Morgan Stanley has assessed recent performance at two U.S. cybersecurity software firms, pointing to execution progress and new product pathways while cautioning that financial confirmation of recoveries remains thin. The brokerage kept restrained ratings on both names as management teams contend with competition and aim to steady growth metrics.
Rapid7 (RPD)
Morgan Stanley assigned Rapid7 an Equal Weight rating with a revised price target of $9, down from $10. The company reported first-quarter revenue of $209.7 million, a 0.3% decline year-over-year but slightly above consensus of $208.1 million. Annual recurring revenue stood at $832 million, a 0.6% decline year-over-year and a sequential drop from $840 million in the fourth quarter.
Management characterized performance within the portfolio as bifurcated. Core platform solutions - which represent more than 80% of Rapid7’s business - expanded roughly 2% year-over-year, with detection and response posting about 7% growth. Those gains were partially offset by weakness in exposure management and faster churn in non-core products.
On the product roadmap, Rapid7’s acquisition of Kenzo is expected to speed parity for managed detection and response by automating tasks typically performed by entry-level security operations center analysts. Morgan Stanley emphasized this as a prospective product lever rather than definitive financial proof of a turnaround.
Profit metrics exceeded expectations in the period. Non-GAAP operating income reached $24.4 million, and free cash flow was $33.4 million, the latter beating consensus by roughly 31%. For fiscal 2026, Rapid7’s revenue guidance remained unchanged at a range of $836 million to $842 million, implying a 2.4% decline year-over-year. Operating income guidance was raised to $112 million to $118 million, reflecting management’s focus on cost discipline.
In updating its valuation approach for Rapid7, Morgan Stanley lowered its multiple to 5x fiscal 2027 estimated free cash flow from 7x previously, citing broad software valuation compression tied to concerns about artificial intelligence-native competitors.
Qualys (QLYS)
Morgan Stanley placed Qualys at Underweight with a price target reduced to $96 from $117. The company posted first-quarter revenue of $175.6 million, an increase of 9.8% year-over-year and above the $173.5 million estimate.
Revenue mix shifted toward channel sales, which grew 17% and accounted for 52% of total revenue; direct revenue increased by 3%. Management noted that External Threat Management and Cyber Security Asset Management together represented 11% of last-twelve-months total bookings and 14% of new bookings, while Patch Management constituted 8% of total bookings and 15% of new bookings. Net dollar retention rose modestly to 104% from 103% in the fourth quarter.
Current billings of $168.3 million were up 8% year-over-year. Management reiterated fiscal 2026 current billings growth guidance in the 7-8% range. The company raised fiscal 2026 revenue guidance to a midpoint of $724 million, which implies growth of 8.2% year-over-year and is only 0.4% above the prior midpoint.
Morgan Stanley adjusted its valuation framework for Qualys as well, moving to an 8x fiscal 2027 estimated free cash flow multiple from 11x previously. The firm attributed the change to valuation compression across software names amid concerns about artificial intelligence-native competitors.
Outside of Morgan Stanley, other analysts also revised their views: Scotiabank lowered its target on Qualys to $100 citing the billings outlook, while RBC Capital raised its target to $90, citing a solid start to the fiscal year.
Takeaway
Morgan Stanley’s review presents a picture of operational progress at both Rapid7 and Qualys - including pockets of product growth, margin and cash flow improvements at Rapid7, and booking and channel momentum at Qualys - but stops short of declaring financial turnarounds. The firm reduced price targets and compressed valuation multiples to reflect sector-wide concerns, particularly around how AI-native competitors could affect software valuations.