Qualys under pressure as firm says Microsoft vulnerability partnership ending

Microsoft (MSFT) recently announced plans to end its original equipment manufacturer partnership with Qualys (QLYS) as the default provider of vulnerability scanning within Microsoft Defender, effective May 1, according to Morgan Stanley, which sees this posing a “potentially material” sales risk for the latter. The news has pushed Qualys’ shares into negative territory on Monday.

END OF PARTNERSHIP: Morgan Stanley said that Microsoft recently announced plans to end its original equipment manufacturer partnership with Qualys as the default provider of vulnerability scanning within Microsoft Defender, effective May 1. With Microsoft being one of Qualys’ largest customers and partners, the firm sees sales risks as “potentially material.” Morgan Stanley further believes Microsoft represents between 5%-10% of Qualys revenue, presenting material risk to sales as existing Defender customers migrate. It feels the recent Microsoft announcement adds to its view of mounting topline pressures for Qualys.

Last month, Microsoft outlined plans to retire its existing Vulnerability Management solution within the defender for Servers product, after announcing intentions to consolidate VM across servers and containers with the Microsoft Defender Vulnerability Management, or MDVM, solution embedded within its Defender for Cloud offering at Ignite 2023. While the announcement presents risks to the VM market at large given the distribution advantages wielded by Microsoft, the emergence of Microsoft’s own VM offering is particularly precarious for Qualys given the company’s prior OEM/white label partnership with Microsoft as the default vulnerability assessment tool within Defender.

While existing Microsoft/Qualys customers will still be able to utilize Qualys within Defender for Cloud by manually enabling the scanner through Microsoft’s BYOL — bring your own license — option, effective May 1, 2024, Microsoft customers utilizing the Qualys scanner within Defender will be migrated to MDVM as the default VM offering, diminishing Qualys’ reach within Microsoft Security’s large installed base, stated Morgan Stanley. With that said, the firm thinks it important to note, both companies have indicated plans to continue maintaining integrations with the others’ solutions, with Qualys still participating in the Microsoft Security Copilot partner private preview and Microsoft’s Defender for Endpoint integrating with the Qualys Enterprise TruRisk Platform. Morgan Stanley keeps an Underweight rating on Qualys’ shares with a price target of $150.

PRICE ACTION: In Monday morning trading, shares of Qualys have dropped over 9% to $170.62, while Microsoft’s stock has slipped about 1% to $406.82.