What changed in this filing

/stocks — the workspaceLOADING

Item 1. Business

2021-02-22 compared with 2020-02-21 · 121 added, 72 removed, 263 unchanged (42% of the section changed)

10 unchanged sentences

IT infrastructures are more complex and globally-distributed today than ever before, as organizations of all sizes increasingly rely upon a myriad of interconnected information systems and related IT assets, such as servers, databases, web applications, routers, switches, desktops, laptops, other physical and virtual infrastructure, and numerous external networks and cloud services.

In this environment, new and evolving digital technologies intended to improve organizations’ operations can also increase vulnerability to cyber-attacks, which can expose sensitive data, damage IT and physical infrastructures, and result in serious financial or reputational consequences.

In this environment, new and evolving digital technologies intended to improve organizations’

operations can also increase vulnerability to cyber-attacks, which can expose sensitive data, damage IT and physical infrastructures, and result in serious financial or reputational consequences.

In addition, the rapidly increasing amount of data and devices in IT environments makes it more difficult to identify and remediate vulnerabilities in a timely manner.

2 unchanged sentences

We designed our Qualys Cloud Platform to transform the way organizations secure and protect their IT infrastructures and applications.

Our cloud platform offers an integrated suite of solutions that automates the lifecycle of asset discovery and management, security assessments, and compliance management for an organization’s IT infrastructure and assets, whether such infrastructure and assets reside inside the organization, on their network perimeter, on endpoints or in the cloud.

Since inception, our solutions have been designed to be delivered through the cloud and to be easily and rapidly deployed on a global scale, enabling faster implementation and lower total cost of ownership than traditional on-premises enterprise software products.

2 unchanged sentences

No hardware to buy or manage.

There is no infrastructure or software to buy and maintain thus reducing our customers’ operating costs;

There is no infrastructure or software to buy and maintain thus reducing our customers’

operating costs;

all services are accessible in the cloud via web interface.

17 unchanged sentences

These Cloud Apps address and include:

Vulnerability Management (VM), Threat Protection (TP), Continuous Monitoring (CM), Patch Management (PM), Indication of Compromise (IOC);

Compliance Monitoring:

Policy Compliance (PC), PCI Compliance (PCI), File Integrity Monitoring (FIM), Security Configuration Assessment (SCA), Security Assessment Questionnaire (SAQ), Out of-Band Configuration Assessment (OCA);

Vulnerability Management (VM), Vulnerability Management, Detection and Response (VMDR), Threat Protection (TP), Continuous Monitoring (CM), Patch Management (PM), Multi-Vector Endpoint Detection and Response (EDR), Indication of Compromise (IOC), Certificate Assessment (CRA);

Policy Compliance (PC), Security Configuration Assessment (SCA), PCI Compliance (PCI), File Integrity Monitoring (FIM), Security Assessment Questionnaire (SAQ), Out of-Band Configuration Assessment (OCA); 

Web Application Security:

Web Application Scanning (WAS), Web Application Firewall (WAF);

Global IT Asset Management:

Asset Management:

Global IT Asset Inventory (AI), CMDB Sync (SYN), Certificate Inventory (CRI);

Cloud/Container Security:

Cloud Inventory (CI), Cloud Security Assessment (CSA), Container Security

Cloud Inventory (CI), Cloud Security Assessment (CSA), Container Security (CS).

We provide our solutions through a software-as-a-service model, primarily with renewable annual subscriptions.

1 unchanged sentence

We generally invoice our customers for the entire subscription amount at the start of the subscription term, and the invoiced amounts are treated as deferred revenues and are recognized ratably over the term of each subscription.

We continue to experience significant revenue growth from our existing customers as they renew and purchase additional subscriptions, as well as from the addition of new customers to our cloud platform.

O ur Qualys Cloud Platform is currently used by over 15,700 customers, including active subscribers of our free services, in more than 133 countries, including a majority of each of the Forbes Global 100 and Fortune 100.

Our revenues increased to $321.6 million in 2019 from $278.9 million in 2018 and $230.8 million in 2017 .

Our VM solutions (including VM, CM, TP, Cloud Agent for VM, CS, CRI, allocated scanner revenue and Qualys Private Cloud Platform) have provided a majority of our revenues to date, representing 73% of total revenue in 2019, and 74% of total revenues in each of 2018 and 2017 .

Our cloud platform consists of a suite of IT security, compliance monitoring, web application security, global IT asset management and cloud and container security solutions, which we refer to as the Qualys Cloud Apps, that leverages our shared and extensible core services and our highly scalable multi-tenant cloud infrastructure.

We continue to experience revenue growth from our existing customers as they renew and purchase additional subscriptions, as well as from the addition of new customers to our cloud platform.

Our Qualys Cloud Platform is currently used by over 19,000 customers, including active subscribers of our free services, in more than 130 countries, including a majority of each of the Forbes Global 100 and Fortune 100.

Our revenues increased to $363.0 million in 2020 from $321.6 million in 2019 and $278.9 million in 2018. 

Our cloud platform consists of a suite of IT security, compliance, web application security, asset management and cloud and container security solutions, which we refer to as the Qualys Cloud Apps, that leverages our shared and extensible core services and our highly scalable multi-tenant cloud infrastructure.

We also provide open application program interfaces, or APIs, and other developer tools that allow third parties to embed our technology into their solutions and build applications on our cloud platform.

13 unchanged sentences

Our core services enable integrated workflows, management and real-time analysis and reporting across all of our IT, security and compliance solutions for our customers inside their organizations, on the perimeter, on endpoints or in the cloud.

Our core services constitute dynamic and customizable dashboards and centrally managed, self-updating integrated Cloud Apps, through what we call a “single-pane-of-glass” user interface.

Our core services constitute dynamic and customizable dashboards and centrally managed, self-updating integrated Cloud Apps, through what we call a “single-pane-of-glass”

user interface.

Our interactive, dynamic dashboards and cloud platform allow our customers to aggregate and correlate all of their IT, security and compliance data in one place, drill down into details, and generate reports customized for different audiences.

Our cloud platform’s powerful Elasticsearch clusters enable customers to instantly find detailed data on any asset.

Our core services include:

15 unchanged sentences

Qualys Cloud Apps

Many organizations have an array of heterogeneous point tools that do not interoperate well and are difficult and costly to maintain and integrate, making it difficult for Chief Information Officers (CIOs) and Chief Information Security Officers (CISOs) to obtain a single, unified view of their organization’s security and compliance posture.

The Qualys Cloud Platform and its Cloud Apps help organizations escape this tool-fragmentation dilemma by drastically simplifying their security stacks and regaining unimpeded visibility across their IT environment.

The Cloud Apps are self-updating, centrally managed and tightly integrated, and cover a broad range of functionality in areas such as IT, security, compliance monitoring, web application security, global IT asset management and cloud and container security solutions.

The Cloud Apps are self-updating, centrally managed and tightly integrated, and cover a broad range of functionality in areas such as IT, security, compliance, web application security, asset management and cloud and container security solutions.

From inception through December 31, 2019, we have added the following Cloud Apps:

VM, PC, PCI, WAS, WAF, CM, SYN, SAQ, TP, FIM, IOC, AI , SCA, CS, CI, CSA, and CRI.

In 2019, we introduced Patch Management (PM) and a free version of Global IT Asset Discovery and Inventory.

VM, PC, PCI, WAS, WAF, CM, SYN, SAQ, TP, FIM, IOC, AI, SCA, CS, CI, CSA, CRI, CRA, OCA, PM, and a free version of AI.

In 2020, we introduced VMDR and EDR.

We believe that our applications are easy to use and provide our customers with a high level of control because our applications are part of one platform, share a common user interface, utilize the same scanners and agents, access the same collected data, and leverage the same user permissions.

2 unchanged sentences

Enterprise for large enterprises, Express for medium-sized businesses, Express Lite for small-sized businesses, and Consulting Edition for consultants, consulting organizations and Managed Service Providers (MSPs).

Many of our customers use multiple Cloud Apps to develop a more complete understanding of their respective environment’s IT, security and compliance posture.

The Qualys Cloud Platform currently provides the following Cloud Apps to our customers:

Vulnerability Management (VM):

VM is an industry leading and award-winning solution that automates network auditing and vulnerability management across an organization, including network discovery and mapping, asset management,

vulnerability reporting and remediation tracking.

VM is an industry leading and award-winning solution that automates network auditing and vulnerability management across an organization, including network discovery and mapping, asset management, vulnerability reporting and remediation tracking.

Driven by our comprehensive knowledge base of known vulnerabilities, VM enables cost-effective protection against vulnerabilities without substantial resource deployment.

Vulnerability Management, Detection and Response (VMDR):

VMDR enables organizations to automatically discover every asset in their environment, including unmanaged assets appearing on the network, inventory all hardware and software, and classify and tag critical assets.

VMDR continuously assesses these assets for the latest vulnerabilities and applies the latest threat intel analysis to prioritize actively exploitable vulnerabilities.

Finally, VMDR automatically detects the latest superseding patch for the vulnerable asset and easily deploys it for remediation.

By delivering all this in a single app workflow, VMDR automates the entire process and significantly accelerates an organization’s ability to respond to threats, thus preventing possible exploitation.

Threat Protection (TP):

2 unchanged sentences

TP continuously correlates external threat information against a customer's vulnerabilities and IT asset inventory, so customers know which threats pose the greatest risk to their organization at any given time.

As Qualys engineers continuously validate and rate new threats from internal and external sources, TP’s live feed displays the latest vulnerability disclosures and maps them to customers’ impacted IT assets.

As Qualys engineers continuously validate and rate new threats from internal and external sources, TP’s live feed displays the latest vulnerability disclosures and maps them to customers’

impacted IT assets.

Customers can see the assets affected by each threat, and drill down into details.

Continuous Monitoring (CM):

Built on top of VM, CM is a next-generation cloud service that can detect network threats and unexpected changes before they turn into breaches.

Built on top of VM, CM is a next-generation cloud service that can detect network threats and unexpected changes before they turn into breaches.

Whenever CM spots an anomaly in a network, it immediately sends targeted, informative alerts to the right people for each situation and each machine.

3 unchanged sentences

It continuously gathers and uploads telemetry about installed software, open vulnerabilities and missing patches to the Qualys Cloud Platform.

The resulting shared visibility of assets and their posture enables IT and security teams to collaborate using common vulnerability-centric terminology and provides a consistent data set to analyze, prioritize, deploy and verify patches more efficiently.

Multi-Vector Endpoint Detection and Response (EDR):

Traditional endpoint detection and response solutions focus only on endpoint activity to detect attacks.

As a result, they lack the full context to analyze attacks accurately.

This leads to an incomplete picture and a high rate of false positives and negatives, requiring organizations to use multiple point solutions and large incident response teams.

Qualys fills the gaps by bringing a new multi-vector approach and the unifying power of its highly scalable Cloud Platform to EDR, providing vital context and comprehensive visibility to the entire attack chain, from prevention to detection to response.

EDR unifies different context vectors like asset discovery, rich normalized software inventory, end-of-life visibility, vulnerabilities and exploits, misconfigurations, in-depth endpoint telemetry, and network reachability with a powerful backend to correlate it all for accurate assessment, detection and response.

Indication of Compromise (IOC):

3 unchanged sentences

IOC 2.0, which was released in 2019, now provides enhanced attack detection, investigation, and response capabilities for security analysts, incident responders, and managed security service providers.

Compliance Monitoring

Certificate Assessment (CRA):

CRA assesses digital certificates and Transport Layer Security (TLS) configurations.

CRA generates certificate instance grades using a straightforward methodology that allows administrators to assess often overlooked server SSL/TLS configurations without having to become SSL experts.

It also identifies out-of-policy certificates with weak signatures or key length and shows how many unique Certificate Authorities were found in the environment and how many certificates each one issued.

Policy Compliance (PC):

2 unchanged sentences

PC also provides a centralized, interactive console for specifying baseline standards for different hosts.

By automating requirement evaluation against multiple standards for OSes, network devices, databases and server applications, PC enables the quick identification of security issues and works to prevent configuration drift.

By automating requirement evaluation against multiple standards for operating systems, network devices, databases and server applications, PC enables the quick identification of security issues and works to prevent configuration drift.

PC works to prioritize and track remediation and exceptions, while demonstrating a repeatable auditable process for compliance management.

Security Configuration Assessment (SCA):

SCA provides automatic assessment of IT assets’

configurations using the latest Center for Internet Security (CIS) Benchmarks for operating systems, databases, applications and network devices.

SCA provides intuitive workflows for assessing, monitoring, reporting and remediating security-related configuration issues.

SCA’s CIS assessments are provided via a web-based user interface and delivered from the Qualys Cloud Platform, enabling centralized management with minimal deployment overhead.

SCA users can automatically create downloadable reports and view dashboards.

PCI Compliance (PCI):

8 unchanged sentences

FIM helps customers to comply with change control policy enforcement and change monitoring requirements.

Security Configuration Assessment (SCA):

SCA provides automatic assessment of IT assets’ configurations using the latest Center for Internet Security (CIS) Benchmarks for operating systems, databases, applications and network devices.

SCA provides intuitive workflows for assessing, monitoring, reporting and remediating security-related configuration issues.

SCA’s CIS assessments are provided via a web-based user interface and delivered from the Qualys Cloud Platform, enabling centralized management with minimal deployment overhead.

SCA users can automatically create downloadable reports and view dashboards.

Security Assessment Questionnaire (SAQ):

SAQ automates and streamlines third-party and internal risk assessment processes, obviating the need to perform such processes manually via email and spreadsheets.

SAQ easily designs surveys

to assess procedural controls of IT and security policies and practices.

SAQ easily designs surveys to assess procedural controls of IT and security policies and practices.

SAQ automates the launch and monitoring of assessment campaigns, making the process agile, accurate, comprehensive, centralized, scalable and uniform across an organization.

1 unchanged sentence

Out-of-Band Configuration Assessment (OCA):

The OCA sensor and Cloud App allows customers to achieve complete visibility of all known IT infrastructure by pushing vulnerability and configuration data to the Qualys Cloud Platform from systems that are otherwise difficult to assess, such as highly locked-down systems, systems on disconnected or “air gap” networks, or in environments that are highly sensitive to scans.

OCA’s expanded data collection approach significantly broadens the types of technologies supported by the Qualys Cloud Platform and provides deeper assessment of configuration so that customers have better visibility into potentially critical vulnerabilities and misconfigurations across their entire environment.

networks, or in environments that are highly sensitive to scans.

Web Application Security

Web Application Scanning (WAS):

WAS continuously discovers and catalogs web applications – including new and unknown ones – and detects vulnerabilities and misconfigurations in web apps and APIs.

WAS continuously discovers and catalogs web applications –

including new and unknown ones –

and detects vulnerabilities and misconfigurations in web apps and APIs.

Scaling to thousands of scans, it conducts incisive, thorough and precise testing of browser-based web apps, mobile app backends, and Internet of things (IoT) services.

8 unchanged sentences

Customers scan web apps with WAS, deploy one-click virtual patches if needed in WAF, and manage it all from a centralized cloud-based portal.

WAF can be deployed in minutes on prem or in the cloud, as a virtual machine or a container, supports load-balancing as well as Transport Layer Security (TLS) offloading, and does not require special hardware.

Global IT Asset Management

WAF can be deployed in minutes on prem or in the cloud, as a virtual machine or a container, supports load-balancing as well as TLS offloading, and does not require special hardware.

Asset Management

Global IT Asset Inventory (AI):

1 unchanged sentence

Asset discovery and inventory collection is done through a combination of Qualys network scanners, Cloud Agents and passive scanners, which together collect comprehensive data from on-premises or cloud infrastructure as well as remote endpoints.

In order to create consistent and uniform asset data, AI normalizes raw discovery data to standardize every manufacturer name, product name, model and software version using Qualys’ ever-evolving technology catalog as a reference.

In order to create consistent and uniform asset data, AI normalizes raw discovery data to standardize every manufacturer name, product name, model and software version using Qualys’

ever-evolving technology catalog as a reference.

This catalog automatically extends IT asset inventory with non-discoverable metadata such as hardware and software release dates, end of life dates, and license categories.

2 unchanged sentences

CMDB Sync (SYN):

SYN is a certified application that synchronizes Qualys AI data with ServiceNow’s Configuration Management system.

Device changes are immediately transmitted to the Qualys Cloud Platform and then synchronized with ServiceNow.

9 unchanged sentences

CI delivers continuous visibility into public cloud accounts.

In one single-pane view, it inventories virtual machines, storage buckets, databases, security groups, Access Control Lists (ACLs), Elastic Load Balancers (ELBs) and users – across all regions, multiple accounts and multiple cloud platforms.

CI continuously tracks assets and enables users to quickly understand the topography of their cloud environment and uncover the root cause of incidents.

Cloud Security Assessment (CSA):

CSA provides a continuous assessment of the security posture of an organization’s cloud resources against misconfigurations, malicious behavior, and nonstandard deployments.

CSA correlates host vulnerabilities and compliance data into intelligent insights which allow users to quickly detect risks throughout their complex cloud environments.

With CSA, users gain real-time visibility into their up-to-date security and compliance posture of public clouds in one single-pane view.

In one single-pane view, it inventories virtual machines, storage buckets, databases, security groups, Access Control Lists (ACLs), Elastic Load Balancers (ELBs) and users –

across all regions, multiple accounts and multiple cloud platforms.

CI continuously tracks assets and enables users to quickly understand the topography of their cloud environment and uncover the root cause of incidents.

Cloud Security Assessment (CSA): CSA provides a continuous assessment of the security posture of an organization’s cloud resources against misconfigurations, malicious behavior, and nonstandard deployments.

CSA evaluates resources against CIS benchmarks and best practices to identify misconfigured storage buckets, security groups, Relational Database Service, exposing data and the resource for public exploitation. CSA correlates host vulnerabilities and compliance data into intelligent insights which allow users to quickly detect risks throughout their complex cloud environments.

With CSA, users gain real-time visibility into their up-to-date security and compliance posture of public clouds in one single-pane view.

Container Security (CS):

CS delivers container-native visibility and protection throughout the entire lifecycle of containerized applications.

It incorporates scanning of container images for software composition and enforcement of hardened container stack configurations for continuous policy compliance, whether the images are on the build machines, in the container registries or in the runtime cluster nodes.

CS uses a unique 'layered-in' approach to provide deep visibility into all the application activities and automatically creates a behavior profile, which is enforced on each container for runtime protection.

By integrating with CI/CD pipelines and toolchains, CS enables DevSecOps processes and transparent enforcement of security and compliance without compromising the speed and agility of containers and serverless deployment models.

This leads to significant cost benefits for enterprises compared to certain legacy security solutions.

It incorporates scanning of container images for software composition and enforcement of hardened container stack configurations for continuous policy compliance, whether the images are on the build machines, in the container registries or in the runtime cluster nodes.

CS uses a unique 'layered-in' approach to provide deep visibility into all the application activities and automatically creates a behavior profile, which is enforced on each container for runtime protection.

By integrating with continuous integration and continuous delivery pipelines and toolchains, CS enables DevSecOps processes and transparent enforcement of security and compliance without compromising the speed and agility of containers and serverless deployment models.

This leads to significant cost benefits for enterprises compared to certain legacy security solutions.

Free Services

We also offer organizations of all sizes free security and compliance services based on the Qualys Cloud Platform:

Qualys Global IT Asset Discovery and Inventory app automatically creates a continuous, real-time inventory of known and unknown assets throughout a user's global IT footprint across on-premises, endpoints, multi-cloud, mobile, containers, OT and IoT.

The app also automatically normalizes and categorizes assets to ensure clean, reliable, and consistent data.

12 unchanged sentences

Continue to innovate and enhance our cloud platform and suite of solutions.

We intend to continue to make significant investments in research and development to extend our cloud platform’s functionality by developing new security solutions and capabilities and further enhancing our existing suite of solutions.

From inception through December 31, 2019, we have added the following Cloud Apps:

VM, PCI, PC, WAS, WAF, CM, SYN, SAQ, TP, FIM, IOC, AI , SCA, CS, CI, CSA, and CRI.

In 2019, we introduced Patch Management (PM) and a free version of Global IT Asset Discovery and Inventory.

VM, PC, PCI, WAS, WAF, CM, SYN, SAQ, TP, FIM, IOC, AI, SCA, CS, CI, CSA, CRI, PM, and a free version of AI.

In 2020, we introduced VMDR and EDR.

Expand the use of our suite of solutions by our large and diverse customer base.

10 unchanged sentences

We may explore acquisitions that are complementary to and can expand the functionality of our cloud platform.

We may also seek to acquire development teams to supplement our own personnel and acquire technology to increase the breadth of our cloud-based IT, security and compliance solutions.

We may also seek to acquire development teams to supplement our own personnel and acquire technology to increase the breadth of our cloud-based IT, security and compliance solutions. In 2020, we acquired certain intangible assets of Spell Security Private Limited (Spell Security), expanding Qualys’

endpoint behavior detection, threat hunting, malware research and multi-layered response capabilities for our EDR application.

In 2019, we acquired the software assets of Adya Inc.

13 unchanged sentences

Our global sales force is organized into a field sales team, which focuses on enterprises, generally including organizations with more than 5,000 employees, and an inside sales team, which focuses on small to medium-sized businesses, which generally include organizations with less than 5,000 employees.

Both our field and inside sales teams are divided into three geographic regions, including the Americas;

Both our field and inside sales teams are divided into three geographic regions, the Americas;

Europe, Middle East and Africa;

and Asia-Pacific.

We also further segment each of our sales teams into groups that focus on adding new customers or managing relationships with existing customers.

Our channel partners maintain relationships with their customers throughout the territories in which they operate and provide their customers with services and third-party solutions to help meet those customers’ evolving security and compliance requirements.

We also further assign each of our sales teams into groups that focus on adding new customers or managing relationships with existing customers.

evolving security and compliance requirements.

As such, these partners offer our IT, security and compliance solutions in conjunction with one or more of their own products or services and act as a conduit through which we can connect with these prospective customers to offer our solutions.

29 unchanged sentences

Manufacturing Agreement

Our physical appliances are provided by SYNNEX Corporation (SYNNEX), pursuant to a manufacturing services agreement dated March 1, 2011.

Under this agreement, SYNNEX manufactures, assembles and tests our physical scanner appliances.

This agreement is automatically renewed annually, unless terminated (i) at any time upon the mutual written agreement of us and SYNNEX, (ii) by either party upon 90 days or more written notice, (iii) upon written notice, subject to applicable cure periods, if the other party has materially breached its obligations under the agreement or (iv) by either party upon the other party seeking an order for relief under the bankruptcy laws of the United States or similar laws of any other jurisdiction, a composition with or assignment for the benefit of creditors, or dissolution or liquidation.

Our physical appliances are provided by SYNNEX Corporation (SYNNEX), pursuant to a manufacturing services agreement dated March 1, 2011. Under this agreement, SYNNEX manufactures, assembles and tests our physical scanner appliances.

This agreement is automatically renewed annually, unless terminated (i) at any time upon the mutual written agreement of us and SYNNEX, (ii) by either party upon 90 days or more written notice, (iii) upon written notice, subject to applicable cure periods, if the other party has materially breached its obligations under the agreement or (iv) by either party upon the other party seeking an order for relief under the bankruptcy laws of the United States or similar laws of any other jurisdiction, a composition with or assignment for the benefit of creditors, or dissolution or liquidation.

Data Center Agreements

Our data center operations are provided by large third-party data center vendors and are located in the United States, Canada, Switzerland, the Netherlands and India.

Our data center operations are provided by large third-party data center vendors and are located in the United States, Canada, Switzerland, the Netherlands, United Arab Emirates and India.

Our data center agreements have varying terms through 2025.

1 unchanged sentence

We compete with a large and broad array of established and emerging vulnerability management vendors, compliance vendors and data security vendors in a highly fragmented and competitive environment.

We compete with large and small public companies, such as Belden (Tripwire), Broadcom (Symantec Enterprise Security), CrowdStrike, F5 Networks, FireEye, Forescout Technologies, International Business Machines, Micro Focus International, Rapid7, Palo Alto Networks, and Tenable Holdings, as well as privately held security providers including Barracuda Networks, BeyondTrust Software, Flexera, Imperva, McAfee, Tanium, Trustwave Holdings, Venafi, and Veracode.

We compete with large and small public companies, such as Belden (Tripwire), Broadcom (Symantec Enterprise Security), CrowdStrike, F5 Networks, FireEye, International Business Machines, McAfee, Micro Focus International, Palo Alto Networks, Rapid7, Tenable Holdings and VMware, as well as privately held security providers including Barracuda Networks, BeyondTrust Software, Flexera, Forescout Technologies, Imperva, Tanium, Trustwave Holdings, Venafi, and Veracode.

We also seek to replace IT, security and compliance solutions that organizations have developed internally.

As we continue to extend our cloud platform’s functionality by further developing IT, security and compliance solutions, such as web application scanning and firewalls, we expect to face additional competition in these new markets.

Our competitors may also attempt to further expand their presence in the IT, security and compliance market and compete more directly against one or more of our solutions.

4 unchanged sentences

We rely on a combination of trade secrets, copyrights, patents and trademarks, as well as contractual protections, to establish and protect our intellectual property rights and protect our proprietary technology.

As of December 31, 2019, we have eighteen issued patents, several pending U.S.

As of December 31, 2020, we ha ve twenty issue d patents, several pending U.S.

patent applications and an exclusive license to four U.S.

2 unchanged sentences

The licenses are currently exclusive and will remain exclusive so long as we make an appropriately-timed written election and pay an annual fixed royalty for ten years thereafter.

These exclusive licenses are subject to the licensor’s reservation of certain rights in the patents and subject to the U.S.

government’s reserved rights in the technology.

These exclusive licenses are subject to the licensor’s reservation of certain rights in the patents and subject to the U.S.

government’s reserved rights in the technology.

We have a number of registered and unregistered trademarks.

3 unchanged sentences

Any of these third parties might make a claim of infringement against us at any time.

Human Capital Resources

We take a holistic approach to our human capital management strategy, striving to create a culture where talented people want to come to work, develop their careers, become leaders, and make a difference for all our stakeholders and communities.

Doing the right thing for our people, our communities and our environment upholds the trust of our customers, partners, employees, and stockholders, enabling us to grow our business profitably and meet the diverse needs of our constituents.

As of December 31, 2020, we had 1,498 full-time employees, including 749 in research and development, 298 in sales and marketing, 310 in operations and customer support, and 141 in general and administrative.

As of December 31, 2019 , we had 389 employees in the United States and 900 employees internationally.

As of December 31, 2020, approximately 73% of our employees were located outside the United States, with 63% of our employees located in Pune, India.

None of our U.S.

employees are covered by collective bargaining agreements.

Employees in certain European countries have collective bargaining arrangements at the national level.

Employees in certain European countries and Brazil have collective bargaining arrangements at the national level.

We believe our employee relations are good, and we have not experienced any work stoppages.

As of December 31, 2019, approximately 70% of our employees were located outside the United States, with 61% of our employees located in Pune, India.

Diversity and Inclusion

We are proud to be a leader in the promotion and practice of diversity and inclusion.

In addition to having offices and employees all over the world, we take pride in our cultural diversity.

Qualys searches the globe for top talent in an effort to recruit and hire diverse individuals with a variety of skills, experiences, and backgrounds.

Our objective is to continue to improve our hiring, development, advancement, and retention of diverse talent and to foster an inclusive environment.

Our board of directors and executive team are highly diverse.

Three out of our current eight member board of directors are women, and the board seeks to identify strong candidates who provide a wide range of perspectives, competencies, and knowledge to complement the board’s skills, diversity and experiences.

Further, our executive team is gender and ethnically diverse, with more than 50% of the executive team from underrepresented communities.

Health and Safety

We recognize that a healthy environment and safe workplaces are critical to our business, strategy, and communities.

We address environmental issues in an integrated manner to encompass protection of the environment as well as the health and safety of our workforce.

For example, in response to COVID-19 and the significant increases in remote workforces in March 2020, we mandated a work from home policy to protect our employees and our communities.

We also released a free cloud-based remote endpoint protection solution for 60 days that allowed IT and security teams to protect the computers of remote employees and support the health and safety of our communities.

With the ongoing COVID-19 pandemic, our workforce continues to operate remotely, and our top priority remains providing support for our employees, partners, and customers.

We are fortunate that the nature of our business allows us to successfully operate in this dynamic work-from-home environment.

We have been able to successfully adapt to the current challenges and deliver results despite the pandemic while continuing to protect the health and safety of our workforce and customers.

We require our employees and managers to participate in myriad training programs directed at maintaining a harassment-free, diverse, and secure workplace.

With our diverse employee population, we uphold the rights to work in an environment that promotes equal opportunity and prohibits discriminatory practices against race, color, national origin, ancestry, medical condition, religious creed (including religious dress and grooming practices), marital status, registered domestic partner status, sex, sexual orientation, gender identity and expression, genetic characteristics and information, age, veteran status, or any other protected characteristic.

Creating a respectful workplace and preventing harassment to our employees remain our on-going commitment.

Compensation and Benefits

We provide robust compensation and benefits to our employees.

In addition to competitive base salaries, all qualified employees are eligible for variable pay and equity awards.

To support the health and wellness of our workforce, Qualys offers premium health coverage with minimal out-of-pocket contributions for our global employees.

Training and Development

We have experience with managing and developing a rapidly growing employee base.

We believe every employee makes a difference, so we empower them in their roles and support them for maximum professional growth.

We assist employees in achieving their career goals by helping them improve their skillsets and transition to other challenging roles.

To support career growth inside and outside the Company, Qualys offers free self-paced or instructor-led certified training on core Qualys topics giving employees and non-employees an opportunity to achieve certifications.

Available Information

6 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1. Business