larger business, with Qualys showing a smaller revenue base.
What is the market cap of Qualys vs Rapid7?
Qualys's market capitalisation stands at $5.6B, while Rapid7's is $2.5B. Qualys carries the higher market valuation, reflecting investors' expectations of its future earnings power relative to Rapid7.
How does revenue per employee compare for Qualys and Rapid7?
Qualys has $268k / employee in revenue per employee, while Rapid7 has $363k / employee. Headcounts may use different dates, so the ratio alone does not establish which business operates more efficiently.
How do Qualys and Rapid7 make money?
Qualys and Rapid7 generate revenue in fundamentally different ways. Qualys: Qualys operates a pure-play multi-tenant cloud Software-as-a-Service (SaaS) subscription business model characterized by exceptional software gross margins, high operating profitability, and predictable annual recurring revenue: (1) Qualys Cloud Platform Subscriptions (~95% of revenue), billed annually in advance based on the number of monitored IT assets, IP addresses, web applications, and cloud workloads. Rapid7: Rapid7 operates an enterprise Software-as-a-Service (SaaS) subscription and managed services business model with strong recurring revenue and high customer lifetime value: (1) Insight Platform SaaS Subscriptions (~80% of revenue), billed annually on a per-asset, per-user, or data-ingestion basis across InsightVM (vulnerability management), InsightIDR (cloud SIEM/XDR), InsightCloudSec (cloud security), and InsightConnect (SOAR automation); (2) Managed Detection and Response (MDR) Services (~15% of revenue), providing 24/7/365 managed threat monitoring, human-led threat hunting, and automated incident response delivered by Rapid7's elite global Security Operations Centers; and (3) Professional Security Services & Metasploit Pro (~5% of revenue), encompassing adversary emulation, red-teaming penetration testing consulting, and commercial Metasploit software licensing.
Which company is valued higher relative to revenue — Qualys or Rapid7?
On a price-to-sales (P/S) basis, Qualys trades at 9.5x P/S and Rapid7 at 3.0x P/S. Qualys commands a higher revenue multiple, typically indicating that investors expect faster growth or higher future margins compared to Rapid7. A higher multiple is not inherently better — it may also signal that the stock is priced for perfection.
Is Qualys bigger than Rapid7?
By last reported revenue, Rapid7 ($835.0M (FY2024)) is the larger company compared to Qualys ($590.0M (FY2024)). Revenue scale is one dimension of size — market capitalisation, employee count, and geographic reach are also relevant depending on the context.
Figures come from each company's filings and the sources linked beside them. Amounts reported in another currency are shown in US dollars at an approximate rate and marked with ~. Back to the Qualys vs Rapid7 overview