U.S. Software: 2Q Vulnerability Management Preview

Research evidence excerpt

U.S. Software: 2Q Vulnerability Management Preview

Global Research

23 July 2026ab

U.S. Software Equities

Americas2Q Vulnerability Management Preview

Software

Roger Boyd

Summary Analyst

Into 2Q, we see relatively more challenging setups for TENB, QLYS, and RPD. In April, we roger.boyd@ubs.com

noted that the introduction of AI-powered vulnerability discovery could act as a near- +1-212-713 1256

term tailwind for vulnerability management and remediation. Since then, all three Nicholas Hodge

vendors have rallied 50%-75%. Our recent fieldwork suggests customers are spending Associate Analyst

more time on exposure management and remediation/patching, but it isn't clear that nicholas.hodge@ubs.com

this is translating into incremental spend with vulnerability management vendors. We +1-212-882 5954

continue to hear anecdotes of customers using frontier AI discovery offerings directly,

experimenting with solutions from broader cyber platforms, and generally moving

slowly on budget decisions, despite increased board-level awareness and urgency.

Longer-term, we see risks to all three companies as the vulnerability detection and

remediation process shifts further left in the development cycle (an opportunity all AI-

coding tools are speaking to). As a result, we're downgrading TENB to Neutral from Buy

with a PT of $37 ($32 prior), and are now Neutral rated on all three names. While we're

cautious on the group, our checks were most constructive on Qualys, with partners

highlighting stronger competitive positioning given the recent focus on remediation/

patching and improving sales execution with the channel.

Summary of checks

Mythos appears to be driving a meaningful increase in customer awareness and

executive engagement around vulnerability and patch management, though spending is