While security companies have grown swiftly, they have invested much of their cash in technology to stay ahead of their competitors and ahead of hackers. Margins will remain tight as companies fight to gain business.
"It is going to be a race of these new companies," Courtot said of the emerging generation of security providers.
Research and data company IHS projected recently that enterprises will spend $175 million in cloud infrastructure and services this year. The company said it expects the number to grow to $235 billion in 2017.
The increase in cloud computing and use of mobile devices presents a conundrum for security. "Where does my network start and finish?" Courtot asked.
"I have apps on Amazon. I have a lot of endpoints. I have mobile devices. I have to do business with a lot of people," he said. "I have to exchange data between partners."
News that hackers used credentials issued to a heating and air conditioning contractor to break into Target Inc.'s systems underscores the difficulty of plugging every gap in a network's defenses.
"Now you realize that my AC system is connected to my network because it was very convenient to de-provision or provision users and now the bad guys use that as an entry door and that's how it started at Target," Courtot said.
The Qualys chief acknowledged that there will be more consolidation, but declined to comment on the likelihood that Qualys would become a target.
The shift to the cloud and the narrow field of cloud security companies could make the company appealing to a larger security company such as Symantec Corp. (SYMC) Checkpoint Software Technologies or Fortinet (FTNT).
Nonetheless, Courtot said Qualys could be a buyer. The first criterion for a target, he said, would be the quality of the management team and the ability to keep talent at the company after an acquisition. Second, the target would have to have a cloud architecture, rather than a legacy enterprise network security model.
Courtot pointed to the winners and losers in social media to illustrate the importance of architecture. Friendster preceded Facebook (FB) but it developed an architecture that did not scale well. MySpace.com took over, but kept its architecture closed. Facebook opened its infrastructure to developers, and supplanted MySpace.
The third criterion, Courtot said, is "of course you don't want to overpay."