Here are 1-3 brief analogies to describe Qualys (QLYS):

• Qualys is like Salesforce for IT security and compliance management.
• Qualys is like ServiceNow for enterprise cybersecurity workflows.
• Qualys is like Moody's or S&P Global for assessing and managing your company's digital security risks.

• Vulnerability Management, Detection & Response (VMDR): A comprehensive solution for continuous asset discovery, vulnerability assessment, threat prioritization, and remediation orchestration across the IT environment.
• Patch Management (PM): Automates the patching of operating systems and applications to address identified vulnerabilities and improve security posture.
• Endpoint Detection and Response (EDR): Provides visibility into endpoint activities, detects advanced threats, and enables rapid incident response on endpoints.
• Web Application Scanning (WAS): Automatically discovers and scans web applications for known and unknown vulnerabilities, misconfigurations, and malware.
• Cloud Security Posture Management (CSPM): Continuously assesses cloud environments for security misconfigurations, compliance violations, and provides remediation guidance.
• Container Security (CS): Integrates security throughout the container lifecycle, from build to runtime, identifying vulnerabilities and misconfigurations in container images and deployments.

Qualys (QLYS) primarily sells its cloud-based IT security and compliance solutions to other companies, not individuals. As is common for business-to-business (B2B) software-as-a-service (SaaS) providers, Qualys does not publicly disclose the names of its specific "major customers" due to competitive reasons and client confidentiality agreements. Therefore, it is not possible to list specific customer company names and their symbols.

However, Qualys serves a broad and diverse customer base across various industries and organizational sizes. Its customer base can be broadly categorized as:

• Large Enterprises and Global Organizations: This category includes a significant number of Fortune 1000 and Global 2000 companies across diverse sectors. These organizations leverage Qualys for comprehensive vulnerability management, threat detection, compliance, and cloud security at scale.
• Government Agencies: Qualys solutions are adopted by various government entities at federal, state, and local levels to secure critical infrastructure and ensure regulatory compliance.
• Small and Medium-sized Businesses (SMBs): While often associated with large enterprises, Qualys also caters to SMBs that require robust, scalable, and cost-effective security solutions without the need for extensive on-premise infrastructure.

Qualys's solutions are utilized by companies across a wide range of industries, including but not limited to:

• Financial Services
• Retail
• Healthcare
• Technology and Telecommunications
• Manufacturing
• Energy and Utilities

• Amazon.com, Inc. (AMZN)
• Microsoft Corporation (MSFT)

Sumedh Thakar, President & CEO

Sumedh Thakar joined Qualys in 2003 as an engineer and steadily progressed through leadership roles, becoming Chief Product Officer in 2014, President in 2019, and President and CEO in 2021. He was a key architect in the expansion of the Qualys Cloud Platform. Before Qualys, he worked as a software engineer at Intacct, a cloud-based financial software provider, and also at Northwest Airlines, where he developed complex algorithms for their reservation system. He holds five U.S. patents for cybersecurity technology.

Joo Mi Kim, Chief Financial Officer

Joo Mi Kim is responsible for all aspects of Qualys' finance organization globally, including finance, accounting, investor relations, treasury, and tax. She brings over 15 years of experience in financial planning and operations, investor relations, investment banking, and economic consulting. Prior to her current appointment as Qualys' CFO in 2020, she served as CFO for Impact, a leader in partnership automation, and Aera Technology, an enterprise SaaS company. She also previously served as Vice President of FP&A and Investor Relations at Qualys from 2016 to 2018. Her earlier career includes roles as an investment banker at J.P. Morgan and an economic consultant at Ernst & Young.

Dilip Bachwani, CTO and EVP, Enterprise TruRisk Platform

Prior to joining Qualys, Dilip Bachwani held numerous engineering leadership positions at various mid-sized and large organizations, where he was responsible for building and delivering complex, scalable, distributed enterprise SaaS products and big data cloud platforms.

Brad Bell, Chief Information Officer

As Qualys' Chief Information Officer, Brad Bell is responsible for the global corporate IT infrastructure, business applications, and operations. With over 30 years of experience in the technology industry, he specializes in leading global IT functions and driving digital transformation. Before joining Qualys, he was the CIO at Infoblox, where he spearheaded the company's global IT strategy and played a crucial role in its business transformation towards a SaaS-based model and cloud transition.

Pinkesh Shah, Chief Product Officer

Pinkesh Shah oversees all global Product Management, Product & UX Design, Product Marketing, Demand Generation, Branding, and Analyst Relations functions at Qualys. He is an entrepreneurial product leader with over 18 years of experience in building and launching category-defining technology products. Shah has extensive cybersecurity expertise, having led product, engineering, and marketing teams at companies such as McAfee, BeyondTrust, Exabeam, netIQ, and IBM.

The key risks to Qualys' business include intense competition and industry consolidation, challenges in sustaining revenue growth and customer acquisition, and regulatory and compliance risks.

The cybersecurity market is highly competitive and experiencing a major vendor consolidation trend. Larger platform competitors are increasingly offering broader, integrated security solutions, which places pressure on specialized providers like Qualys that focus on vulnerability and risk management.

Qualys faces a core challenge in sustaining its top-line revenue growth, especially within a market characterized by customer budget scrutiny. This environment has contributed to a slowdown in customer acquisition and presents difficulties in retaining long-term customers.

Furthermore, Qualys is subject to various regulatory requirements, including the need to maintain government authorizations such as its FedRAMP High solution. Any changes to global data privacy or security standards could necessitate costly platform updates, impacting the company's operations.

The emergence and rapid adoption of dedicated cloud-native application protection platforms (CNAPPs) and agentless cloud security solutions (e.g., Wiz, Orca Security, Lacework). These platforms often provide a unified, agentless, and graph-based approach to cloud security posture management (CSPM), cloud workload protection (CWPP), and other cloud security functions across public cloud environments. This fundamentally different architectural model, purpose-built for modern cloud infrastructures, challenges Qualys's existing cloud security and vulnerability management offerings, potentially providing a more integrated and less friction-filled security experience for organizations adopting cloud-native architectures.

Qualys (QLYS) is expected to drive future revenue growth over the next 2-3 years through several key initiatives and market trends:

1. Expansion of the Enterprise TruRisk Management (ETM) Platform and Risk Operations Center (ROC): Qualys is seeing early traction and significant demand for its ETM solution, which integrates risk quantification, continuous threat exposure management, and automated remediation. This platform is designed to help customers consolidate cybersecurity tools and operationalize risk management. The introduction of the cloud-based Risk Operations Center (ROC) and managed Risk Operations Center (mROC), along with new AI-powered features like TruConfirm and TruRisk Eliminate, are anticipated to drive deeper platform adoption and open new market opportunities.
2. Growth through Channel Partners and International Expansion: The company has reported a significant increase in revenue contribution from its channel partners, with this segment outpacing direct revenue growth. Furthermore, international revenue growth has consistently outpaced domestic growth, indicating a strong opportunity for continued expansion in global markets.
3. Adoption of Flexible Pricing Models and Vendor Consolidation: Qualys's flexible pricing model is contributing to its competitive advantage. Additionally, customers are increasingly looking to consolidate their cybersecurity tools onto unified platforms, and Qualys's comprehensive offerings position it well to capture this demand. This trend supports deeper platform adoption and increased average revenue per user (ARPU).
4. Expansion into Government Business with FedRAMP High Authorization: The Qualys GovCloud Platform achieving FedRAMP High Authorization is a crucial development that opens up significant opportunities for the company to secure more contracts with federal and state government agencies, thereby expanding its customer base and revenue streams.
5. Launch of New AI and Machine Learning-Powered Products and Services: Qualys continues to innovate by introducing new capabilities, including AI and ML-based security solutions. These new offerings, such as a marketplace for AI-powered agents aimed at managing cyber risk and enhancements to its Total Cloud Synapse platform, are expected to create incremental greenfield opportunities and support sustained revenue growth.

Share Repurchases

• As of the third quarter of 2025, Qualys had $205 million remaining in its share repurchase program.
• In the third quarter of 2025, Qualys repurchased $49.4 million in shares.
• Since the inception of its share repurchase program in February 2018, Qualys has repurchased 10.4 million shares, returning $1.2 billion in cash to shareholders.

Share Issuance

• On August 1, 2025, 6,042 common shares were withheld from the CEO to cover tax liability related to vesting Restricted Stock Units (RSUs), with an implied value of approximately $0.79 million.
• The number of common shares outstanding decreased from 36,977,259 as of February 12, 2024, to 36,477,672 as of February 11, 2025, indicating a net reduction in shares.

Outbound Investments

• Qualys acquired Blue Hexagon in October 2022, an AI-based automated network threat defense solution.
• In August 2021, Qualys acquired Total Cloud for $1.1 million.
• Qualys acquired Spell Security in August 2020 for an undisclosed amount.

Capital Expenditures

• Planned capital expenditures for the full year 2025 are expected to be in the range of $5.5 million to $7 million.
• Capital expenditures were modest at $3.4 million in the second quarter of 2025.
• The primary focus of capital expenditures is to support the company's scalable cloud infrastructure and platform expansion.