What changed in this filing

/stocks — the workspaceLOADING

Item 1. Business

2025-02-21 compared with 2024-02-22 · 28 added, 33 removed, 290 unchanged (17% of the section changed)

We are a pioneer and leading provider of a cloud-based platform delivering information technology (IT), security and compliance solutions.

We are a leading provider of a cloud-based platform delivering information technology (IT), security and compliance solutions.

Our integrated suite of IT, security and compliance solutions delivered on Qualys' Enterprise TruRisk Platform enables our customers to:

72 unchanged sentences

An integrated workflow engine that allows customers to automatically generate helpdesk tickets for remediation to manage compliance exceptions based on customer-defined policies, enabling subsequent review, commentary, tracking and escalation.

This engine automatically distributes remediation tasks to IT administrators upon scan completion, tracks remediation progress and closes open tickets once patches are applied and remediation is verified in subsequent scans.

This engine automatically distributes remediation tasks to IT administrators upon scan completion, tracks remediation progress and closes open tickets once patches or other mitigating actions are applied and remediation is verified in subsequent scans.

• Big Data Correlation and Analytics Engine.

6 unchanged sentences

Qualys’ Enterprise TruRisk Platform and its Cloud Apps help organizations escape this tool-fragmentation dilemma by drastically simplifying their security stacks and regaining unimpeded visibility across their on-premises, endpoints, cloud, container, and mobile environments.

The Cloud Apps are self-updating, centrally managed and tightly integrated, and cover a broad range of functionality in areas such as asset management, vulnerability management, risk mitigation, threat detection and response, compliance and cloud security solutions.

The Cloud Apps are self-updating, centrally managed and tightly integrated, and cover a broad range of functionality in areas such as asset management, vulnerability and configuration management, risk remediation, threat detection and response, compliance and cloud security solutions.

We believe that our applications are easy to use and provide our customers with a high level of control because our applications are part of one platform, share a common user interface, utilize the same scanners and agents, access the same collected data, and leverage the same user permissions.

5 unchanged sentences

It identifies unauthorized or end-of-life and end-of-service software and the absence of required security tools, and assesses the health of the attack surface.

Further, CSAM enables response options with threat alerts and software removal and delivers regulatory reporting in support of the Federal Risk and Authorization Management Program ("FedRAMP"), PCI-DSS and other mandates.

CSAM includes External Attack Surface Management (EASM), which allows discovery of internet facing unknown assets.

Vulnerability Management

Vulnerability and Configuration Management

Vulnerability Management, Detection and Response (VMDR):

10 unchanged sentences

By Integrating WAS with manual testing tools and bug bounty solutions, customers can build a comprehensive web application vulnerability testing program.

Risk Mitigation

Risk Remediation

Patch Management (PM):

2 unchanged sentences

The resulting shared visibility of assets and their posture enables IT and security teams to collaborate using common vulnerability-centric terminology and provides a consistent data set to analyze, prioritize, deploy and verify patches more efficiently.

Patch Management is a component of Qualys' TruRisk Eliminate suite of remediation solutions.

TruRusk Eliminate encompasses a broad range of remediation capabilities for organizations when patches are not yet available or feasible to deploy.

Custom Assessment and Remediation (CAR):

8 unchanged sentences

and exploits, misconfigurations, in-depth endpoint telemetry, and network reachability with a powerful backend to correlate it all for accurate assessment, detection and response.

Context Extended Detection and Response (XDR):

XDR provides context and clarity to enterprise security operations through risk-focused, single pane of glass visibility and control to improve enterprise-wide threat detection and incident response.

It leverages our cloud platform's response capabilities - patching, fixing misconfigurations, killing processes and network connections, and quarantining hosts - to comprehensively remediate cyber security threats identified by Qualys’ XDR.

Policy Compliance (PC):

16 unchanged sentences

Remediation is streamlined through our QFlow technology, which provides no-code, drag-and-drop workflows for efficient vulnerability management.

TotalCloud provides organizations with an all-encompassing solution, delivering fast, agentless, real-time security and compliance across a variety of use cases, including Cloud Workload Protection (CWP), Cloud Detection and Response (CDR), Cloud Security Posture Management (CSPM), Infrastructure as Code (IaC), and Container Security (CS) to offer organizations a single unified solution for comprehensively securing their cloud and multi-cloud environments.

TotalCloud provides organizations with an all-encompassing solution, delivering fast, agentless, real-time security and compliance across a variety of use cases, including Cloud Workload Protection (CWP), Cloud Detection and Response (CDR), Cloud Security Posture Management (CSPM), Infrastructure as Code (IaC), SaaS Security Posture Management (SSPM), and Kubernetes and Container Security (KCS) to offer organizations a single unified solution for comprehensively securing their cloud and multi-cloud environments.

Free Services

14 unchanged sentences

Because our customers typically initially deploy one or two of our solutions in select parts of their IT infrastructures, our existing customers serve as a strong source of new sales as they expand their scope and increase their subscriptions or choose to adopt additional solutions from our integrated suite of IT, security and compliance offerings.

In this regard, we continue to expand our sales execution and marketing functions to increase adoption of our newly developed solutions among our existing customers.

In this regard, we continue to enhance our sales execution and marketing functions to increase adoption of our newly developed solutions among our existing customers.

• Drive new customer growth and broaden our global reach.

We are pursuing new customers by targeting key accounts, releasing free IT, security and compliance services and expanding both our sales and marketing organization and network of channel partners.

We are pursuing new customers by targeting key accounts, releasing free IT, security and compliance services and enhancing both our sales and marketing organization and network of channel partners.

We will continue to seek to make significant investments to encourage organizations to replace their existing security products with our cloud solutions.

We intend to expand our relationships with key security consulting organizations, leading cloud service providers, managed security service providers and value-added resellers to accelerate the adoption of our cloud platform.

We intend to enhance our relationships with key security consulting organizations, leading cloud service providers, managed security service providers, leading cloud providers and value-added resellers to accelerate the adoption of our cloud platform.

We seek to strengthen existing relationships as well as establish new relationships to increase the distribution and market awareness of our cloud platform and target new geographic regions.

4 unchanged sentences

In 2022, we acquired certain intangible assets of Blue Hexagon Inc., enabling us to leverage our cloud platform with deep learning AI and machine learning (ML) technologies to uncover behavior patterns including active vulnerability exploitation, identification of advanced network threats, and adaptive risk mitigation across all assets and applications.

In 2021, we acquired certain intangible assets of Kandor Soft Labs Private Ltd.

(TotalCloud), strengthening our cloud security solution by allowing customers to build user-defined workflows for custom policies and execute them on-demand for simplified security and compliance.

Our Customers

16 unchanged sentences

For sales involving a channel partner, the channel partner engages with the prospective customer directly and involves our sales team as needed to assist in developing and closing an order.

When a channel partner secures a sale, we sell the associated subscription to the channel partner who in turn resells the subscription to the customer, with the channel partner earning a fee based on the total value of the order.

When a channel partner secures a sale, we sell the associated

subscription to the channel partner who in turn resells the subscription to the customer, with the channel partner retaining the margin between the price they purchase from us and the price they sell to the end user.

Once the order is completed, we provide these customers with direct access to our solutions and other associated back-office applications, enabling us to establish a direct relationship as part of ensuring customer satisfaction with our solutions.

28 unchanged sentences

We compete with a large and broad array of established and emerging vulnerability management vendors, compliance vendors and data security vendors in a highly fragmented and competitive environment.

We compete with large and small public companies, such as Broadcom (Symantec Enterprise Security), CrowdStrike, Palo Alto Networks, Rapid7, and Tenable Holdings, as well as privately held security providers including Axonius, Checkmarx, Flexera, Invicti, Ivanti, Tanium, HelpSystems (Tripwire), Trustwave Holdings, Veracode and Wiz.

We compete with large and small public companies, such as CrowdStrike, Palo Alto Networks, Rapid7, and Tenable Holdings, as well as privately held security providers including Invicti, Tanium, and Wiz.

We also seek to replace IT, security and compliance solutions that organizations have developed internally.

6 unchanged sentences

We rely on a combination of trade secrets, copyrights, patents and trademarks, as well as contractual protections, to establish and protect our intellectual property rights and protect our proprietary technology.

As of December 31, 2023, we have thirty-six issued patents, which expire from 2029 to 2042, several pending U.S.

As of December 31, 2024, we have 42 issued patents, which expire from 2029 to 2042, several pending U.S.

patent applications and an exclusive license to four U.S.

12 unchanged sentences

As of December 31, 2024, we had 2,400 full-time employees, including 1,144 in research and development, 474 in sales and marketing, 554 in operations and customer support, and 228 in general and administrative.

As of December 31, 2023, approximately 75% of our employees were located outside of the United States, with 66% of our employees located in Pune, India.

As of December 31, 2024, approximately 77% of our employees were located outside of the United States, with 68% of our employees located in India.

None of our U.S.

8 unchanged sentences

Corporate Governance.

Qualys maintains a Compensation and Talent Committee of the Board of Directors to oversee the company’s compensation policies, plans and benefits programs, and overall compensation philosophy.

Qualys maintains a Compensation and Talent Committee of the Board of Directors to oversee our compensation policies, plans and benefits programs, and overall compensation philosophy.

The Committee approves CEO and executive officers’ compensation plans, and reviews, approves, and administers various employee benefit plans, among other duties.

As part of its ongoing review of the performance criteria and compensation of designated key executives, the Compensation and Talent Committee also meets annually with the CEO, the Company’s principal human resources executive, and any other corporate officers as it deems appropriate.

As part of its ongoing review of the performance criteria and compensation of designated key executives, the Compensation and Talent Committee also meets annually with the CEO, our principal human resources executive, and any other corporate officers as it deems appropriate.

Supporting our Team and Community

7 unchanged sentences

Our objective is to continue to improve our hiring, development, advancement, and retention of diverse talent and to foster an inclusive environment.

In addition to having more than 50% of the executive team from underrepresented communities, we are also continuing to improve diversity among our growing workforce, with steady increases in recent years in the percentage of women employed among our global workforce and with over half of our US-based employees from underrepresented communities.

Qualys is focused on building a pipeline of diverse candidates across all our job functions.

We define diversity as underrepresented job seekers, like women, minorities, people with disabilities, older workers, and LGBTQIA+ community members.

In addition to having more than 50% of the executive team from underrepresented communities, we are also continuing to improve diversity among our growing workforce, with over half of our US-based employees from underrepresented communities.

Qualys searches the globe for top talent in an effort to recruit and hire diverse individuals with a variety of skills, experiences, and backgrounds.

Our company holiday calendar includes events and festivals from many regions and religions, and we include diverse cultural initiatives throughout the year to ensure employees feel represented.

Our company holiday calendar includes events and festivals from many regions and religions, and we include diverse cultural initiatives throughout the year.

Promoting a Healthy Work-life Balance.

3 unchanged sentences

Our top priority remains providing support for our employees, partners, and customers.

We are fortunate that the nature of our business allows us to successfully operate in this dynamic hybrid environment.

We believe that our hybrid policy will be a key enabler to support the broad needs of critical on-site to remote employees.

Community Engagement .

We value the communities that support our operations and have several company and employee-led initiatives to support the communities in which we operate.

In 2023, our efforts were centered on advancing education, gender equality, and environmental initiatives.

In 2024, our efforts were centered on advancing education, technology, local communities, and environmental initiatives.

For example, we provided scholarships for women in Science, Technology, Engineering, and Mathematics (STEM), partnered with nonprofit organizations to provide back-to-school backpacks to underserved youth in our community, and donated to food drives and holiday fundraisers to support local families in need, among other initiatives.

Our employees participated in environmental initiatives such as World Environment Day that encourage awareness and action for the protection of the environment, in addition to taking part in local clean-up activities across the world.

Training and Development

1 unchanged sentence

We require our employees and managers to participate in myriad training programs directed at maintaining a harassment-free, diverse, and secure workplace.

With our diverse employee population, we uphold the rights to work in an environment that promotes equal opportunity and prohibits discriminatory practices against race, color, national origin, ancestry, medical condition, religious creed (including religious dress and grooming practices), marital status, registered domestic partner status, sex, sexual orientation, gender identity and expression, genetic characteristics and information, age, veteran status,

or any other protected characteristic.

Creating a respectful workplace and preventing harassment to our employees remain our on-going commitment.

8 unchanged sentences

In addition to formal reviews, our Human Resources team regularly meets with managers to check in with teams and conducts exit interviews globally.

Qualys India also conducts an assimilation program for new employees, through which feedback is collected as employees join the company.

Sustainable Business Operations

1 unchanged sentence

Qualys products, delivered via our multi-tenant cloud platform, enable improved environmental sustainability for our customers.

In particular, our cloud-based solutions minimize the number of physical servers our customers have to deploy within their own environments, reducing energy consumption on their end.

In particular, our cloud-based solutions minimize the number of physical servers our customers

have to deploy within their own environments, reducing energy consumption on their end.

Qualys Cloud Apps, delivering rich content and dashboards visible on any device, also reduce paper and printing costs for our customers.

2 unchanged sentences

We strive to consistently improve how we operate our platforms in energy-efficient networks and data centers as well as pursue sustainability initiatives that reduce energy, waste and materials consumption.

We have 14 multi-tenant platforms across the world, eight of which are in collocated facilities.

We have 14 multi-tenant platforms across the world, six of which are in collocated facilities.

The others are hosted in public cloud environments.

13 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1. Business