Here are 1-3 brief analogies for Qualys (QLYS):

• Qualys is the Salesforce for IT security and compliance.
• Think of Qualys as the SAP for cybersecurity.

• Vulnerability Management, Detection and Response (VMDR): A comprehensive solution for identifying, detecting, and responding to vulnerabilities across IT environments.
• Patch Management: Automates the deployment of software patches to remediate vulnerabilities and maintain system integrity.
• Multi-Vector Endpoint Detection and Response (Multi-Vector EDR): Detects and responds to advanced threats across various vectors on endpoint devices.
• Policy Compliance & Security Configuration Assessment: Ensures IT assets adhere to security policies and compliance mandates through continuous assessment.
• Web Application Security (WAS & WAF): Provides scanning for web application vulnerabilities and firewall protection against web-based attacks.
• Cybersecurity Asset Management: Offers a unified inventory and management solution for all IT and cybersecurity assets across the enterprise.
• Cloud and Container Security: Assesses and secures cloud environments and containerized applications against various threats and misconfigurations.

Qualys (QLYS) primarily sells its cloud-based IT, security, and compliance solutions to other companies and government entities, operating on a Business-to-Business (B2B) model.

The provided background information does not list the specific names of Qualys's major customer companies or their public symbols. Companies in the cybersecurity space often do not disclose specific customer names for competitive or privacy reasons.

However, the background indicates that Qualys serves a broad range of customers, including:

• Enterprises: Large organizations across various sectors.
• Government Entities: Public sector organizations.
• Small and Medium-sized Businesses (SMBs): Smaller to mid-sized companies.

These customers span diverse industries, such as:

• Education
• Financial Services
• Government
• Healthcare
• Insurance
• Manufacturing
• Media
• Retail
• Technology
• Utilities

Sumedh Thakar, President and CEO

Sumedh Thakar joined Qualys in 2003 as an engineer and has held various leadership roles, eventually becoming President and CEO in 2021. Prior to Qualys, he worked as a software engineer at Intacct, an early cloud-based financial software provider, and at Northwest Airlines, where he developed complex algorithms. He holds a bachelor's degree in computer engineering from Savitribai Phule Pune University and is a co-inventor of five U.S. patents for cybersecurity technology.

Joo Mi Kim, Chief Financial Officer

Joo Mi Kim has served as the Chief Financial Officer of Qualys since 2020. She previously held the CFO position at Impact, a leader in partnership automation, and Aera Technology, an enterprise SaaS company. Before that, she was Vice President of FP&A and Investor Relations at Qualys from 2016 to 2018. Her career also includes experience as an investment banker at J.P. Morgan and an economic consultant at Ernst & Young. Joo Mi Kim earned a bachelor's degree in economics from the University of Chicago and an MBA from The Wharton School of the University of Pennsylvania.

Pinkesh Shah, Chief Product Officer

Pinkesh Shah is the Chief Product Officer at Qualys, where he is responsible for all Product Management, Product & UX Design, Product Marketing, Demand Generation, Branding, and Analyst Relations. With over 18 years of experience, he has led product, engineering, and marketing teams at companies such as McAfee, BeyondTrust, Exabeam, netIQ, and IBM. He is also the Founder & CEO of DelightLoop and a Professor of Practice at the Institute of Product Leadership.

Dilip Bachwani, CTO and SVP, Enterprise TruRisk Platform

Dilip Bachwani is the Chief Technology Officer and Senior Vice President of the Enterprise TruRisk Platform at Qualys. He oversees global product development, data and platform engineering, DevOps, site reliability engineering, cloud operations, and customer support. Joining Qualys in 2016, he has been instrumental in scaling the company's technology and organization. Prior to Qualys, Dilip held multiple engineering leadership roles at various organizations, building complex, scalable, distributed enterprise SaaS products and big data cloud platforms. He holds a bachelor's degree in electronics engineering from the University of Mumbai and a master's degree in computer science from Ball State University.

Shawn O'Brien, EVP Global Sales and Strategic Alliances

Shawn O'Brien leads global sales, channel and alliance development, and sales operations for Qualys. He brings over 30 years of executive and sales leadership experience in the security and IT sectors, with a strong track record of building high-performance teams and driving revenue growth. Most recently, he served as Chief Revenue Officer at Phosphorus.

Key Risks to Qualys (QLYS):

1. Intense Competition: Qualys operates in a highly competitive and dynamic cybersecurity market, facing pressure from a broad range of rivals. Larger, diversified technology companies such as Palo Alto Networks, CrowdStrike, and Zscaler, alongside specialized cybersecurity firms like Tenable and Rapid7, are actively expanding their offerings into Qualys's core vulnerability management sector and adjacent markets, including cloud security and endpoint detection and response (EDR). Qualys's growth strategy, which relies on cross-selling new modules to its existing customer base, places it in direct competition with these established players in their respective domains.
2. Rapid Technological Evolution and AI Disruption: The cybersecurity industry is characterized by continuous technological advancements and evolving threat landscapes, particularly with the increasing sophistication of cyberattacks powered by artificial intelligence (AI). Qualys must constantly innovate and adapt to maintain its competitive edge. Concerns exist that Qualys's emphasis on profitability might lead to a less aggressive investment in generative AI compared to some faster-growing competitors, potentially hindering long-term innovation. The rise of AI also presents a "net downside risk" by potentially disrupting core vulnerability management practices, similar to how endpoint detection and response (EDR) solutions superseded traditional antivirus products.
3. Macroeconomic Headwinds and Longer Sales Cycles: Macroeconomic uncertainty is a significant risk, contributing to extended sales cycles and increased scrutiny of IT budgets for cybersecurity solutions. This economic environment can negatively impact Qualys's opportunities to upsell to existing customers and acquire new ones, potentially affecting its overall revenue growth and financial performance.

Qualys (NASDAQ: QLYS) operates within several significant and growing cybersecurity markets. Here's an overview of the addressable markets for their main products and services globally:

• Vulnerability Management: The global security and vulnerability management market was valued at approximately USD 17.67 billion in 2025 and is projected to reach USD 34.01 billion by 2035. Another estimate places the global vulnerability management market at US$14.94 billion in 2024, with a projection to reach US$24.08 billion by 2030.
• Endpoint Detection and Response (EDR): The global endpoint detection and response (EDR) market was valued at USD 3.5 billion in 2024 and is expected to reach USD 9.8 billion by 2030. Other sources indicate the global EDR market was valued at USD 3,553.4 million in 2023 and is expected to reach USD 16,893.2 million by 2030.
• Cloud Security: The global cloud security market size was estimated at USD 40.81 billion in 2025 and is predicted to increase to approximately USD 133.39 billion by 2035. Another report valued the global cloud security market at USD 51.11 billion in 2025, with a projection to reach USD 224.16 billion by 2034.
• Application Security (including Web Application Security): The global application security market size was estimated at USD 10.65 billion in 2025 and is projected to reach USD 42.09 billion by 2033. Furthermore, the market was valued at USD 10.4 billion in 2024 and is estimated to reach USD 34.8 billion by 2033.
• Governance, Risk, and Compliance (GRC): The global GRC technology market reached an approximate valuation of USD 51.5 billion in early 2025. Separately, the global Governance, Risk, and Compliance (GRC) platform market size was valued at USD 51.43 billion in 2025 and is forecast to reach USD 92.68 billion by 2031.
• Overall Cybersecurity Market: The global cybersecurity market size was valued at USD 218.98 billion in 2025 and is projected to grow to USD 699.39 billion by 2034. Another estimate for global spending on cybersecurity products and services predicts it will reach $454 billion annually in 2025.

Qualys (QLYS) is expected to drive future revenue growth over the next 2-3 years through several key initiatives and market trends:

1. Expansion and Adoption of the Enterprise TruRisk Management (ETM) Platform and AI-driven Cybersecurity Solutions: Qualys is strategically focused on the broader adoption of its Enterprise TruRisk Management (ETM) platform, which incorporates advanced AI capabilities, including its Agentic AI platform. This platform approach allows for features like exploit validation, risk quantification, and autonomous remediation, aiming to redefine pre-breach risk management. The company is actively launching new AI-driven cybersecurity solutions, such as Identity Security Posture Management (ISPM) and TotalCloud CNAPP, to address evolving threats and expand its total addressable market.
2. Growth Through Channel Partnerships: Channel partners, including security consulting organizations, managed service providers, and resellers, are a significant and growing component of Qualys's revenue strategy. Channel partner revenue has been outpacing direct sales growth and now accounts for a substantial portion of total revenue. Programs like the Managed Risk Operation Center (mROC) are designed to further empower partners, driving both new customer acquisition and deeper adoption of Qualys solutions, especially in international markets.
3. International Market Expansion: Qualys is experiencing robust growth in international markets, with non-U.S. revenue consistently growing at a higher rate than domestic sales. This global market penetration is a key driver, with international revenue representing a significant and increasing percentage of the company's total revenue. The company is strategically expanding its reach outside the U.S. to capitalize on this momentum.
4. Upselling and Cross-selling to Existing Customers (Net Dollar Expansion): A crucial driver for Qualys is deepening relationships with its existing customer base of over 10,000 subscribers. The company aims to expand "wallet share" by encouraging customers to adopt more modules and services within the Qualys Cloud Platform. This strategy is reflected in an improving net dollar expansion rate, indicating that existing customers are increasing their spending on Qualys's comprehensive suite of IT, security, and compliance solutions.
5. Expansion into the Government Sector with FedRAMP High Certification: Qualys has achieved agency authorization for FedRAMP High, a significant certification that positions the company uniquely in the U.S. federal sector. This achievement establishes a strong foundation for securing government entities and opens new opportunities for revenue growth across multiple solution categories in hybrid environments.

Capital Allocation Decisions of Qualys (QLYS)

Share Repurchases

• Qualys increased its share repurchase program by an additional $200 million in February 2026.
• As of the third quarter of 2025, Qualys had $205 million remaining in its share repurchase program.
• Since the inception of its share repurchase program in February 2018, Qualys has repurchased 10.4 million shares, returning $1.2 billion in cash to shareholders.

Share Issuance

• On August 1, 2025, 6,042 common shares were withheld from the CEO to cover tax liability related to vesting Restricted Stock Units (RSUs).
• The number of Qualys shares outstanding decreased by 2.41% in one year, as of February 2026, indicating net repurchases exceeding any new issuances.

Outbound Investments

• Qualys acquired Blue Hexagon, an AI-based automated network threat defense solution company, in October 2022.
• In August 2021, Qualys acquired Total Cloud for $1.1 million.
• Qualys acquired Spell Security, an endpoint detection and response (EDR) cybersecurity startup, in August 2020.

Capital Expenditures

• Qualys anticipates 2025 capital expenditures to range between $8 million and $11 million.
• Capital expenditures were $23 million in 2024 and $38 million in 2023.
• The company has steadily reduced its capital spending over time as it matured into a fully cloud-native, low-infrastructure SaaS business, with capital expenditures settling at 1-2% of revenues for ongoing CapEx.