QUALYS, INC.

Qualys operates in the information technology (IT), security, and compliance market, delivering a cloud-based platform that addresses the growing complexities and risks amplified by dissolving boundaries between IT infrastructures and web environments, the rapid adoption of cloud computing, containers and serverless IT models, and the proliferation of geographically dispersed IT assets. The predominant approach to IT security has been to implement multiple disparate security products that can be costly and difficult to deploy, integrate and manage, and the company believes there is a large and growing opportunity for comprehensive cloud-based IT, security and compliance solutions that detect, measure, prioritize and remediate cyber risk delivered in a single platform.

The company competes with a large and broad array of established and emerging vulnerability management vendors, compliance vendors and data security vendors in a highly fragmented and competitive environment, including large and small public companies such as CrowdStrike, Palo Alto Networks, Rapid7, and Tenable Holdings, as well as privately held security providers including Invicti, Tanium, and Wiz (which has announced a pending acquisition by Google). The principal competitive factors include product functionality, breadth of offerings, flexibility of delivery models, ease of deployment and use, total cost of ownership, scalability and performance, customer support and the extensibility of the platform. As of December 31, 2025, the company had 52 issued patents, which expire from 2029 to 2044, several pending U.S. patent applications and an exclusive license to four U.S. patents.

The company provides its solutions through a software-as-a-service model, primarily with renewable annual subscriptions that require customers to pay a fee to access each cloud solution, with invoiced amounts treated as deferred revenues and recognized ratably over the subscription term. The cloud platform is currently used by over 10,000 customers worldwide, including a majority of the Forbes Global 100, and in each of 2025, 2024 and 2023, no one customer accounted for more than 10% of revenues. In 2025, 2024 and 2023, 56%, 58% and 60%, respectively, of revenues were derived from customers in the United States based on billing addresses.

The Qualys Enterprise TruRisk Platform delivers an integrated suite of IT, security and compliance solutions that enable customers to identify and manage internal and external IT and operational technology (OT) assets across on-premises, endpoints, cloud, containers, and mobile environments; collect and analyze large amounts of IT security data; discover and prioritize vulnerabilities; quantify cyber risk exposure; recommend and implement remediation actions; and verify the implementation of such actions. The platform is delivered via 15 global shared cloud platforms, or via the Qualys Private Cloud Platform (PCP) for customers or partners that want the platform to reside within the customer's shared cloud platform. The company offers 20+ Cloud Apps, including Vulnerability Management, Detection and Response (VMDR), Total Application Security (TAS), Patch Management (PM), Custom Assessment and Remediation (CAR), Multi-Vector Endpoint Detection and Response (EDR), Policy Audit (PA), File Integrity Monitoring (FIM), TotalCloud (TC), Cybersecurity Asset Management (CSAM), and Enterprise TruRisk Management (ETM).

The company's core services include Asset Tagging and Management, Reporting and Dashboards, Questionnaires and Collaboration, Remediation and Workflow, Big Data Correlation and Analytics Engine, and Alerts and Notifications. The Qualys GAV framework is a global asset inventory service enabling customers to search for information on any asset, scaling to millions of assets. The Policy Audit (PA) solution includes a library of 900+ pre-built policies, 20,000 controls, and 350 supported technologies, covering over 90 regulations and frameworks such as PCI DSS, HIPAA, SOX, and NIST. The company also offers free services including Qualys Global AssetView and Qualys Certificate Inventory.

On February 12, 2018, the board of directors authorized a $100.0 million ¹ repurchase program, and on each of October 30, 2018, October 30, 2019, May 7, 2020, February 10, 2021 and February 9, 2023, authorized an increase of $100.0 million ², and on each of November 3, 2021, May 4, 2022, February 7, 2024, and February 6, 2025, authorized an increase of $200.0 million ³ to the share repurchase program. On February 5, 2026, the board authorized an increase of $200.0 million ⁴ to the share repurchase program, resulting in an aggregate authorization of $1.6 billion ⁵ to date ($1.4 billion ⁶ as of December 31, 2025). During the year ended December 31, 2025, the company repurchased 1.4 million ⁷ shares of common stock for approximately $182.9 million ⁸. As of December 31, 2025, approximately $160.5 million ⁹ remained available for share repurchases pursuant to the program (excluding the $200.0 million ¹⁰ increase announced on February 5, 2026).

Revenues increased to $669.1 million ¹¹ in 2025 from $607.6 million ¹² in 2024 and $554.5 million ¹³ in 2023. The company continues to experience revenue growth from existing customers as they renew and purchase additional subscriptions, as well as from the addition of new customers. In 2025, 2024 and 2023, 49%, 46% and 43%, respectively, of revenues were generated by channel partners.

The company intends to continue to make significant investments in research and development to extend the cloud platform's functionality by developing new security solutions and capabilities and further enhancing the existing suite of solutions. With more than 10,000 customers across many industries and geographies, the company believes there is a significant opportunity to sell additional solutions to existing customers and expand their use of the suite of solutions, as customers typically initially deploy one or two solutions in select parts of their IT infrastructures and serve as a strong source of new sales as they expand scope and increase subscriptions or adopt additional solutions.

The company is pursuing new customers by targeting key accounts, releasing free IT, security and compliance services and enhancing both the sales and marketing organization and network of channel partners. The company intends to enhance relationships with key security consulting organizations, leading cloud service providers, managed security service providers, leading cloud providers and value-added resellers to accelerate adoption of the cloud platform, and also plans to partner with security providers that can host the private cloud offering within their shared cloud platforms to expand reach in new markets and new geographies. The company may also explore acquisitions that are complementary to and can expand the functionality of the cloud platform, and may seek to acquire development teams and technology to increase the breadth of cloud-based IT, security and compliance solutions, deep learning AI, and machine learning technologies.

The filing does not contain specific margin or cost outlook targets.

The company's shared cloud platform operations are provided by large third-party vendors and are located in the United States, Canada, Switzerland, the Netherlands, United Arab Emirates, Australia, United Kingdom, Italy, the Kingdom of Saudi Arabia and India, with agreements having varying terms through 2030. The company has added shared cloud platforms to provide additional capacity and to enable disaster recovery, and continues to build out these facilities. As of December 31, 2025, the company had 2,625 ¹⁴ full-time employees, including 1,262 ¹⁵ in research and development, 524 ¹⁶ in sales and marketing, 592 ¹⁷ in operations and customer support, and 247 ¹⁸ in general and administrative.

The filing does not specify R&D spending levels, capital expenditure plans, or dividend policy with exact figures for the upcoming period. The board of directors authorized an increase of $200.0 million ¹⁹ to the share repurchase program on February 5, 2026, resulting in an aggregate authorization of $1.6 billion ²⁰ to date.

Adverse economic conditions or reduced IT spending may adversely impact the business, as the company depends on the overall demand for IT and on the economic health of current and prospective customers. Economic weakness, customer financial difficulties, change in interest rates, inflationary pressures and potential for a recession, economic and regulatory uncertainty, and constrained spending on IT security, as well as longer sales cycles, which factors the company has experienced since 2023, have resulted and may in the future result in decreased revenue and earnings. The company faces competition in its markets and may lack sufficient financial or other resources to maintain or improve its competitive position, as many existing and potential competitors have greater brand name recognition, larger sales and marketing budgets and resources, broader distribution networks, access to larger customer bases, and substantially greater financial, technical and other resources.

The company is exposed to fluctuations in currency exchange rates, as for the year ended December 31, 2025, approximately 31% ²¹ of expenses were incurred in foreign currencies, primarily the Euro, British Pound, and Indian Rupee, and approximately 22% ²² of revenues were generated in foreign currencies. A significant portion of customers, channel partners and employees are located outside of the United States, with approximately 78% ²³ of employees located outside of the United States as of December 31, 2025, and 70% ²⁴ of employees located in India.

The company's quarterly and annual operating results may vary from period to period due to factors including the level of demand, timing of deals, seasonal buying patterns, the length of the sales cycle which typically ranges from six to twelve months but can be more than eighteen months, price competition, and general economic conditions. If the company does not successfully anticipate market needs and opportunities or is unable to enhance solutions and develop new solutions on a timely or cost-effective basis, it may not be able to compete effectively. The company faces significant competition from companies with broad product suites and greater name recognition and resources, such as CrowdStrike, Palo Alto Networks, Rapid7, and Tenable Holdings, as well as privately held security providers including Invicti, Tanium, and Wiz. The company's IT, security and compliance solutions are delivered from 15 shared cloud platforms, and any disruption of service at these facilities would interrupt or delay the ability to deliver solutions to customers, which could reduce revenues and harm operating results. The company relies on third-party channel partners to generate a substantial amount of revenues, deriving approximately 49% ²⁵ of revenues from channel partners in 2025, and if it fails to effectively manage distribution channels, revenues could decline.

Management's message emphasizes the company's position as a leading provider of a cloud-based platform delivering IT, security and compliance solutions, with the Qualys Enterprise TruRisk Platform enabling customers to identify and manage assets, collect and analyze security data, discover and prioritize vulnerabilities, quantify cyber risk exposure, recommend and implement remediation actions, and verify implementation. The key elements of the growth strategy are to continue to innovate and enhance the cloud platform and suite of solutions, expand the use of the suite of solutions by the large and diverse customer base of over 10,000 customers worldwide, drive new customer growth and broaden global reach, and selectively pursue technology acquisitions to bolster capabilities and leadership position. The company intends to strengthen its leadership position as a trusted provider of cloud-based IT, security and compliance solutions.