What changed in this filing

/stocks — the workspaceLOADING

Item 1. Business

2024-02-22 compared with 2023-02-23 · 149 added, 210 removed, 174 unchanged (67% of the section changed)

We are a pioneer and leading provider of a cloud-based platform delivering information technology (IT), security and compliance solutions.

Our integrated suite of IT, security and compliance solutions delivered on our Qualys Cloud Platform enables our customers to:

1) identify and manage their IT assets across on-premises, endpoints, cloud, containers, and mobile environments;

Our integrated suite of IT, security and compliance solutions delivered on Qualys' Enterprise TruRisk Platform enables our customers to:

1) identify and manage their internal and external IT and operational technology (OT) assets across on-premises, endpoints, cloud, containers, and mobile environments;

2) collect and analyze large amounts of IT security data;

3) discover and prioritize vulnerabilities;

4) quantify cyber risk exposure;

5) recommend and implement remediation actions;

1 unchanged sentence

This helps organizations protect their systems and applications from ever-evolving cyber-attacks and helps achieve compliance with internal policies and external regulations.

Our cloud solutions address the growing IT, security and compliance complexities and risks that are amplified by the dissolving boundaries between internal and external IT infrastructures and web environments, the rapid adoption of cloud computing, containers and serverless IT models, and the proliferation of geographically dispersed IT assets.

Organizations use our integrated suite of solutions to cost-effectively obtain a unified view of their IT asset inventory as well as security and compliance posture across globally-distributed IT infrastructures as our solution offers a single platform for information technology, information security, application security, endpoint, developer security and cloud teams.

IT infrastructures are more complex and globally-distributed today than ever before, as organizations of all sizes increasingly rely upon a myriad of interconnected information systems and related IT assets, such as servers, databases, web applications, routers, switches, desktops, laptops, other physical and virtual infrastructure, and numerous external networks and cloud services.

In this environment, new and evolving digital technologies intended to improve organizations’

operations can also increase vulnerability to cyber-attacks, which can expose sensitive data, damage IT and physical infrastructures, and result in serious financial or reputational consequences.

Our cloud platform addresses the growing IT, security and compliance complexities and risks that are amplified by the dissolving boundaries between IT infrastructures and web environments, the rapid adoption of cloud computing, containers and serverless IT models, and the proliferation of geographically dispersed IT assets.

Organizations use our integrated suite of solutions to cost-effectively obtain a unified view of their internal and external IT and OT asset inventory as well as security and compliance posture across globally-distributed IT infrastructures as our solution offers a single platform for information technology, information security, application security, endpoint, developer security and cloud teams.

IT infrastructures are more complex and globally-distributed today than ever before, as organizations of all sizes increasingly rely upon a myriad of interconnected information systems and related assets, such as servers, databases, web applications, routers, switches, desktops, laptops, other physical and virtual infrastructure, and numerous external networks and cloud services.

In this environment, new and evolving digital technologies intended to improve organizations’ operations can also increase vulnerability to cyber-attacks, which can expose sensitive data, damage IT and physical infrastructures, and result in serious financial or reputational consequences.

In addition, the rapidly increasing amount of data and devices in IT environments makes it more difficult to identify and remediate vulnerabilities in a timely manner.

The predominant approach to IT security has been to implement multiple disparate security products that can be costly and difficult to deploy, integrate and manage and may not adequately protect organizations.

As a result, we believe there is a large and growing opportunity for comprehensive cloud-based IT, security and compliance solutions delivered in a single platform.

We designed our Qualys Cloud Platform to transform the way organizations secure and protect their IT infrastructures and applications.

Our cloud platform offers an integrated suite of solutions that automates the lifecycle of asset discovery and management, security assessments, and compliance management for an organization’s IT infrastructure and assets, whether such infrastructure and assets reside inside the organization, on their network perimeter, on endpoints or in the cloud.

Since inception, our solutions have been designed to be delivered through the cloud and to be easily and rapidly deployed on a global scale, enabling faster implementation and lower total cost of ownership than traditional on-premises enterprise software products.

As a result, we believe there is a large and growing opportunity for comprehensive cloud-based IT, security and compliance solutions that detect, measure, prioritize and remediate cyber risk delivered in a single platform.

We designed our cloud platform to transform the way organizations secure and protect their IT infrastructures and applications.

Our cloud platform offers an integrated suite of solutions that automates the lifecycle of asset discovery and management, security and compliance assessments, and remediation for an organization’s IT infrastructure and assets, whether such infrastructure and assets reside inside the organization, on their network perimeter, on endpoints or in the cloud.

Our customers, ranging from some of the largest global organizations to small businesses, are served from our globally-distributed cloud platform, enabling us to rapidly deliver new solutions, enhancements and security updates.

1 unchanged sentence

• No hardware to buy or manage.

There is no infrastructure or software to buy and maintain thus reducing our customers’

operating costs;

There is no infrastructure or software to buy and maintain thus reducing our customers’ operating costs;

all services are accessible in the cloud via web interface.

1 unchanged sentence

• Real-time visibility in one place, anytime and anywhere .

Our customers can conveniently see their security and compliance posture across their global IT asset inventory in one browser window, without plugins or a virtual private network (VPN), whenever and wherever Internet access is available.

Our customers can conveniently see their security and compliance posture across their global IT and OT asset inventory in one browser window, without plugins or a virtual private network (VPN), whenever and wherever Internet access is available.

• Easy global scanning.

11 unchanged sentences

As VM gained acceptance, we introduced additional solutions to help customers manage increasing IT, security and compliance requirements.

Today, the suite of solutions that we offer on our cloud platform and refer to as the Qualys Cloud Apps helps our customers protect a range of assets across on-premises, endpoints, cloud, containers, and mobile environments.

These Cloud Apps address and include:

Vulnerability Management (VM),  

Vulnerability Management, Detection and Response (VMDR), Threat Protection (TP), Continuous Monitoring (CM), Patch Management (PM), Multi-Vector Endpoint Detection and Response (EDR), Certificate Assessment (CRA), SaaS Detection and Response (SaaSDR), Secure Enterprise Mobility (SEM), Custom Assessment and Remediation (CAR), Context Extended Detection and Response (XDR), Network Detection and Response (NDR);

Policy Compliance (PC), Security Configuration Assessment (SCA), PCI Compliance (PCI), File Integrity Monitoring (FIM), Security Assessment Questionnaire (SAQ), Out of-Band Configuration Assessment (OCA); 

Web Application Security:

Web Application Scanning (WAS), Web Application Firewall (WAF);

Asset Management:

Global AssetView (GAV), Cybersecurity Asset Management (CSAM), Certificate Inventory (CRI);

Cloud/Container Security:

Cloud Inventory (CI), Cloud Security Assessment (CSA), Container Security (CS).

Today, the suite of solutions that we offer on our cloud platform and refer to as the Qualys Cloud Apps help our customers detect, measure, prioritize and remediate cyber risk spanning a range of assets across on-premises, endpoints, cloud, containers, and mobile environments.

We provide our solutions through a software-as-a-service model, primarily with renewable annual subscriptions.

2 unchanged sentences

We continue to experience revenue growth from our existing customers as they renew and purchase additional subscriptions, as well as from the addition of new customers to our cloud platform.

Our Qualys Cloud Platform is currently used by over 10,000 customers worldwide, including a majority of each of the Forbes Global 100 and Fortune 100.

Our revenues increased to 

$489.7 million in 2022 from $411.2 million in 2021 and $363.0 million in 2020 . 

Our cloud platform consists of a suite of IT security, compliance, web application security, asset management and cloud and container security solutions, which we refer to as the Qualys Cloud Apps, that leverages our shared and extensible core services and our highly scalable multi-tenant cloud infrastructure.

We also provide open application program interfaces, or APIs, and other developer tools that allow third parties to embed our technology into their solutions and build applications on our cloud platform.

Our cloud platform is currently used by over 10,000 customers worldwide, including a majority of the Forbes Global 100.

Our revenues increased to $554.5 million in 2023 from $489.7 million in 2022 and $411.2 million in 2021.

Our cloud platform consists of a suite of IT security, compliance, web application security, asset management and cloud security solutions, which we refer to as the Qualys Cloud Apps, that leverage our shared and extensible core services and our highly scalable multi-tenant cloud infrastructure.

We also provide open application program interfaces, or APIs, and other developer tools that allow third parties to embed our technology into their solutions and build applications on our platform.

Our cloud platform utilizes physical and virtual sensors, and cloud agents that provide our customers with continuous visibility enabling customers to respond to threats immediately.

Customers can extend visibility to all known IT infrastructure using our Out-of-Band Configuration Assessment sensor for systems that are air-gapped or otherwise difficult to assess.

The Qualys Cloud Platform automatically gathers and analyzes security and compliance data in a scalable, state-of-the-art backend.

Our cloud platform automatically gathers and analyzes security and compliance data in a scalable, state-of-the-art backend.

The technology underlying our cloud infrastructure enables us to ingest, process, analyze and store a high volume of sensor data coming from our agents, scanners and passive analyzers, and correlate information at very high speeds in a distributed manner for millions of devices.

Our cloud platform is delivered to our customers via our 11 global shared cloud platforms, or via our private platform offering, Qualys Private Cloud Platform (PCP), for customers or partners that want the platform to reside within the customer's shared cloud platform.

Our cloud platform is delivered to our customers via our 14 global shared cloud platforms, or via our private platform offering, Qualys Private Cloud Platform (PCP), for customers or partners that want the platform to reside within the customer's shared cloud platform.

The PCP is a standalone version of our multi-layer, multi-tenant services architecture and is a fully integrated turnkey solution, making it more scalable, cost effective and faster to deploy within a customer's shared cloud platform.

4 unchanged sentences

This virtualized PCP allows us to extend our security and compliance solutions without the complexity and cost associated with deploying traditional enterprise software.

We also offer Private Cloud Platform Appliance (PCPA), an on-premises IT, security and compliance solution packaged in a form-factor for medium-sized companies.

Qualys Core Services

Our core services enable integrated workflows, management and real-time analysis and reporting across all of our IT, security and compliance solutions for our customers inside their organizations, on the perimeter, on endpoints or in the cloud.

Our core services enable our customers to detect vulnerabilities, measure and remediate cyber risk through integrated workflows, management and real-time analysis and reporting inside their organizations, on the perimeter, on endpoints or in the cloud.

Our core services constitute dynamic and customizable dashboards and centrally managed, self-updating integrated Cloud Apps, through a natively integrated unified platform.

Our interactive, dynamic dashboards and cloud platform allow our customers to aggregate and correlate all of their IT, security and compliance data in one place, drill down into details, and generate reports customized for different audiences.

Our cloud platform’s powerful Elasticsearch clusters enable customers to instantly find detailed data on any asset.

Our core services include:

• Asset Tagging and Management.

Enables customers to easily identify, categorize and manage large numbers of assets in highly dynamic IT environments and automates the process of inventory management and hierarchical organization of IT assets.

Built on top of this core service is the Qualys GAV framework, which is a global asset inventory service enabling our customers to search for information on any IT asset, scaling to millions of assets for customers of all sizes, helping IT and security personnel to search IT assets and maintain an up-to-date inventory on a continuous basis.

Enables customers to easily identify, categorize and manage large numbers of assets in highly dynamic IT and OT environments and automates the process of inventory management and hierarchical organization of all internal and external assets.

Built on top of this core service is the Qualys GAV framework, which is a global asset inventory service enabling our customers to search for information on any asset, scaling to millions of assets for customers of all sizes, helping IT and security personnel to search assets and maintain an up-to-date inventory on a continuous basis.

• Reporting and Dashboards.

3 unchanged sentences

• Remediation and Workflow.

An integrated workflow engine that allows customers to automatically generate helpdesk tickets for remediation and to manage compliance exceptions based on customer-defined policies, enabling subsequent review, commentary, tracking and escalation.

An integrated workflow engine that allows customers to automatically generate helpdesk tickets for remediation to manage compliance exceptions based on customer-defined policies, enabling subsequent review, commentary, tracking and escalation.

This engine automatically distributes remediation tasks to IT administrators upon scan completion, tracks remediation progress and closes open tickets once patches are applied and remediation is verified in subsequent scans.

5 unchanged sentences

Qualys Cloud Apps

Many organizations have an array of heterogeneous point tools that do not interoperate well and are difficult and costly to maintain and integrate, making it difficult for Chief Information Officers (CIOs) and Chief Information Security Officers (CISOs) to obtain a single, unified view of their organization’s security and compliance posture.

The Qualys Cloud Platform and its Cloud Apps help organizations escape this tool-fragmentation dilemma by drastically simplifying their security stacks and regaining unimpeded visibility across their IT environment.

The Cloud Apps are self-updating, centrally managed and tightly integrated, and cover a broad range of functionality in areas such as IT security, compliance, web application security, asset management and cloud and container security solutions.

From inception through December 31, 2021, we have added the following Cloud Apps:

VM, PC, PCI, WAS, WAF, CM, SAQ, TP, FIM, GAV, SCA, CS, CI, CSA, CRI, CRA, OCA, PM, VMDR, EDR, SaaSDR, SEM, and CSAM.

In 2022, we introduced CAR, XDR and NDR. 

Qualys’ Enterprise TruRisk Platform and its Cloud Apps help organizations escape this tool-fragmentation dilemma by drastically simplifying their security stacks and regaining unimpeded visibility across their on-premises, endpoints, cloud, container, and mobile environments.

The Cloud Apps are self-updating, centrally managed and tightly integrated, and cover a broad range of functionality in areas such as asset management, vulnerability management, risk mitigation, threat detection and response, compliance and cloud security solutions.

We believe that our applications are easy to use and provide our customers with a high level of control because our applications are part of one platform, share a common user interface, utilize the same scanners and agents, access the same collected data, and leverage the same user permissions.

Our customers can subscribe to one or more of our IT, security and compliance Apps based on their initial needs and expand their subscriptions over time to new areas within their organization or to additional Qualys solutions.

For VMDR, we offer four editions of our Qualys Cloud App:

Enterprise for large enterprises, Express for medium-sized businesses, Express Lite for small-sized businesses, and Scan-on-Behalf for Scan-on-Behalf customers.

For all other Qualys Cloud Apps, we offer four editions:

Enterprise for large enterprises, Express for medium-sized businesses, Express Lite for small-sized businesses, and Consulting Edition for consultants, consulting organizations and Managed Service Providers (MSPs).

Many of our customers use multiple Cloud Apps to develop a more complete understanding of their respective environment’s IT, security and compliance posture.

The Qualys Cloud Platform currently provides the following Cloud Apps to our customers:

Vulnerability Management (VM):

VM is an industry leading and award-winning solution that automates network auditing and vulnerability management across an organization, including network discovery and mapping, asset management, vulnerability reporting and remediation tracking.

Driven by our comprehensive knowledge base of known vulnerabilities, VM enables cost-effective protection against vulnerabilities without substantial resource deployment.

Our customers can subscribe to one or more of our 20+ Cloud Apps based on their initial needs and expand their subscriptions over time to new areas within their organization or to additional Qualys solutions to develop a more complete understanding of their respective environment's IT, security and compliance posture and remediate cybersecurity risk.

Many of our customers use multiple Cloud Apps, some of which are noted below:

Asset Management

Cybersecurity Asset Management (CSAM):

CSAM is an all-in-one solution that leverages the power of our cloud platform with its multiple native sensors and CMDB synchronization to continuously inventory known and unknown assets, discover installed applications, and overlay business and risk context to establish asset criticality.

It identifies unauthorized or end-of-life and end-of-service software and the absence of required security tools, and assesses the health of the attack surface.

Further, CSAM enables response options with threat alerts and software removal and delivers regulatory reporting in support of the Federal Risk and Authorization Management Program ("FedRAMP"), PCI-DSS and other mandates.

CSAM includes External Attack Surface Management (EASM), which allows discovery of internet facing unknown assets.

Vulnerability Management

Vulnerability Management, Detection and Response (VMDR):

2 unchanged sentences

VMDR automatically detects the latest superseding patch for the vulnerable asset and easily deploys it for remediation.

Finally, VMDR quantifies risk across vulnerabilities, assets and groups of assets helping organizations proactively reduce cyber risk exposure and track cyber risk reduction over time. By delivering all this in a single app workflow, VMDR automates the entire process and significantly accelerates an organization’s ability to respond to threats, thus preventing possible exploitation.

Threat Protection (TP):

Thousands of new vulnerabilities are disclosed annually.

With TP, customers can pinpoint their most critical threats and identify what they need to remediate first.

TP continuously correlates external threat information against a customer's vulnerabilities and IT asset inventory, so customers know which threats pose the greatest risk to their organization at any given time.

As Qualys engineers continuously validate and rate new threats from internal and external sources, TP’s live feed displays the latest vulnerability disclosures and maps them to customers’

impacted IT assets.

Customers can see the assets affected by each threat, and drill down into details.

Continuous Monitoring (CM):

Built on top of VM, CM is a next-generation cloud service that can detect network threats and unexpected changes before they turn into breaches.

Whenever CM spots an anomaly in a network, it immediately sends targeted, informative alerts to the right people for each situation and each machine.

CM tracks what happens throughout public perimeters, internal networks, and cloud environments - anywhere in the world.

Finally, VMDR quantifies risk across vulnerabilities, assets and groups of assets helping organizations proactively reduce cyber risk exposure and track cyber risk reduction over time.

By delivering all this in a single app workflow, VMDR automates the entire process and significantly accelerates an organization’s ability to respond to threats, thus preventing possible exploitation across on-premises, endpoints, cloud, containers, and mobile environments.

Web Application Scanning (WAS):

WAS continuously discovers and catalogs web applications – including new and unknown ones – and detects vulnerabilities and misconfigurations in web apps and APIs.

Scaling to thousands of scans, it conducts incisive, thorough and precise testing of browser-based web apps, mobile app backends, and Internet of things (IoT) services.

WAS' powerful API enables integration with other systems and allows teams to detect issues within DevOps environments early in the application development process.

Bundled malware detection capability with WAS uses reputational, behavioral, antivirus, and heuristic analyses to identify and alert on malware infecting a user's websites.

By Integrating WAS with manual testing tools and bug bounty solutions, customers can build a comprehensive web application vulnerability testing program.

Risk Mitigation

Patch Management (PM):

PM provides automated patch deployment capabilities for Windows, Linux, Mac and third party software by correlating vulnerabilities and the right set of remediation including patches and configuration fixes.

It continuously gathers and uploads telemetry about installed software, open vulnerabilities and missing patches to the Qualys Cloud Platform.

The resulting shared visibility of assets and their posture enables IT and security teams to collaborate using common vulnerability-centric terminology and provides a consistent data set to analyze, prioritize, deploy and verify patches more efficiently. 

PM provides automated patch deployment capabilities for Windows, Linux, Mac and third party software by correlating vulnerabilities and the right set of remediation including patches and configuration fixes.

It continuously gathers and uploads telemetry about installed software, open vulnerabilities and missing patches to our cloud platform.

Custom Assessment and Remediation (CAR):

CAR enables security architects to create custom scripts in popular scripting languages, user-defined controls and automation, all seamlessly integrated within existing programs to quickly assess, respond to and remediate threats across global hybrid environments.

Threat Detection and Response

Multi-Vector Endpoint Detection and Response (EDR):

2 unchanged sentences

This leads to an incomplete picture and a high rate of false positives and negatives, requiring organizations to use multiple point solutions and large incident response teams.

Qualys fills the gaps by bringing a new multi-vector approach and the unifying power of its highly scalable Cloud Platform to EDR, providing vital context and comprehensive visibility to the entire attack chain, from prevention to detection to response.

EDR unifies different context vectors like asset discovery, rich normalized software inventory, end-of-life visibility, vulnerabilities and exploits, misconfigurations, in-depth endpoint telemetry, and network reachability with a powerful backend to correlate it all for accurate assessment, detection and response.

Certificate Assessment (CRA):

CRA assesses digital certificates and Transport Layer Security (TLS) configurations.

CRA generates certificate instance grades using a straightforward methodology that allows administrators to assess often overlooked server SSL/TLS configurations without having to become SSL experts.

It also identifies out-of-policy certificates with weak signatures or key length and shows how many unique Certificate Authorities were found in the environment and how many certificates each one issued.

SaaS Detection and Response (SaaSDR):

SaaSDR leverages the Qualys Cloud platform to provide continuous visibility into SaaS applications such as Office 365, Salesforce and Zoom for configuration posture management, activity monitoring and data security insights.

Secure Enterprise Mobility (SEM):

SEM extends the power of VMDR for in-depth inventory of mobile devices and their data, real time vulnerability and misconfiguration detection, and built-in remediation with patch orchestration for all Android and iOS/iPadOS devices across the enterprise.

 Custom Assessment and Remediation (CAR):

Custom Assessment and Remediation opens the Qualys Cloud Platform for security architects allowing the creation of custom scripts in popular scripting languages, user-defined controls and automation, all seamlessly integrated within existing programs to quickly assess, respond to and remediate threats across global hybrid environments.   

 Context Extended Detection and Response (XDR): XDR provides context and clarity to enterprise security operations through risk-focused, single pane of glass visibility and control to improve enterprise-wide threat detection and incident response.

It leverages the Cloud Platform's response capabilities - patching, fixing misconfigurations, killing processes and network connections, and quarantining hosts - to comprehensively remediate cyber security threats identified by Qualys XDR.  

 Network Detection and Response (NDR):

Network detection and response monitors network traffic and analyzes it using deep learning artificial intelligence (AI) to detect cyber threats in data centers and in the public cloud. 

The solution is able to detect both known and publicly undisclosed threats in real time. 

Our highly scalable platform fills the gaps by bringing a new multi-vector approach and the unifying power to EDR, providing vital context and comprehensive visibility to the entire attack chain, from prevention to detection to response.

EDR unifies different context vectors like asset discovery, rich normalized software inventory, end-of-life visibility, vulnerabilities

and exploits, misconfigurations, in-depth endpoint telemetry, and network reachability with a powerful backend to correlate it all for accurate assessment, detection and response.

Context Extended Detection and Response (XDR):

XDR provides context and clarity to enterprise security operations through risk-focused, single pane of glass visibility and control to improve enterprise-wide threat detection and incident response.

It leverages our cloud platform's response capabilities - patching, fixing misconfigurations, killing processes and network connections, and quarantining hosts - to comprehensively remediate cyber security threats identified by Qualys’ XDR.

Policy Compliance (PC):

4 unchanged sentences

PC works to prioritize and track remediation and exceptions, while demonstrating a repeatable auditable process for compliance management

Security Configuration Assessment (SCA):

SCA provides automatic assessment of IT assets’

configurations using the latest Center for Internet Security (CIS) Benchmarks for operating systems, databases, applications and network devices.

SCA provides intuitive workflows for assessing, monitoring, reporting and remediating security-related configuration issues.

SCA’s CIS assessments are provided via a web-based user interface and delivered from the Qualys Cloud Platform, enabling centralized management with minimal deployment overhead.

SCA users can automatically create downloadable reports and view dashboards.

PCI Compliance (PCI):

PCI streamlines and automates compliance with PCI DSS (Payment Card Industry Data Security Standard) requirements for protecting the collection, storage, processing and transmission of cardholder data.

As an Approved Scanning Vendor, Qualys has been authorized by the PCI Security Standards Council to conduct the required quarterly scans.

PCI scans all Internet-facing networks and systems with Six Sigma (99.9996%) accuracy, generates reports and provides detailed patching instructions.

An auto-submission feature completes the compliance process once remediation is completed.

File Integrity Monitoring (FIM):

3 unchanged sentences

FIM helps customers to comply with change control policy enforcement and change monitoring requirements.

Security Assessment Questionnaire (SAQ):

SAQ automates and streamlines third-party and internal risk assessment processes, obviating the need to perform such processes manually via email and spreadsheets.

SAQ easily designs surveys to assess procedural controls of IT and security policies and practices.

SAQ automates the launch and monitoring of assessment campaigns, making the process agile, accurate, comprehensive, centralized, scalable and uniform across an organization.

SAQ also provides tools for displaying, analyzing and acting on collected data, enabling the assessment of compliance with industry standards, regulations and internal policies of third parties, like vendors and partners, and of employees.

Out-of-Band Configuration Assessment (OCA):

The OCA sensor and Cloud App allows customers to achieve complete visibility of all known IT infrastructure by pushing vulnerability and configuration data to the Qualys Cloud Platform from systems that are otherwise difficult to assess, such as highly locked-down systems, systems on disconnected or “air gap”

networks, or in environments that are highly sensitive to scans.

OCA’s expanded data collection approach significantly broadens the types of technologies supported by the Qualys Cloud Platform and provides deeper assessment of configuration so that customers have better visibility into potentially critical vulnerabilities and misconfigurations across their entire environment.

Web Application Security

Web Application Scanning (WAS):

WAS continuously discovers and catalogs web applications –

including new and unknown ones –

and detects vulnerabilities and misconfigurations in web apps and APIs.

Scaling to thousands of scans, it conducts incisive, thorough and precise testing of browser-based web apps, mobile app backends, and Internet of things (IoT) services.

Its seamless integration with the Qualys Web Application Firewall (WAF) enables verification of attack protection, ticket creation and one click mitigation of vulnerabilities.

WAS' powerful API enables integration with other systems and allows teams to detect issues within DevOps environments early in the application development process.

Bundled malware detection capability with WAS uses reputational, behavioral, antivirus, and heuristic analyses to identify and alert on malware infecting a user's websites.

By Integrating WAS with manual testing tools and bug bounty solutions, customers can build a comprehensive web application vulnerability testing program.

Web Application Firewall (WAF):

WAF permits the reduction of application security cost and complexity with a unified platform to prevent any attempt to exploit vulnerabilities.

Simple, scalable and adaptive, WAF enables the quick blocking of attacks, prevents disclosure of sensitive information, and controls when and where customer applications are accessed.

WAF and WAS work together seamlessly.

Customers scan web apps with WAS, deploy one-click virtual patches if needed in WAF, and manage it all from a centralized cloud-based portal.

WAF can be deployed in minutes on prem or in the cloud, as a virtual machine or a container, supports load-balancing as well as TLS offloading, and does not require special hardware.

Asset Management

Global AssetView (GAV):

GAV constantly gathers information on all assets, including system and hardware details, running services, open ports, installed software and user accounts.

Asset discovery and inventory collection is done through a combination of Qualys network scanners, Cloud Agents and passive scanners, which together collect comprehensive data from on-premises or cloud infrastructure as well as remote endpoints.

In order to create consistent and uniform asset data, GAV normalizes raw discovery data to standardize every manufacturer name, product name, model and software version using Qualys’

ever-evolving technology catalog as a reference.

This catalog automatically extends IT asset inventory with non-discoverable metadata such as hardware and software release dates, end of life dates, and license categories.

This new data layer allows teams to detect issues such as unauthorized software, outdated hardware or end-of-life software, which can help properly tag, support, and secure business-critical assets. 

Cybersecurity Asset Management (CSAM):

CSAM is an all-in-one solution that leverages the power of the Qualys Cloud Platform with its multiple native sensors and CMDB synchronization to continuously inventory known and unknown assets, discover installed applications, and overlay business and risk context to establish asset criticality.

It identifies unauthorized or end-of-life and end-of-service software and the absence of required security tools, and assesses the health of the attack surface.

Further, CSAM enables response options with threat alerts and software removal and delivers regulatory reporting in support of FedRAMP, PCI-DSS and other mandates. 

CSAM includes External Attack Surface Management, which allows discovery of internet facing unknown assets.  

Certificate Inventory (CRI):

CRI continuously scans global IT assets from a single console to discover internal and external certificates issued from any certificate authority across all enterprise IT assets, both on premise and in the cloud.

As a result, certificates can be renewed before they expire, which stops certificate-related outages and improves availability.

It collects all certificate, vulnerability and configuration data required for certificate inventory and analysis.

CRI also reveals how many certificates are out of compliance or do not follow organizational policies for key length, for signature algorithms or for the use of trusted and approved Certificate Authorities through the use of highly customizable dashboards and provides users a comprehensive overview of Qualys SSL Labs-caliber certificate grades for internal and externally facing certificates.

Cloud / Container Security

Cloud Inventory (CI):

CI delivers continuous visibility into public cloud accounts.

In one single-pane view, it inventories virtual machines, storage buckets, databases, security groups, Access Control Lists (ACLs), Elastic Load Balancers (ELBs) and users –

across all regions, multiple accounts and multiple cloud platforms.

CI continuously tracks assets and enables users to quickly understand the topography of their cloud environment and uncover the root cause of incidents.

Cloud Security Assessment (CSA): CSA provides a continuous assessment of the security posture of an organization’s cloud resources against misconfigurations, malicious behavior, and nonstandard deployments.

CSA evaluates resources against CIS benchmarks and best practices to identify misconfigured storage buckets, security groups, Relational Database Service, exposing data and the resource for public exploitation. CSA correlates host vulnerabilities and compliance data into intelligent insights which allow users to quickly detect risks throughout their complex cloud environments.

With CSA, users gain real-time visibility into their up-to-date security and compliance posture of public clouds in one single-pane view.

Container Security (CS):

CS delivers container-native visibility and protection throughout the entire lifecycle of containerized applications.

It incorporates scanning of container images for software composition and enforcement of hardened container stack configurations for continuous policy compliance, whether the images are on the build machines, in the container registries or in the runtime cluster nodes.

CS uses a unique 'layered-in' approach to provide deep visibility into all the application activities and automatically creates a behavior profile, which is enforced on each container for runtime protection.

By integrating with continuous integration and continuous delivery pipelines and toolchains, CS enables DevSecOps processes and transparent enforcement of security and compliance without compromising the speed and agility of containers and serverless deployment models.

This leads to significant cost benefits for enterprises compared to certain legacy security solutions.

Cloud Security

Qualys TotalCloud is a Cloud-Native Application Protection Platform (CNAPP), which provides an integrated suite of security capabilities designed for multi-cloud environments.

It provides complete visibility and cyber-risk exposure assessment across cloud assets, enabling continuous discovery and monitoring of the cloud landscape to identify risks and maintain compliance.

With its FlexScan technology, TotalCloud offers comprehensive assessment features that include no-touch, agentless, API, and snapshot-based scanning, along with agent and network-based scanning for thorough vulnerability detection.

The TruRisk component allows for a unified risk view, correlating vulnerabilities, security controls, and compliance across resources to prioritize and reduce cyber risks effectively.

For real-time defense, TotalCloud's InstaProtect continuously monitors all cloud assets to detect and protect against evolving and unknown threats.

Remediation is streamlined through our QFlow technology, which provides no-code, drag-and-drop workflows for efficient vulnerability management.

TotalCloud provides organizations with an all-encompassing solution, delivering fast, agentless, real-time security and compliance across a variety of use cases, including Cloud Workload Protection (CWP), Cloud Detection and Response (CDR), Cloud Security Posture Management (CSPM), Infrastructure as Code (IaC), and Container Security (CS) to offer organizations a single unified solution for comprehensively securing their cloud and multi-cloud environments.

Free Services

We also offer organizations of all sizes free security and compliance services based on the Qualys Cloud Platform:

Qualys Global AssetView app automatically creates a continuous, real-time inventory of known and unknown assets throughout a user's global IT footprint across on-premises, endpoints, multi-cloud, mobile, containers, operational technology and IoT.

We also offer organizations of all sizes free security and compliance services based on our cloud platform:

• Qualys Global AssetView app automatically creates a continuous, real-time inventory of known and unknown assets throughout a user's global IT footprint across on-premises, endpoints, cloud, containers, and mobile environments.

The app also automatically normalizes and categorizes assets to ensure clean, reliable, and consistent data.

2 unchanged sentences

Upon an unknown device detection, users can install a light-weight Qualys self-updating agent (3MB) to turn the device into a managed device or launch a vulnerability scan.

Qualys Cloud Inventory continuously discovers and tracks assets and resources across public cloud deployments to provide users both real-time and historical views of cloud inventory.

It collects metadata about cloud assets and resources to help users understand the relationships between public cloud assets and resources across different dimensions and then discover their threat posture based on those attributes and relationships.

Cloud Inventory is limited to three accounts per public cloud platform.

Qualys Certificate Inventory inventories and assesses all Internet-facing certificates to generate SSL/TLS configuration grades, identifies the certificate issuer and tracks certificate expirations to help stop expired and expiring certificates from interrupting critical business functions.

• Qualys Certificate Inventory inventories and assesses all Internet-facing certificates to generate SSL/TLS configuration grades, identifies the certificate issuer and tracks certificate expirations to help stop expired and expiring certificates from interrupting critical business functions.

Our Growth Strategy

2 unchanged sentences

• Continue to innovate and enhance our cloud platform and suite of solutions.

We intend to continue to make significant investments in research and development to extend our cloud platform’s functionality by developing new security solutions and capabilities and further enhancing our existing suite of solutions.

From inception through December 31, 2021, we have added the following Cloud Apps:

PC, PCI, WAS, WAF, CM, SAQ, TP, FIM, GAV, SCA, CS, CI, CSA, CRI, CRA, OCA, PM, VMDR, EDR, SaaSDR, SEM, and CSAM.

In 2022, we introduced CAR, XDR and NDR. 

• Expand the use of our suite of solutions by our large and diverse customer base.

5 unchanged sentences

We will continue to seek to make significant investments to encourage organizations to replace their existing security products with our cloud solutions.

We intend to expand our relationships with key security consulting organizations, managed security service providers and value-added resellers to accelerate the adoption of our cloud platform.

We intend to expand our relationships with key security consulting organizations, leading cloud service providers, managed security service providers and value-added resellers to accelerate the adoption of our cloud platform.

We seek to strengthen existing relationships as well as establish new relationships to increase the distribution and market awareness of our cloud platform and target new geographic regions.

3 unchanged sentences

We may also seek to acquire development teams to supplement our own personnel and acquire technology to increase the breadth of our cloud-based IT, security and compliance solutions.

In 2022, we acquired certain intangible assets of Blue Hexagon Inc., enabling us to leverage our cloud platform with AI/machine learning to uncover behavior patterns including active vulnerability exploitation, identification of advanced network threats, and adaptive risk mitigation across all assets and applications. 

In 2022, we acquired certain intangible assets of Blue Hexagon Inc., enabling us to leverage our cloud platform with deep learning AI and machine learning (ML) technologies to uncover behavior patterns including active vulnerability exploitation, identification of advanced network threats, and adaptive risk mitigation across all assets and applications.

In 2021, we acquired certain intangible assets of Kandor Soft Labs Private Ltd.

(TotalCloud), strengthening our cloud security solution by allowing customers to build user-defined workflows for custom policies and execute them on-demand for simplified security and compliance. In 2020, we acquired certain intangible assets of Spell Security Private Limited (Spell Security), expanding our endpoint behavior detection, threat hunting, malware research and multi-layered response capabilities for our EDR application.

(TotalCloud), strengthening our cloud security solution by allowing customers to build user-defined workflows for custom policies and execute them on-demand for simplified security and compliance.

Our Customers

We market and sell our solutions to enterprises, government entities and small and medium-sized businesses across a broad range of industries, including education, financial services, government, healthcare, insurance, manufacturing, media, retail, technology and utilities.

As of December 31, 2022 , we had over 10,000 customers worldwide, including a majority of each of the Forbes Global 100 and Fortune 100.

As of December 31, 2023, we had over 10,000 customers worldwide, including a majority of the Forbes Global 100.

In each of 2023, 2022 and 2021, no one customer accounted for more than 10% of our revenues.

In 2022 , 2021 and 2020 , 60% , 61% and 63%, respectively, of our revenues were derived from customers in the United States based on our customers' billing addresses.

In 2023, 2022 and 2021, 60%, 60% and 61%, respectively, of our revenues were derived from customers in the United States based on our customers' billing addresses.

We sell our solutions to enterprises and government entities primarily through our field sales force and to small and medium-sized businesses through our inside sales force.

7 unchanged sentences

We also further assign each of our sales teams into groups that focus on adding new customers or managing relationships with existing customers.

Our channel partners maintain relationships with their customers throughout the territories in which they operate and provide their customers with services and third-party solutions to help meet those customers’

evolving security and compliance requirements.

As such, these partners offer our IT, security and compliance solutions in conjunction with one or more of their own products or services and act as a conduit through which we can connect with these prospective customers to offer our solutions.

Our channel partners include security consulting organizations, managed service providers and resellers, such as Accenture, BT Managed Security, Cognizant Technology Solutions, Deutsche Telekom, DXC Technology, Fujitsu, Hindustan Computers Limited (HCL) Technologies, International Business Machines (IBM), Infosys, Nippon Telegraph and Telephone Corporation (NTT), Optiv, Tata Communications, Verizon, Wipro and TD SYNNEX Corporation (TD SYNNEX).

Qualys has also established strategic partnerships with leading cloud providers like Amazon Web Services, Microsoft Azure and the Google Cloud Platform.

Our channel partners include security consulting organizations, leading cloud providers, managed service providers and resellers.

For sales involving a channel partner, the channel partner engages with the prospective customer directly and involves our sales team as needed to assist in developing and closing an order.

16 unchanged sentences

Research and Development and Operations

We devote significant resources to maintain, enhance and add new functionality to our Qualys Cloud Platform and the integrated suite of solutions that we offer.

We devote significant resources to maintain, enhance and add new functionality to our cloud platform and the integrated suite of solutions that we offer.

Our development organization consists of agile engineering teams with substantial security expertise in specific areas of our solutions.

6 unchanged sentences

Our research and development team also works collaboratively with our technical support team to ensure customer satisfaction and with our sales team to accelerate the adoption of our solutions.

Shared Cloud Platform Agreements

Our shared cloud platform operations are provided by large third-party vendors and are located in the United States, Canada, Switzerland, the Netherlands, United Arab Emirates, Australia, United Kingdom and India.

Our shared cloud platform agreements have varying terms through 2025.

Shared Cloud Platform Agreements

Our shared cloud platform operations are provided by large third-party vendors and are located in the United States, Canada, Switzerland, the Netherlands, United Arab Emirates, Australia, United Kingdom, Italy, the Kingdom of Saudi Arabia and India.

Our shared cloud platform agreements have varying terms through 2027.

The expanding capabilities of our IT, security and compliance solutions have enabled us to address a growing array of opportunities in the cloud IT, security and compliance market.

We compete with a large and broad array of established and emerging vulnerability management vendors, compliance vendors and data security vendors in a highly fragmented and competitive environment.

We compete with large and small public companies, such as Broadcom (Symantec Enterprise Security), CrowdStrike, Palo Alto Networks, Rapid7, and Tenable Holdings, as well as privately held security providers including Axonius, Checkmarx, Flexera, Invicti, Ivanti, Tanium, HelpSystems (Tripwire), Trustwave Holdings and Veracode.

We compete with large and small public companies, such as Broadcom (Symantec Enterprise Security), CrowdStrike, Palo Alto Networks, Rapid7, and Tenable Holdings, as well as privately held security providers including Axonius, Checkmarx, Flexera, Invicti, Ivanti, Tanium, HelpSystems (Tripwire), Trustwave Holdings, Veracode and Wiz.

We also seek to replace IT, security and compliance solutions that organizations have developed internally.

As we continue to extend our cloud platform’s functionality by further developing IT, security and compliance solutions, such as web application scanning and firewalls, we expect to face additional competition in these new markets.

As we continue to extend our cloud platform’s functionality by further developing IT, security and compliance solutions, such as Cybersecurity Asset Management and Patch Management, we expect to face additional competition in these new markets.

Our competitors may also attempt to further expand their presence in the IT, security and compliance market and compete more directly against one or more of our solutions.

We believe that the principal competitive factors affecting our markets include product functionality, breadth of offerings, flexibility of delivery models, ease of deployment and use, total cost of ownership, scalability and performance, customer support and extensibility of platform.

We believe that our suite of solutions generally competes favorably with respect to these factors.

2 unchanged sentences

We rely on a combination of trade secrets, copyrights, patents and trademarks, as well as contractual protections, to establish and protect our intellectual property rights and protect our proprietary technology.

As of December 31, 2022 , we have thirty issued patents, which expire from 2029 to 2040, several pending U.S.

As of December 31, 2023, we have thirty-six issued patents, which expire from 2029 to 2042, several pending U.S.

patent applications and an exclusive license to four U.S.

1 unchanged sentence

The licenses are currently exclusive and will remain exclusive so long as we make an appropriately-timed written election and pay an annual fixed royalty for ten years thereafter.

These exclusive licenses are subject to the licensor’s reservation of certain r ights in the patents and subject to the U.S.

government’s reserved rights in the technology.

These exclusive licenses are subject to the licensor’s reservation of certain r ights in the patents and subject to the U.S.

government’s reserved rights in the technology.

We have a number of registered and unregistered trademarks.

We require our employees, consultants and other third parties to enter into confidentiality and proprietary rights agreements and control access to software, documentation and other proprietary information.

We view our trade secrets and know-how as a significant component of our intellectual property assets, as we have spent years designing and developing the Qualys Cloud Platform, which we believe differentiates us from our competitors.

We view our trade secrets and know-how as a significant component of our intellectual property assets, as we have spent years designing and developing our cloud platform, which we believe differentiates us from our competitors.

We expect that software and other solutions in our industry may be subject to third-party infringement claims as the number of competitors grows and the functionality of products in different industry segments overlaps.

3 unchanged sentences

Doing the right thing for our people, our communities and our environment upholds the trust of our customers, partners, employees, and stockholders, enabling us to grow our business profitably and meet the diverse needs of our constituents.

As of December 31, 2022 , we had 2,143 full-time employees, including 1,062 in research and development, 376 in sales and marketing, 478 in operations and customer support, and 227 in general and administrative.

As of December 31, 2023, we had 2,188 full-time employees, including 1,016 in research and development, 438 in sales and marketing, 504 in operations and customer support, and 230 in general and administrative.

As of December 31, 2023, approximately 75% of our employees were located outside of the United States, with 66% of our employees located in Pune, India.

3 unchanged sentences

We believe our employee relations are good, and we have not experienced any work stoppages.

Compensation and Benefits

Our Competitive Compensation and Benefits Policy.

We understand that providing competitive compensation and benefits plays a critical role in attracting and retaining the best available personnel.

That is why we offer robust compensation and benefits to our employees, including competitive base salaries, variable pay and equity awards, and generous benefits packages.

To support the health and wellness of our workforce, Qualys offers premium health coverage with minimal out-of-pocket contributions for our employees.

Corporate Governance.

Qualys maintains a Compensation and Talent Committee of the Board of Directors to oversee the company’s compensation policies, plans and benefits programs, and overall compensation philosophy.

The Committee approves CEO and executive officers’ compensation plans, and reviews, approves, and administers various employee benefit plans, among other duties.

As part of its ongoing review of the performance criteria and compensation of designated key executives, the Compensation and Talent Committee also meets annually with the CEO, the Company’s principal human resources executive, and any other corporate officers as it deems appropriate.

Supporting our Team and Community

Talent Development and Safety.

We take a holistic approach to our social strategy, striving to create a culture where talented people want to come to work, develop their careers, become leaders, and make a difference for all our stakeholders and communities.

We believe every employee makes a difference, so we empower them in their roles and support them for professional growth.

We assist employees in achieving their career goals by helping them improve their skillsets and transition to increasingly challenging roles.

Diversity and Inclusion.

We are proud to be a leader in the promotion and practice of diversity and inclusion.

In addition to having offices and employees all over the world, we take pride in our cultural diversity.

Qualys searches the globe for top talent in an effort to recruit and hire diverse individuals with a variety of skills, experiences, and backgrounds.

We take pride in our cultural diversity with offices and employees all over the world.

Our objective is to continue to improve our hiring, development, advancement, and retention of diverse talent and to foster an inclusive environment.

Our board of directors and executive team are highly diverse.

Two out of our current seven member board of directors are women, one is a man from an underrepresented community, and the board of directors seeks to identify strong candidates who provide a wide range of perspectives, competencies, and knowledge to complement the skills, diversity and experiences of the board of directors.

Further, our executive team is gender and ethnically diverse, with more than 50% of the executive team from underrepresented communities.

Health and Safety

We recognize that a healthy environment and safe workplaces are critical to our business, strategy, and communities.

We address environmental issues in an integrated manner to encompass protection of the environment as well as the health and safety of our workforce.

For example, in response to COVID-19 and the significant increases in remote workforces in March 2020, we mandated a work from home policy to protect our employees and our communities.

We also released a free cloud-based remote endpoint protection solution for 60 days that allowed IT and security teams to protect the computers of remote employees and support the health and safety of our communities.

During 2022, our workforce gradually transitioned into a hybrid work schedule, which resulted in a significant portion of our workforce working either in-person on a part-time basis, or remotely on a permanent basis.

In addition to having more than 50% of the executive team from underrepresented communities, we are also continuing to improve diversity among our growing workforce, with steady increases in recent years in the percentage of women employed among our global workforce and with over half of our US-based employees from underrepresented communities.

Qualys is focused on building a pipeline of diverse candidates across all our job functions.

We define diversity as underrepresented job seekers, like women, minorities, people with disabilities, older workers, and LGBTQIA+ community members.

Qualys searches the globe for top talent in an effort to recruit and hire diverse individuals with a variety of skills, experiences, and backgrounds.

Our company holiday calendar includes events and festivals from many regions and religions, and we include diverse cultural initiatives throughout the year to ensure employees feel represented.

Promoting a Healthy Work-life Balance.

Qualys aims to maintain a healthy work-life balance and provide resources to support our employees’ mental and physical well-being.

During 2022, our workforce gradually transitioned into a hybrid work schedule, which resulted in a significant portion of our workforce working either in-person on a part-time basis, or remotely on a permanent basis.

During 2023, we continued to offer this hybrid work schedule to our workforce.

Our top priority remains providing support for our employees, partners, and customers.

We are fortunate that the nature of our business allows us to successfully operate in this dynamic hybrid environment.

We believe that our hybrid policy will be a key enabler to support the broad needs of critical on-site to remote employees. 

We require our employees and managers to participate in myriad training programs directed at maintaining a harassment-free, diverse, and secure workplace.

With our diverse employee population, we uphold the rights to work in an environment that promotes equal opportunity and prohibits discriminatory practices against race, color, national origin, ancestry, medical condition, religious creed (including religious dress and grooming practices), marital status, registered domestic partner status, sex, sexual orientation, gender identity and expression, genetic characteristics and information, age, veteran status, or any other protected characteristic.

Creating a respectful workplace and preventing harassment to our employees remain our on-going commitment.

Compensation and Benefits

We provide robust compensation and benefits to our employees.

In addition to competitive base salaries, all qualified employees are eligible for variable pay and equity awards.

To support the health and wellness of our workforce, we offer premium health coverage with minimal out-of-pocket contributions for our global employees.

We are fortunate that the nature of our business allows us to successfully operate in this dynamic hybrid environment.

We believe that our hybrid policy will be a key enabler to support the broad needs of critical on-site to remote employees.

Community Engagement .

We value the communities that support our operations and have several company and employee-led initiatives to support the communities in which we operate.

In 2023, our efforts were centered on advancing education, gender equality, and environmental initiatives.

Training and Development

We have experience with managing and developing a rapidly growing employee base.

We believe every employee makes a difference, so we empower them in their roles and support them for maximum professional growth.

We assist employees in achieving their career goals by helping them improve their skillsets and transition to other challenging roles.

To support career growth inside and outside Qualys, we offer free self-paced or instructor-led certified training on core Qualys topics giving employees and non-employees an opportunity to achieve certifications.

Employee Training.

We require our employees and managers to participate in myriad training programs directed at maintaining a harassment-free, diverse, and secure workplace.

or any other protected characteristic.

Creating a respectful workplace and preventing harassment to our employees remain our on-going commitment.

Employee Development.

Investing in employees is critical to our success.

Qualys employees participate in an onboarding program to integrate new hires into role-specific functions and company culture.

Qualys offers managers and employees various training courses as needed.

To support career growth inside and outside Qualys, we offer free self-paced and instructor-led certified training on core Qualys topics, giving employees and non-employees an opportunity to achieve certifications and job-related courses free of charge.

To allow for open dialogue between employees and managers, we conduct formal employee reviews each year.

Corrective action plans are developed for employees who may be struggling to meet his or her job responsibilities.

Employee performance is considered during compensation reviews.

In addition to formal reviews, our Human Resources team regularly meets with managers to check in with teams and conducts exit interviews globally.

Qualys India also conducts an assimilation program for new employees, through which feedback is collected as employees join the company.

Sustainable Business Operations

Our Sustainable Solutions.

Qualys products, delivered via our multi-tenant cloud platform, enable improved environmental sustainability for our customers.

In particular, our cloud-based solutions minimize the number of physical servers our customers have to deploy within their own environments, reducing energy consumption on their end.

Qualys Cloud Apps, delivering rich content and dashboards visible on any device, also reduce paper and printing costs for our customers.

Our Eco-Friendly Operations.

Our environmental, health and safety systems, processes and tools in place across our footprint enable Qualys to meet or exceed governmental and industry requirements.

We strive to consistently improve how we operate our platforms in energy-efficient networks and data centers as well as pursue sustainability initiatives that reduce energy, waste and materials consumption.

We have 14 multi-tenant platforms across the world, eight of which are in collocated facilities.

The others are hosted in public cloud environments.

Though data centers are inherently energy-intensive, utilizing collocated facilities allows us to leverage economies of scale for power and cooling.

In addition, most of our third-party providers continue to advance their own sustainability programs to reduce their environmental impact.

Environmental Standards Within Supply Chain .

We are committed to advancing supply chain responsibility and strive to enhance transparency and promote greater accountability in our own operations and with our suppliers.

Qualys outsources product manufacturing and recycling to suppliers and vendors that follow the highest environmental standards in the industry, such as ISO 14001.

We also seek to prohibit our suppliers from profiting from the sale of tantalum, tin, tungsten, and gold (also known as “conflict minerals”) that funds conflict in the Democratic Republic of the Congo (DRC) and adjoining countries, and we seek to require that our suppliers source these minerals from socially responsible suppliers.

Available Information

6 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1. Business