What changed in this filing

/stocks — the workspaceLOADING

Item 1. Business

2026-02-20 compared with 2025-02-21 · 47 added, 39 removed, 279 unchanged (24% of the section changed)

9 unchanged sentences

Our cloud platform addresses the growing IT, security and compliance complexities and risks that are amplified by the dissolving boundaries between IT infrastructures and web environments, the rapid adoption of cloud computing, containers and serverless IT models, and the proliferation of geographically dispersed IT assets.

Organizations use our integrated suite of solutions to cost-effectively obtain a unified view of their internal and external IT and OT asset inventory as well as security and compliance posture across globally-distributed IT infrastructures as our solution offers a single platform for information technology, information security, application security, endpoint, developer security and cloud teams.

Organizations use our integrated suite of solutions to cost-effectively obtain a unified view of their internal and external IT and OT asset inventory as well as security and compliance posture across globally-distributed IT infrastructures as our solution offers a single platform for IT, information security, application security, endpoint, developer security and cloud teams.

IT infrastructures are more complex and globally-distributed today than ever before, as organizations of all sizes increasingly rely upon a myriad of interconnected information systems and related assets, such as servers, databases, web applications, routers, switches, desktops, laptops, other physical and virtual infrastructure, and numerous external networks and cloud services.

48 unchanged sentences

Qualys Core Services

Our core services enable our customers to detect vulnerabilities, measure and remediate cyber risk through integrated workflows, management and real-time analysis and reporting inside their organizations, on the perimeter, on endpoints or in the cloud.

Our core services enable customers to detect vulnerabilities, measure and remediate cyber risk through integrated workflows, and deliver real-time analysis and reporting across on-premises environments, network perimeters, endpoints, and cloud deployments.

Our core services constitute dynamic and customizable dashboards and centrally managed, self-updating integrated Cloud Apps, through a natively integrated unified platform.

21 unchanged sentences

The Cloud Apps are self-updating, centrally managed and tightly integrated, and cover a broad range of functionality in areas such as asset management, vulnerability and configuration management, risk remediation, threat detection and response, compliance and cloud security solutions.

We believe that our applications are easy to use and provide our customers with a high level of control because our applications are part of one platform, share a common user interface, utilize the same scanners and agents, access the same collected data, and leverage the same user permissions.

Qualys' TruRisk scoring capabilities are embedded in many of our Cloud Apps, providing

our customers with a quantitative metric of risk to help prioritize cybersecurity threats based on a combination of severity, exploitability, asset criticality, threat intelligence, and business context.

We believe that our applications are easy to use and provide our customers with a high level of control because our applications are part of one platform, share a common user interface, utilize the same scanners and agent, access the same collected data, and leverage the same user permissions.

Our customers can subscribe to one or more of our 20+ Cloud Apps based on their initial needs and expand their subscriptions over time to new areas within their organization or to additional Qualys solutions to develop a more complete understanding of their respective environment's IT, security and compliance posture and remediate cybersecurity risk.

6 unchanged sentences

CSAM includes External Attack Surface Management (EASM), which allows discovery of internet facing unknown assets.

Enterprise TruRisk Management (ETM):

ETM provides a unified view of cyber risk across an organization’s entire attack surface, including on-premises infrastructure, cloud environments, and applications, through a consolidated inventory of assets.

The solution ingests and analyzes security telemetry from Qualys and third-party sensors, applying normalization, deduplication, and correlation of threat signals across more than 25 threat intelligence feeds to enhance risk severity and exploitability assessment.

Leveraging the Qualys TruRisk score, ETM incorporates configurable business and risk parameters to quantify cyber risk in financial terms specific to an organization’s risk tolerance, supporting risk-based prioritization and decision-making.

ETM further enables automated remediation through policy-based response rules and AI-driven workflows that integrate with Qualys’ TruRisk Eliminate solutions, IT service management platforms, and other third-party systems.

These capabilities provide organizations with a vendor-agnostic solution to holistically centralize their response to cyber risk.

Vulnerability and Configuration Management

5 unchanged sentences

By delivering all this in a single app workflow, VMDR automates the entire process and significantly accelerates an organization’s ability to respond to threats, thus preventing possible exploitation across on-premises, endpoints, cloud, containers, and mobile environments.

Web Application Scanning (WAS):

WAS continuously discovers and catalogs web applications – including new and unknown ones – and detects vulnerabilities and misconfigurations in web apps and APIs.

Scaling to thousands of scans, it conducts incisive, thorough and precise testing of browser-based web apps, mobile app backends, and Internet of things (IoT) services.

WAS' powerful API enables integration with other systems and allows teams to detect issues within DevOps environments early in the application development process.

Bundled malware detection capability with WAS uses reputational, behavioral, antivirus, and heuristic analyses to identify and alert on malware infecting a user's websites.

By Integrating WAS with manual testing tools and bug bounty solutions, customers can build a comprehensive web application vulnerability testing program.

Total Application Security (TotalAppSec, TAS):

TAS continuously discovers and catalogs web applications and APIs – including new and unknown ones – and detects vulnerabilities and misconfigurations in web apps and APIs.

Scaling to thousands of scans, it conducts incisive, thorough and precise testing of browser-based web apps, mobile app backends, and APIs.

TAS' powerful API enables integration with other systems and allows teams to detect issues within DevOps environments early in the application development process.

Bundled malware detection capability with TAS uses reputational, behavioral, antivirus, and heuristic analyses to identify and alert on malware infecting a user's websites.

By Integrating TAS with manual testing tools and bug bounty solutions, customers can build a comprehensive application security testing program.

Risk Remediation

2 unchanged sentences

It continuously gathers and uploads telemetry about installed software, open vulnerabilities and missing patches to our cloud platform.

The resulting shared visibility of assets and their posture enables IT and security teams to collaborate using common vulnerability-centric terminology and provides a consistent data set to analyze, prioritize, deploy and verify patches more efficiently.

The resulting shared visibility of assets and their posture enables IT and security teams to collaborate using common vulnerability-

centric terminology and provides a consistent data set to analyze, prioritize, deploy and verify patches more efficiently.

Patch Management is a component of Qualys' TruRisk Eliminate suite of remediation solutions.

TruRusk Eliminate encompasses a broad range of remediation capabilities for organizations when patches are not yet available or feasible to deploy.

TruRisk Eliminate encompasses a broad range of remediation capabilities for organizations when patches are not yet available or feasible to deploy.

Custom Assessment and Remediation (CAR):

6 unchanged sentences

Our highly scalable platform fills the gaps by bringing a new multi-vector approach and the unifying power to EDR, providing vital context and comprehensive visibility to the entire attack chain, from prevention to detection to response.

EDR unifies different context vectors like asset discovery, rich normalized software inventory, end-of-life visibility, vulnerabilities

and exploits, misconfigurations, in-depth endpoint telemetry, and network reachability with a powerful backend to correlate it all for accurate assessment, detection and response.

Policy Compliance (PC):

PC performs automated security configuration assessments on IT systems throughout a network, helping to reduce risk and continuously ensure compliance with internal policies and external regulations.

PC leverages out-of-the-box library content to fast-track compliance assessments using industry-recommended best practices.

PC also provides a centralized, interactive console for specifying baseline standards for different hosts.

By automating requirement evaluation against multiple standards for operating systems, network devices, databases and server applications, PC enables the quick identification of security issues and works to prevent configuration drift.

PC works to prioritize and track remediation and exceptions, while demonstrating a repeatable auditable process for compliance management

EDR unifies different context vectors like asset discovery, rich normalized software inventory, end-of-life visibility, vulnerabilities and exploits, misconfigurations, in-depth endpoint telemetry, and network reachability with a powerful backend to correlate it all for accurate assessment, detection and response.

Policy Audit (PA):

PA automates security configuration assessments across IT systems spanning on-premises, cloud, and hybrid environments.

PA provides real-time visibility into compliance status and helps prevent configuration drift by continuously monitoring against multiple standards for operating systems, network devices, databases, and server applications.

PA includes a robust library of 900+ pre-built policies, 20,000 controls, and 350 supported technologies, covering over 90 regulations and frameworks such as PCI DSS, HIPAA, SOX, and NIST.

With built-in CIS 18 management and actionable remediation guidance, Qualys’ PA solution simplifies compliance by enabling organizations to identify security issues, prioritize fixes, and track exceptions from a single, unified workflow.

By leveraging industry-recommended best practices and a repeatable, auditable process, Qualys’ PA empowers organizations to reduce risk, automate compliance assessments, and ensure adherence to both internal policies and external regulations.

File Integrity Monitoring (FIM):

4 unchanged sentences

Cloud Security

Qualys TotalCloud is a Cloud-Native Application Protection Platform (CNAPP), which provides an integrated suite of security capabilities designed for multi-cloud environments.

TotalCloud (TC):

TC is a Cloud-Native Application Protection Platform (CNAPP), which provides an integrated suite of security capabilities designed for multi-cloud environments.

It provides complete visibility and cyber-risk exposure assessment across cloud assets, enabling continuous discovery and monitoring of the cloud landscape to identify risks and maintain compliance.

With its FlexScan technology, TotalCloud offers comprehensive assessment features that include no-touch, agentless, API, and snapshot-based scanning, along with agent and network-based scanning for thorough vulnerability detection.

With its FlexScan technology, TC offers comprehensive assessment features that include no-touch, agentless, API, and snapshot-based scanning, along with agent and network-based scanning for thorough vulnerability detection.

The TruRisk component allows for a unified risk view, correlating vulnerabilities, security controls, and compliance across resources to prioritize and reduce cyber risks effectively.

For real-time defense, TotalCloud's InstaProtect continuously monitors all cloud assets to detect and protect against evolving and unknown threats.

For real-time defense, TC's InstaProtect continuously monitors all cloud assets to detect and protect against evolving and unknown threats.

Remediation is streamlined through our QFlow technology, which provides no-code, drag-and-drop workflows for efficient vulnerability management.

TotalCloud provides organizations with an all-encompassing solution, delivering fast, agentless, real-time security and compliance across a variety of use cases, including Cloud Workload Protection (CWP), Cloud Detection and Response (CDR), Cloud Security Posture Management (CSPM), Infrastructure as Code (IaC), SaaS Security Posture Management (SSPM), and Kubernetes and Container Security (KCS) to offer organizations a single unified solution for comprehensively securing their cloud and multi-cloud environments.

TC provides organizations with an all-encompassing solution, delivering fast, agentless, real-time security and compliance across a variety of use cases, including Cloud Workload Protection (CWP), Cloud Detection and Response (CDR), Cloud Security Posture Management (CSPM), Infrastructure as Code (IaC), SaaS Security Posture Management (SSPM), Cloud Infrastructure and Entitlement Management (CIEM), and

Kubernetes and Container Security (KCS) to offer organizations a single unified solution for comprehensively securing their cloud and hybrid-cloud environments.

Free Services

23 unchanged sentences

We may explore acquisitions that are complementary to and can expand the functionality of our cloud platform.

We may also seek to acquire development teams to supplement our own personnel and acquire technology to increase the breadth of our cloud-based IT, security and compliance solutions.

In 2022, we acquired certain intangible assets of Blue Hexagon Inc., enabling us to leverage our cloud platform with deep learning AI and machine learning (ML) technologies to uncover behavior patterns including active vulnerability exploitation, identification of advanced network threats, and adaptive risk mitigation across all assets and applications.

We may also seek to acquire development teams to supplement our own personnel and acquire technology to increase the breadth of our cloud-based IT, security and compliance solutions, deep learning AI, and machine learning (ML) technologies to uncover behavior patterns including active vulnerability exploitation, identification of advanced network threats, and adaptive risk mitigation across all assets and applications.

Our Customers

4 unchanged sentences

We sell our solutions to enterprises and government entities primarily through our field sales force and to small and medium-sized businesses through our inside sales force.

We generate a significant portion of sales through our channel partners, including managed security service providers, value-added resellers and consulting firms in the United States and internationally.

We generate a significant portion of sales through our channel

partners, including managed security service providers, value-added resellers and consulting firms in the United States and internationally.

Sales and Marketing

9 unchanged sentences

For sales involving a channel partner, the channel partner engages with the prospective customer directly and involves our sales team as needed to assist in developing and closing an order.

When a channel partner secures a sale, we sell the associated

subscription to the channel partner who in turn resells the subscription to the customer, with the channel partner retaining the margin between the price they purchase from us and the price they sell to the end user.

When a channel partner secures a sale, we sell the associated subscription to the channel partner who in turn resells the subscription to the customer, with the channel partner retaining the margin between the price they purchase from us and the price they sell to the end user.

Once the order is completed, we provide these customers with direct access to our solutions and other associated back-office applications, enabling us to establish a direct relationship as part of ensuring customer satisfaction with our solutions.

17 unchanged sentences

In addition to our development teams, we also built a sophisticated research team focused on identifying threats and developing signatures for vulnerabilities and compliance checks so that we can provide our customers with daily updates and enable them to scan their assets for the latest threats.

We conduct our research and development in the United States, France and India, which gives us access to some of the best research and engineering talent in the world.

We conduct our research and development

in the United States, France and India, which gives us access to some of the best research and engineering talent in the world.

Our focus remains to attract engineering talent as we continue to add new solutions and improve existing ones.

8 unchanged sentences

We compete with a large and broad array of established and emerging vulnerability management vendors, compliance vendors and data security vendors in a highly fragmented and competitive environment.

We compete with large and small public companies, such as CrowdStrike, Palo Alto Networks, Rapid7, and Tenable Holdings, as well as privately held security providers including Invicti, Tanium, and Wiz.

We also seek to replace IT, security and compliance solutions that organizations have developed internally.

As we continue to extend our cloud platform’s functionality by further developing IT, security and compliance solutions, such as Cybersecurity Asset Management and Patch Management, we expect to face additional competition in these new markets.

As we continue to extend our cloud platform’s functionality by further developing IT, security and compliance solutions, such as Cybersecurity Asset Management, Patch Management, and Enterprise TruRisk Management, we expect to face additional competition in these new markets.

Our competitors may also attempt to further expand their presence in the IT, security and compliance market and compete more directly against one or more of our solutions.

7 unchanged sentences

The inbound license remains in effect until the licensed patents are no longer enforceable, unless the applicable license agreement is first terminated by us or terminated by the licensor for a breach of the agreement or if we undergo certain bankruptcy events.

The licenses are currently exclusive and will remain exclusive so long as we make an appropriately-timed written election and pay an annual fixed royalty for ten years thereafter.

These exclusive licenses are subject to the licensor’s reservation of certain r ights in the patents and subject to the U.S.

29 unchanged sentences

Diversity and Inclusion.

We are proud to be a leader in the promotion and practice of diversity and inclusion.

We take pride in our cultural diversity with offices and employees all over the world.

4 unchanged sentences

Promoting a Healthy Work-life Balance.

Qualys aims to maintain a healthy work-life balance and provide resources to support our employees’ mental and physical well-being.

During 2022, our workforce gradually transitioned into a hybrid work schedule, which resulted in a significant portion of our workforce working either in-person on a part-time basis, or remotely on a permanent basis.

Qualys aims to maintain a healthy work-life balance and provide resources to support our employees’ well-being.

During 2022, our workforce gradually transitioned into a hybrid work schedule, which resulted in a significant portion of our workforce working either in-person on a part-time basis, or remotely.

During 2025, we continued to offer this hybrid work schedule to our workforce.

3 unchanged sentences

In 2025, our efforts were centered on advancing education, technology, local communities, and environmental initiatives.

For example, we provided scholarships for women in Science, Technology, Engineering, and Mathematics (STEM), partnered with nonprofit organizations to provide back-to-school backpacks to underserved youth in our community, and donated to food drives and holiday fundraisers to support local families in need, among other initiatives.

Our employees participated in environmental initiatives such as World Environment Day that encourage awareness and action for the protection of the environment, in addition to taking part in local clean-up activities across the world.

For example, we provided training, mobility solutions, and job placements for people with disabilities, established a Clinic on Wheels program and brought doctors, medicines, and essential care to areas where access is limited, partnered with nonprofit organizations to provide back-to-school backpacks and computer cyber labs to educate youth in our community, supported by a coursework developed by our own employees, and donated to food drives and holiday fundraisers to support local families in need, among other initiatives.

Our employees further participated in environmental

initiatives such as World Environment Day that encourage awareness and action for the protection of the environment, in addition to taking part in local clean-up activities across the world.

Training and Development

15 unchanged sentences

Qualys products, delivered via our multi-tenant cloud platform, enable improved environmental sustainability for our customers.

In particular, our cloud-based solutions minimize the number of physical servers our customers

have to deploy within their own environments, reducing energy consumption on their end.

In particular, our cloud-based solutions minimize the number of physical servers our customers have to deploy within their own environments, reducing energy consumption on their end.

Qualys Cloud Apps, delivering rich content and dashboards visible on any device, also reduce paper and printing costs for our customers.

18 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1. Business