What changed in this filing

/stocks — the workspaceLOADING

Item 1. Business

2022-02-22 compared with 2021-02-22 · 54 added, 56 removed, 328 unchanged (25% of the section changed)

42 unchanged sentences

These Cloud Apps address and include:

Vulnerability Management (VM), Vulnerability Management, Detection and Response (VMDR), Threat Protection (TP), Continuous Monitoring (CM), Patch Management (PM), Multi-Vector Endpoint Detection and Response (EDR), Indication of Compromise (IOC), Certificate Assessment (CRA);

Vulnerability Management (VM),  

Vulnerability Management, Detection and Response (VMDR), Threat Protection (TP), Continuous Monitoring (CM), Patch Management (PM), Multi-Vector Endpoint Detection and Response (EDR), Certificate Assessment (CRA), SaaS Detection and Response (SaaSDR), Secure Enterprise Mobility (SEM);

Policy Compliance (PC), Security Configuration Assessment (SCA), PCI Compliance (PCI), File Integrity Monitoring (FIM), Security Assessment Questionnaire (SAQ), Out of-Band Configuration Assessment (OCA); 

2 unchanged sentences

Asset Management:

Global IT Asset Inventory (AI), CMDB Sync (SYN), Certificate Inventory (CRI);

Global Asset View (GAV), Cybersecurity Asset Management (CSAM), Certificate Inventory (CRI);

Cloud/Container Security:

4 unchanged sentences

We continue to experience revenue growth from our existing customers as they renew and purchase additional subscriptions, as well as from the addition of new customers to our cloud platform.

Our Qualys Cloud Platform is currently used by over 19,000 customers, including active subscribers of our free services, in more than 130 countries, including a majority of each of the Forbes Global 100 and Fortune 100.

Our revenues increased to $363.0 million in 2020 from $321.6 million in 2019 and $278.9 million in 2018. 

Our Qualys Cloud Platform is currently used by over 10,000 customers worldwide, including a majority of each of the Forbes Global 100 and Fortune 100.

Our revenues increased to 

$411.2 million in 2021 from $363.0 million in 2020 and $321.6 million in 2019 . 

Our cloud platform consists of a suite of IT security, compliance, web application security, asset management and cloud and container security solutions, which we refer to as the Qualys Cloud Apps, that leverages our shared and extensible core services and our highly scalable multi-tenant cloud infrastructure.

4 unchanged sentences

The technology underlying our cloud infrastructure enables us to ingest, process, analyze and store a high volume of sensor data coming from our agents, scanners and passive analyzers, and correlate information at very high speeds in a distributed manner for millions of devices.

Our cloud platform is delivered to our customers via our shared platform offering from our global data centers, or via our private platform offering, Qualys Private Cloud Platform (PCP), for customers or partners that want the platform to reside within the customer's data center.

Our cloud platform is delivered to our customers via our eleven global shared cloud platforms, or via our private platform offering, Qualys Private Cloud Platform (PCP), for customers or partners that want the platform to reside within the customer's data center.

The PCP is a standalone version of our multi-layer, multi-tenant services architecture and is a fully integrated turnkey solution, making it more scalable, cost effective and faster to deploy within a customer's data center.

7 unchanged sentences

Our core services enable integrated workflows, management and real-time analysis and reporting across all of our IT, security and compliance solutions for our customers inside their organizations, on the perimeter, on endpoints or in the cloud.

Our core services constitute dynamic and customizable dashboards and centrally managed, self-updating integrated Cloud Apps, through what we call a “single-pane-of-glass”

user interface.

Our core services constitute dynamic and customizable dashboards and centrally managed, self-updating integrated Cloud Apps, through a natively integrated unified platform.

Our interactive, dynamic dashboards and cloud platform allow our customers to aggregate and correlate all of their IT, security and compliance data in one place, drill down into details, and generate reports customized for different audiences.

3 unchanged sentences

Enables customers to easily identify, categorize and manage large numbers of assets in highly dynamic IT environments and automates the process of inventory management and hierarchical organization of IT assets.

Built on top of this core service is the Qualys AI framework, which is a global asset inventory service enabling our customers to search for information on any IT asset, scaling to millions of assets for customers of all sizes, helping IT and security personnel to search IT assets and maintain an up-to-date inventory on a continuous basis.

Built on top of this core service is the Qualys GAV framework, which is a global asset inventory service enabling our customers to search for information on any IT asset, scaling to millions of assets for customers of all sizes, helping IT and security personnel to search IT assets and maintain an up-to-date inventory on a continuous basis.

Reporting and Dashboards.

13 unchanged sentences

The Qualys Cloud Platform and its Cloud Apps help organizations escape this tool-fragmentation dilemma by drastically simplifying their security stacks and regaining unimpeded visibility across their IT environment.

The Cloud Apps are self-updating, centrally managed and tightly integrated, and cover a broad range of functionality in areas such as IT, security, compliance, web application security, asset management and cloud and container security solutions.

The Cloud Apps are self-updating, centrally managed and tightly integrated, and cover a broad range of functionality in areas such as IT security, compliance, web application security, asset management and cloud and container security solutions.

From inception through December 31, 2020, we have added the following Cloud Apps:

VM, PC, PCI, WAS, WAF, CM, SYN, SAQ, TP, FIM, IOC, AI, SCA, CS, CI, CSA, CRI, CRA, OCA, PM, and a free version of AI.

In 2020, we introduced VMDR and EDR.

VM, PC, PCI, WAS, WAF, CM, SAQ, TP, FIM, GAV (including a free version), SCA, CS, CI, CSA, CRI, CRA, OCA, PM, VMDR, and EDR.

In 2021, we introduced SaaSDR, SEM, and CSAM.

We believe that our applications are easy to use and provide our customers with a high level of control because our applications are part of one platform, share a common user interface, utilize the same scanners and agents, access the same collected data, and leverage the same user permissions.

Our customers can subscribe to one or more of our IT, security and compliance Apps based on their initial needs and expand their subscriptions over time to new areas within their organization or to additional Qualys solutions.

We offer four editions of our Qualys Cloud Apps:

For VMDR, we offer four editions of our Qualys Cloud App:

Enterprise for large enterprises, Express for medium-sized businesses, Express Lite for small-sized businesses, and Scan-on-Behalf for Scan-on-Behalf customers.

For all other Qualys Cloud Apps, we offer four editions:

Enterprise for large enterprises, Express for medium-sized businesses, Express Lite for small-sized businesses, and Consulting Edition for consultants, consulting organizations and Managed Service Providers (MSPs).

30 unchanged sentences

EDR unifies different context vectors like asset discovery, rich normalized software inventory, end-of-life visibility, vulnerabilities and exploits, misconfigurations, in-depth endpoint telemetry, and network reachability with a powerful backend to correlate it all for accurate assessment, detection and response.

Indication of Compromise (IOC):

IOC delivers threat hunting, detects suspicious activity, and confirms the presence of known and unknown malware for devices both on and off the network.

From its single console, customers can monitor current and historical system activity for all on-premises servers, user endpoints, and cloud instances - even for assets that are currently offline or have been re-imaged by IT.

IOC utilizes the Cloud Agent to capture endpoint activity on files, processes, mutant handles, registries, and network connections, and uploads the data to the Qualys Cloud Platform for storage, processing, and query.

IOC 2.0, which was released in 2019, now provides enhanced attack detection, investigation, and response capabilities for security analysts, incident responders, and managed security service providers.

Certificate Assessment (CRA):

2 unchanged sentences

It also identifies out-of-policy certificates with weak signatures or key length and shows how many unique Certificate Authorities were found in the environment and how many certificates each one issued.

SaaS Detection and Response (SaaSDR):

SaaSDR leverages the Qualys Cloud platform to provide continuous visibility into SaaS applications such as Office 365, Salesforce and Zoom for configuration posture management, activity monitoring and data security insights.

Secure Enterprise Mobility (SEM):

SEM extends the power of VMDR for in-depth inventory of mobile devices and their data, real time vulnerability and misconfiguration detection, and built-in remediation with patch orchestration for all Android and iOS/iPadOS devices across the enterprise.

Policy Compliance (PC):

35 unchanged sentences

Scaling to thousands of scans, it conducts incisive, thorough and precise testing of browser-based web apps, mobile app backends, and Internet of things (IoT) services.

Its seamless integration with the Qualys Web Application Firewall (WAF) enables verification of attack protection and one click mitigation of vulnerabilities.

Its seamless integration with the Qualys Web Application Firewall (WAF) enables verification of attack protection, ticket creation and one click mitigation of vulnerabilities.

WAS' powerful API enables integration with other systems and allows teams to detect issues within DevOps environments early in the application development process.

8 unchanged sentences

Asset Management

Global IT Asset Inventory (AI):

AI constantly gathers information on all assets, including system and hardware details, running services, open ports, installed software and user accounts.

Global Asset View (GAV):

GAV constantly gathers information on all assets, including system and hardware details, running services, open ports, installed software and user accounts.

Asset discovery and inventory collection is done through a combination of Qualys network scanners, Cloud Agents and passive scanners, which together collect comprehensive data from on-premises or cloud infrastructure as well as remote endpoints.

In order to create consistent and uniform asset data, AI normalizes raw discovery data to standardize every manufacturer name, product name, model and software version using Qualys’

In order to create consistent and uniform asset data, GAV normalizes raw discovery data to standardize every manufacturer name, product name, model and software version using Qualys’

ever-evolving technology catalog as a reference.

2 unchanged sentences

Additionally, customers can sync their asset information with ServiceNow CMDB.

CMDB Sync (SYN):

SYN is a certified application that synchronizes Qualys AI data with ServiceNow’s Configuration Management system.

Device changes are immediately transmitted to the Qualys Cloud Platform and then synchronized with ServiceNow.

For customers, this means an end to unidentified and misclassified assets, and to data update delays, all of which increase chances of breaches.

SYN provides real-time, comprehensive visibility of IT asset inventories enabling immediate detection of security and compliance risks.

Cybersecurity Asset Management (CSAM):

CSAM is an all-in-one solution that leverages the power of the Qualys Cloud Platform with its multiple native sensors and CMDB synchronization to continuously inventory known and unknown assets, discover installed applications, and overlay business and risk context to establish asset criticality.

It identifies unauthorized or end-of-life and end-of-service software and the absence of required security tools, and assesses the health of the attack surface.

Further, CSAM enables response options with threat alerts and software removal and delivers regulatory reporting in support of FedRAMP, PCI-DSS and other mandates.

Certificate Inventory (CRI):

20 unchanged sentences

We also offer organizations of all sizes free security and compliance services based on the Qualys Cloud Platform:

Qualys Global IT Asset Discovery and Inventory app automatically creates a continuous, real-time inventory of known and unknown assets throughout a user's global IT footprint across on-premises, endpoints, multi-cloud, mobile, containers, operational technology and IoT.

Qualys Global Asset View app automatically creates a continuous, real-time inventory of known and unknown assets throughout a user's global IT footprint across on-premises, endpoints, multi-cloud, mobile, containers, operational technology and IoT.

The app also automatically normalizes and categorizes assets to ensure clean, reliable, and consistent data.

14 unchanged sentences

From inception through December 31, 2020, we have added the following Cloud Apps:

VM, PC, PCI, WAS, WAF, CM, SYN, SAQ, TP, FIM, IOC, AI, SCA, CS, CI, CSA, CRI, PM, and a free version of AI.

In 2020, we introduced VMDR and EDR.

PC, PCI, WAS, WAF, CM, SAQ, TP, FIM, GAV (including a free version), SCA, CS, CI, CSA, CRI, CRA, OCA, PM, VMDR, and EDR.

In 2021, we introduced SaaSDR, SEM, and CSAM.

Expand the use of our suite of solutions by our large and diverse customer base.

With more than 19,000 customers, including active subscribers of our free services, across many industries and geographies, we believe we have a significant opportunity to sell additional solutions to our customers and expand their use of our suite of solutions.

With more than 10,000 customers, across many industries and geographies, we believe we have a significant opportunity to sell additional solutions to our customers and expand their use of our suite of solutions.

Because our customers typically initially deploy one or two of our solutions in select parts of their IT infrastructures, our existing customers serve as a strong source of new sales as they expand their scope and increase their subscriptions or choose to adopt additional solutions from our integrated suite of IT, security and compliance offerings.

8 unchanged sentences

We may explore acquisitions that are complementary to and can expand the functionality of our cloud platform.

We may also seek to acquire development teams to supplement our own personnel and acquire technology to increase the breadth of our cloud-based IT, security and compliance solutions. In 2020, we acquired certain intangible assets of Spell Security Private Limited (Spell Security), expanding Qualys’

endpoint behavior detection, threat hunting, malware research and multi-layered response capabilities for our EDR application.

In 2019, we acquired the software assets of Adya Inc.

(Adya), enabling Qualys to provide companies of all sizes with the ability to consolidate administration of their Software as a Service (SaaS) applications into one console, manage license costs across SaaS applications, set and enforce security policies in one place and report and audit on all activity with a single tool.

In 2018, we acquired the software assets of 1Mobility Private Limited (1Mobility), a Singapore based company, allowing Qualys to provide enterprises of all sizes with the ability to create and continuously update an inventory of mobile devices on all versions of Android, iOS and Windows Mobile in their environment;

and to continuously assess their security and compliance posture, while quarantining devices that are compromised or out-of-compliance.

In 2018, we also acquired Layered Insight (Layered Insight), a provider of container native application protection, delivering insight into container images, adaptive analysis of running containers, and automated enforcement of the container environments.

We may also seek to acquire development teams to supplement our own personnel and acquire technology to increase the breadth of our cloud-based IT, security and compliance solutions.

In 2021, we acquired certain intangible assets of Kandor Soft Labs Private Ltd.

(TotalCloud), strengthening our cloud security solution by allowing customers to build user-defined workflows for custom policies and execute them on-demand for simplified security and compliance. In 2020, we acquired certain intangible assets of Spell Security Private Limited (Spell Security), expanding our endpoint behavior detection, threat hunting, malware research and multi-layered response capabilities for our EDR application.

In 201 9, we acquired Adya Inc.

(Adya), enabling us to provide companies of all sizes with the ability to consolidate administration of their Software as a Service (SaaS) applications into one console, manage license costs across SaaS applications, set and enforce security policies in one place and report and audit on all activity with a single tool.

Our Customers

We market and sell our solutions to enterprises, government entities and small and medium-sized businesses across a broad range of industries, including education, financial services, government, healthcare, insurance, manufacturing, media, retail, technology and utilities.

As of December 31, 2020, we had over 19,000 customers, including active subscribers of our free services, in more than 130 countries, including a majority of each of the Forbes Global 100 and Fortune 100.

As of December 31, 2021 , we had over 10,000 customers worldwide, including a majority of each of the Forbes Global 100 and Fortune 100.

In each of 2021 , 2020 and 2019 , no one customer accounted for more than 10% of our revenues.

In 2020, 2019 and 2018, 63%, 64% and 67%, respectively, of our revenues were derived from customers in the United States based on our customers billing address.

In 2021 , 2020 and 2019 , 61% , 63% and 64%, respectively, of our revenues were derived from customers in the United States based on our customers' billing addresses.

We sell our solutions to enterprises and government entities primarily through our field sales force and to small and medium-sized businesses through our inside sales force.

10 unchanged sentences

As such, these partners offer our IT, security and compliance solutions in conjunction with one or more of their own products or services and act as a conduit through which we can connect with these prospective customers to offer our solutions.

Our channel partners include security consulting organizations, managed service providers and resellers, such as Accenture, BT Managed Security, Cognizant Technology Solutions, Deutsche Telekom, DXC Technology, Fujitsu, Hindustan Computers Limited (HCL) Technologies, International Business Machines (IBM), Infosys, Nippon Telegraph and Telephone Corporation (NTT), Optiv, SecureWorks, Tata Communications, Verizon and Wipro.

Qualys has also established strategic partnerships with leading cloud providers like Amazon Web Services, Microsoft Azure and the Google Cloud Platform.

27 unchanged sentences

Manufacturing Agreement

Our physical appliances are provided by SYNNEX Corporation (SYNNEX), pursuant to a manufacturing services agreement dated March 1, 2011. Under this agreement, SYNNEX manufactures, assembles and tests our physical scanner appliances.

This agreement is automatically renewed annually, unless terminated (i) at any time upon the mutual written agreement of us and SYNNEX, (ii) by either party upon 90 days or more written notice, (iii) upon written notice, subject to applicable cure periods, if the other party has materially breached its obligations under the agreement or (iv) by either party upon the other party seeking an order for relief under the bankruptcy laws of the United States or similar laws of any other jurisdiction, a composition with or assignment for the benefit of creditors, or dissolution or liquidation.

Data Center Agreements

Our data center operations are provided by large third-party data center vendors and are located in the United States, Canada, Switzerland, the Netherlands, United Arab Emirates and India.

Our data center agreements have varying terms through 2025.

Our physical appliances are provided by TD SYNNEX, pursuant to a manufacturing services agreement dated March 1, 2011. Under this agreement, TD SYNNEX manufactures, assembles and tests our physical scanner appliances.

This agreement is automatically renewed annually, unless terminated (i) at any time upon the mutual written agreement of us and TD SYNNEX, (ii) by either party upon 90 days or more written notice, (iii) upon written notice, subject to applicable cure periods, if the other party has materially breached its obligations under the agreement or (iv) by either party upon the other party seeking an order for relief under the bankruptcy laws of the United States or similar laws of any other jurisdiction, a composition with or assignment for the benefit of creditors, or dissolution or liquidation.

Shared Cloud Platform Agreements

Our shared cloud platform operations are provided by large third-party vendors and are located in the United States, Canada, Switzerland, the Netherlands, United Arab Emirates, Australia, United Kingdom and India.

Our shared cloud platform agreements have varying terms through 2025.

The expanding capabilities of our IT, security and compliance solutions have enabled us to address a growing array of opportunities in the cloud IT, security and compliance market.

We compete with a large and broad array of established and emerging vulnerability management vendors, compliance vendors and data security vendors in a highly fragmented and competitive environment.

We compete with large and small public companies, such as Belden (Tripwire), Broadcom (Symantec Enterprise Security), CrowdStrike, F5 Networks, FireEye, International Business Machines, McAfee, Micro Focus International, Palo Alto Networks, Rapid7, Tenable Holdings and VMware, as well as privately held security providers including Barracuda Networks, BeyondTrust Software, Flexera, Forescout Technologies, Imperva, Tanium, Trustwave Holdings, Venafi, and Veracode.

We compete with large and small public companies, such as Belden (Tripwire), Broadcom (Symantec Enterprise Security), CrowdStrike, Palo Alto Networks, Rapid7, and Tenable Holdings, as well as privately held security providers including Axonius, Checkmarx, Flexera, Ivanti, Netsparker, Tanium, Trustwave Holdings and Veracode.

We also seek to replace IT, security and compliance solutions that organizations have developed internally.

1 unchanged sentence

Our competitors may also attempt to further expand their presence in the IT, security and compliance market and compete more directly against one or more of our solutions.

We believe that the principal competitive factors affecting our markets include product functionality, breadth of product offerings, flexibility of delivery models, ease of deployment and use, total cost of ownership, scalability and performance, customer support and extensibility of platform.

We believe that the principal competitive factors affecting our markets include product functionality, breadth of offerings, flexibility of delivery models, ease of deployment and use, total cost of ownership, scalability and performance, customer support and extensibility of platform.

We believe that our suite of solutions generally competes favorably with respect to these factors.

2 unchanged sentences

We rely on a combination of trade secrets, copyrights, patents and trademarks, as well as contractual protections, to establish and protect our intellectual property rights and protect our proprietary technology.

As of December 31, 2020, we ha ve twenty issue d patents, several pending U.S.

As of December 31, 2021 , we have twenty-six issued patents, which expire from 2029 to 2039, several pending U.S.

patent applications and an exclusive license to four U.S.

patents, which was obtained in connection with our acquisition of Nemean in 2010.

The inbound license remains in effect until the licensed patents are no longer enforceable, unless the applicable license agreement is first terminated by us or terminated by the licensor for a breach of the agreement or if we undergo certain bankruptcy events.

The licenses are currently exclusive and will remain exclusive so long as we make an appropriately-timed written election and pay an annual fixed royalty for ten years thereafter.

These exclusive licenses are subject to the licensor’s reservation of certain rights in the patents and subject to the U.S.

These exclusive licenses are subject to the licensor’s reservation of certain r ights in the patents and subject to the U.S.

government’s reserved rights in the technology.

7 unchanged sentences

Doing the right thing for our people, our communities and our environment upholds the trust of our customers, partners, employees, and stockholders, enabling us to grow our business profitably and meet the diverse needs of our constituents.

As of December 31, 2020, we had 1,498 full-time employees, including 749 in research and development, 298 in sales and marketing, 310 in operations and customer support, and 141 in general and administrative.

As of December 31, 2020, approximately 73% of our employees were located outside the United States, with 63% of our employees located in Pune, India.

As of December 31, 2021 , we had 1,823 full-time employees, including 941 in research and development, 308 in sales and marketing, 402 in operations and customer support, and 172 in general and administrative.

As of December 31, 2021 , approximately 75% of our employees were located outside of the United States, with 67% of our employees located in Pune, India.

None of our U.S.

8 unchanged sentences

Our board of directors and executive team are highly diverse.

Three out of our current eight member board of directors are women, and the board seeks to identify strong candidates who provide a wide range of perspectives, competencies, and knowledge to complement the board’s skills, diversity and experiences.

Three out of our current eight member board of directors are women, one is a man from an underrepresented community, and the board of directors seeks to identify strong candidates who provide a wide range of perspectives, competencies, and knowledge to complement the skills, diversity and experiences of the board of directors.

Further, our executive team is gender and ethnically diverse, with more than 50% of the executive team from underrepresented communities.

7 unchanged sentences

We have been able to successfully adapt to the current challenges and deliver results despite the pandemic while continuing to protect the health and safety of our workforce and customers.

We require our employees and managers to participate in myriad training programs directed at maintaining a harassment-free, diverse, and secure workplace.

We require our employees and managers to participate in myriad training programs directed at maintaining a harassment-free, diverse, and secure workplace.

With our diverse employee population, we uphold the rights to work in an environment that promotes equal opportunity and prohibits discriminatory practices against race, color, national origin, ancestry, medical condition, religious creed (including religious dress and grooming practices), marital status, registered domestic partner status, sex, sexual orientation, gender identity and expression, genetic characteristics and information, age, veteran status, or any other protected characteristic.

3 unchanged sentences

In addition to competitive base salaries, all qualified employees are eligible for variable pay and equity awards.

To support the health and wellness of our workforce, Qualys offers premium health coverage with minimal out-of-pocket contributions for our global employees.

To support the health and wellness of our workforce, we offer premium health coverage with minimal out-of-pocket contributions for our global employees.

Training and Development

2 unchanged sentences

We assist employees in achieving their career goals by helping them improve their skillsets and transition to other challenging roles.

To support career growth inside and outside the Company, Qualys offers free self-paced or instructor-led certified training on core Qualys topics giving employees and non-employees an opportunity to achieve certifications.

To support career growth inside and outside Qualys, we offer free self-paced or instructor-led certified training on core Qualys topics giving employees and non-employees an opportunity to achieve certifications.

Available Information

6 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1. Business