What changed in this filing

/stocks — the workspaceLOADING

Item 1. Business

2023-02-23 compared with 2022-02-22 · 37 added, 35 removed, 347 unchanged (17% of the section changed)

43 unchanged sentences

Vulnerability Management (VM),  

Vulnerability Management, Detection and Response (VMDR), Threat Protection (TP), Continuous Monitoring (CM), Patch Management (PM), Multi-Vector Endpoint Detection and Response (EDR), Certificate Assessment (CRA), SaaS Detection and Response (SaaSDR), Secure Enterprise Mobility (SEM), Custom Assessment and Remediation (CAR), Context Extended Detection and Response (XDR), Network Detection and Response (NDR);

Policy Compliance (PC), Security Configuration Assessment (SCA), PCI Compliance (PCI), File Integrity Monitoring (FIM), Security Assessment Questionnaire (SAQ), Out of-Band Configuration Assessment (OCA); 

2 unchanged sentences

Asset Management:

Global Asset View (GAV), Cybersecurity Asset Management (CSAM), Certificate Inventory (CRI);

Global AssetView (GAV), Cybersecurity Asset Management (CSAM), Certificate Inventory (CRI);

Cloud/Container Security:

13 unchanged sentences

The technology underlying our cloud infrastructure enables us to ingest, process, analyze and store a high volume of sensor data coming from our agents, scanners and passive analyzers, and correlate information at very high speeds in a distributed manner for millions of devices.

Our cloud platform is delivered to our customers via our eleven global shared cloud platforms, or via our private platform offering, Qualys Private Cloud Platform (PCP), for customers or partners that want the platform to reside within the customer's data center.

The PCP is a standalone version of our multi-layer, multi-tenant services architecture and is a fully integrated turnkey solution, making it more scalable, cost effective and faster to deploy within a customer's data center.

Our cloud platform is delivered to our customers via our 11 global shared cloud platforms, or via our private platform offering, Qualys Private Cloud Platform (PCP), for customers or partners that want the platform to reside within the customer's shared cloud platform.

Solutions delivered through our PCP are typically on the same subscription basis as solutions delivered through our shared platform.

30 unchanged sentences

From inception through December 31, 2021, we have added the following Cloud Apps:

VM, PC, PCI, WAS, WAF, CM, SAQ, TP, FIM, GAV (including a free version), SCA, CS, CI, CSA, CRI, CRA, OCA, PM, VMDR, and EDR.

In 2021, we introduced SaaSDR, SEM, and CSAM.

VM, PC, PCI, WAS, WAF, CM, SAQ, TP, FIM, GAV, SCA, CS, CI, CSA, CRI, CRA, OCA, PM, VMDR, EDR, SaaSDR, SEM, and CSAM.

In 2022, we introduced CAR, XDR and NDR. 

We believe that our applications are easy to use and provide our customers with a high level of control because our applications are part of one platform, share a common user interface, utilize the same scanners and agents, access the same collected data, and leverage the same user permissions.

12 unchanged sentences

VMDR continuously assesses these assets for the latest vulnerabilities and applies the latest threat intel analysis to prioritize actively exploitable vulnerabilities.

Finally, VMDR automatically detects the latest superseding patch for the vulnerable asset and easily deploys it for remediation.

By delivering all this in a single app workflow, VMDR automates the entire process and significantly accelerates an organization’s ability to respond to threats, thus preventing possible exploitation.

VMDR automatically detects the latest superseding patch for the vulnerable asset and easily deploys it for remediation.

Finally, VMDR quantifies risk across vulnerabilities, assets and groups of assets helping organizations proactively reduce cyber risk exposure and track cyber risk reduction over time. By delivering all this in a single app workflow, VMDR automates the entire process and significantly accelerates an organization’s ability to respond to threats, thus preventing possible exploitation.

Threat Protection (TP):

10 unchanged sentences

Patch Management (PM):

PM provides automated patch deployment capabilities by correlating vulnerabilities and patches.

PM provides automated patch deployment capabilities for Windows, Linux, Mac and third party software by correlating vulnerabilities and the right set of remediation including patches and configuration fixes.

It continuously gathers and uploads telemetry about installed software, open vulnerabilities and missing patches to the Qualys Cloud Platform.

14 unchanged sentences

SEM extends the power of VMDR for in-depth inventory of mobile devices and their data, real time vulnerability and misconfiguration detection, and built-in remediation with patch orchestration for all Android and iOS/iPadOS devices across the enterprise.

 Custom Assessment and Remediation (CAR):

Custom Assessment and Remediation opens the Qualys Cloud Platform for security architects allowing the creation of custom scripts in popular scripting languages, user-defined controls and automation, all seamlessly integrated within existing programs to quickly assess, respond to and remediate threats across global hybrid environments.   

 Context Extended Detection and Response (XDR): XDR provides context and clarity to enterprise security operations through risk-focused, single pane of glass visibility and control to improve enterprise-wide threat detection and incident response.

It leverages the Cloud Platform's response capabilities - patching, fixing misconfigurations, killing processes and network connections, and quarantining hosts - to comprehensively remediate cyber security threats identified by Qualys XDR.  

 Network Detection and Response (NDR):

Network detection and response monitors network traffic and analyzes it using deep learning artificial intelligence (AI) to detect cyber threats in data centers and in the public cloud. 

The solution is able to detect both known and publicly undisclosed threats in real time. 

Policy Compliance (PC):

46 unchanged sentences

Asset Management

Global Asset View (GAV):

Global AssetView (GAV):

GAV constantly gathers information on all assets, including system and hardware details, running services, open ports, installed software and user accounts.

3 unchanged sentences

This catalog automatically extends IT asset inventory with non-discoverable metadata such as hardware and software release dates, end of life dates, and license categories.

This new data layer allows teams to detect issues such as unauthorized software, outdated hardware or end-of-life software, which can help properly tag, support, and secure business-critical assets.

Additionally, customers can sync their asset information with ServiceNow CMDB.

This new data layer allows teams to detect issues such as unauthorized software, outdated hardware or end-of-life software, which can help properly tag, support, and secure business-critical assets. 

Cybersecurity Asset Management (CSAM):

1 unchanged sentence

It identifies unauthorized or end-of-life and end-of-service software and the absence of required security tools, and assesses the health of the attack surface.

Further, CSAM enables response options with threat alerts and software removal and delivers regulatory reporting in support of FedRAMP, PCI-DSS and other mandates.

CSAM includes External Attack Surface Management, which allows discovery of internet facing unknown assets.  

Certificate Inventory (CRI):

20 unchanged sentences

We also offer organizations of all sizes free security and compliance services based on the Qualys Cloud Platform:

Qualys Global Asset View app automatically creates a continuous, real-time inventory of known and unknown assets throughout a user's global IT footprint across on-premises, endpoints, multi-cloud, mobile, containers, operational technology and IoT.

Qualys Global AssetView app automatically creates a continuous, real-time inventory of known and unknown assets throughout a user's global IT footprint across on-premises, endpoints, multi-cloud, mobile, containers, operational technology and IoT.

The app also automatically normalizes and categorizes assets to ensure clean, reliable, and consistent data.

2 unchanged sentences

Upon an unknown device detection, users can install a light-weight Qualys self-updating agent (3MB) to turn the device into a managed device or launch a vulnerability scan.

Qualys Community Edition automatically gathers and analyzes security and compliance data from hybrid IT environments to provide a complete, continuously updated, and instant view of monitored IT assets on-premises or in the cloud, as well as web apps, from a single-pane-of-glass interface.

The Community Edition is limited to one user with data retention for three months.

Qualys CloudView continuously discovers and tracks assets and resources across public cloud deployments to provide users both real-time and historical views of cloud inventory.

Qualys Cloud Inventory continuously discovers and tracks assets and resources across public cloud deployments to provide users both real-time and historical views of cloud inventory.

It collects metadata about cloud assets and resources to help users understand the relationships between public cloud assets and resources across different dimensions and then discover their threat posture based on those attributes and relationships.

CloudView is limited to three accounts per public cloud platform.

Qualys CertView inventories and assesses all Internet-facing certificates to generate SSL/TLS configuration grades, identifies the certificate issuer and tracks certificate expirations to help stop expired and expiring certificates from interrupting critical business functions.

Cloud Inventory is limited to three accounts per public cloud platform.

Qualys Certificate Inventory inventories and assesses all Internet-facing certificates to generate SSL/TLS configuration grades, identifies the certificate issuer and tracks certificate expirations to help stop expired and expiring certificates from interrupting critical business functions.

Our Growth Strategy

4 unchanged sentences

From inception through December 31, 2021, we have added the following Cloud Apps:

PC, PCI, WAS, WAF, CM, SAQ, TP, FIM, GAV (including a free version), SCA, CS, CI, CSA, CRI, CRA, OCA, PM, VMDR, and EDR.

In 2021, we introduced SaaSDR, SEM, and CSAM.

PC, PCI, WAS, WAF, CM, SAQ, TP, FIM, GAV, SCA, CS, CI, CSA, CRI, CRA, OCA, PM, VMDR, EDR, SaaSDR, SEM, and CSAM.

In 2022, we introduced CAR, XDR and NDR. 

Expand the use of our suite of solutions by our large and diverse customer base.

7 unchanged sentences

We seek to strengthen existing relationships as well as establish new relationships to increase the distribution and market awareness of our cloud platform and target new geographic regions.

We also plan to partner with such security providers that can host our private cloud offering within their data centers, helping us expand our reach in new markets and new geographies.

We also plan to partner with such security providers that can host our private cloud offering within their shared cloud platforms, helping us expand our reach in new markets and new geographies.

Selectively pursue technology acquisitions to bolster our capabilities and leadership position.

1 unchanged sentence

We may also seek to acquire development teams to supplement our own personnel and acquire technology to increase the breadth of our cloud-based IT, security and compliance solutions.

In 2022, we acquired certain intangible assets of Blue Hexagon Inc., enabling us to leverage our cloud platform with AI/machine learning to uncover behavior patterns including active vulnerability exploitation, identification of advanced network threats, and adaptive risk mitigation across all assets and applications. 

In 2021, we acquired certain intangible assets of Kandor Soft Labs Private Ltd.

(TotalCloud), strengthening our cloud security solution by allowing customers to build user-defined workflows for custom policies and execute them on-demand for simplified security and compliance. In 2020, we acquired certain intangible assets of Spell Security Private Limited (Spell Security), expanding our endpoint behavior detection, threat hunting, malware research and multi-layered response capabilities for our EDR application.

In 201 9, we acquired Adya Inc.

(Adya), enabling us to provide companies of all sizes with the ability to consolidate administration of their Software as a Service (SaaS) applications into one console, manage license costs across SaaS applications, set and enforce security policies in one place and report and audit on all activity with a single tool.

Our Customers

15 unchanged sentences

As such, these partners offer our IT, security and compliance solutions in conjunction with one or more of their own products or services and act as a conduit through which we can connect with these prospective customers to offer our solutions.

Our channel partners include security consulting organizations, managed service providers and resellers, such as Accenture, BT Managed Security, Cognizant Technology Solutions, Deutsche Telekom, DXC Technology, Fujitsu, Hindustan Computers Limited (HCL) Technologies, International Business Machines (IBM), Infosys, Nippon Telegraph and Telephone Corporation (NTT), Optiv, SecureWorks, Tata Communications, Verizon, Wipro and TD SYNNEX Corporation (TD SYNNEX).

Our channel partners include security consulting organizations, managed service providers and resellers, such as Accenture, BT Managed Security, Cognizant Technology Solutions, Deutsche Telekom, DXC Technology, Fujitsu, Hindustan Computers Limited (HCL) Technologies, International Business Machines (IBM), Infosys, Nippon Telegraph and Telephone Corporation (NTT), Optiv, Tata Communications, Verizon, Wipro and TD SYNNEX Corporation (TD SYNNEX).

Qualys has also established strategic partnerships with leading cloud providers like Amazon Web Services, Microsoft Azure and the Google Cloud Platform.

26 unchanged sentences

Our research and development team also works collaboratively with our technical support team to ensure customer satisfaction and with our sales team to accelerate the adoption of our solutions.

Manufacturing Agreement

Our physical appliances are provided by TD SYNNEX, pursuant to a manufacturing services agreement dated March 1, 2011. Under this agreement, TD SYNNEX manufactures, assembles and tests our physical scanner appliances.

This agreement is automatically renewed annually, unless terminated (i) at any time upon the mutual written agreement of us and TD SYNNEX, (ii) by either party upon 90 days or more written notice, (iii) upon written notice, subject to applicable cure periods, if the other party has materially breached its obligations under the agreement or (iv) by either party upon the other party seeking an order for relief under the bankruptcy laws of the United States or similar laws of any other jurisdiction, a composition with or assignment for the benefit of creditors, or dissolution or liquidation.

Shared Cloud Platform Agreements

3 unchanged sentences

We compete with a large and broad array of established and emerging vulnerability management vendors, compliance vendors and data security vendors in a highly fragmented and competitive environment.

We compete with large and small public companies, such as Belden (Tripwire), Broadcom (Symantec Enterprise Security), CrowdStrike, Palo Alto Networks, Rapid7, and Tenable Holdings, as well as privately held security providers including Axonius, Checkmarx, Flexera, Ivanti, Netsparker, Tanium, Trustwave Holdings and Veracode.

We compete with large and small public companies, such as Broadcom (Symantec Enterprise Security), CrowdStrike, Palo Alto Networks, Rapid7, and Tenable Holdings, as well as privately held security providers including Axonius, Checkmarx, Flexera, Invicti, Ivanti, Tanium, HelpSystems (Tripwire), Trustwave Holdings and Veracode.

We also seek to replace IT, security and compliance solutions that organizations have developed internally.

6 unchanged sentences

We rely on a combination of trade secrets, copyrights, patents and trademarks, as well as contractual protections, to establish and protect our intellectual property rights and protect our proprietary technology.

As of December 31, 2021 , we have twenty-six issued patents, which expire from 2029 to 2039, several pending U.S.

As of December 31, 2022 , we have thirty issued patents, which expire from 2029 to 2040, several pending U.S.

patent applications and an exclusive license to four U.S.

11 unchanged sentences

Doing the right thing for our people, our communities and our environment upholds the trust of our customers, partners, employees, and stockholders, enabling us to grow our business profitably and meet the diverse needs of our constituents.

As of December 31, 2021 , we had 1,823 full-time employees, including 941 in research and development, 308 in sales and marketing, 402 in operations and customer support, and 172 in general and administrative.

As of December 31, 2022 , we had 2,143 full-time employees, including 1,062 in research and development, 376 in sales and marketing, 478 in operations and customer support, and 227 in general and administrative.

As of December 31, 2022 , approximately 75% of our employees were located outside of the United States, with 66% of our employees located in Pune, India.

9 unchanged sentences

Our board of directors and executive team are highly diverse.

Three out of our current eight member board of directors are women, one is a man from an underrepresented community, and the board of directors seeks to identify strong candidates who provide a wide range of perspectives, competencies, and knowledge to complement the skills, diversity and experiences of the board of directors.

Two out of our current seven member board of directors are women, one is a man from an underrepresented community, and the board of directors seeks to identify strong candidates who provide a wide range of perspectives, competencies, and knowledge to complement the skills, diversity and experiences of the board of directors.

Further, our executive team is gender and ethnically diverse, with more than 50% of the executive team from underrepresented communities.

4 unchanged sentences

We also released a free cloud-based remote endpoint protection solution for 60 days that allowed IT and security teams to protect the computers of remote employees and support the health and safety of our communities.

With the ongoing COVID-19 pandemic, our workforce continues to operate remotely, and our top priority remains providing support for our employees, partners, and customers.

We are fortunate that the nature of our business allows us to successfully operate in this dynamic work-from-home environment.

We have been able to successfully adapt to the current challenges and deliver results despite the pandemic while continuing to protect the health and safety of our workforce and customers.

During 2022, our workforce gradually transitioned into a hybrid work schedule, which resulted in a significant portion of our workforce working either in-person on a part-time basis, or remotely on a permanent basis.

Our top priority remains providing support for our employees, partners, and customers.

We are fortunate that the nature of our business allows us to successfully operate in this dynamic hybrid environment.

We believe that our hybrid policy will be a key enabler to support the broad needs of critical on-site to remote employees. 

We require our employees and managers to participate in myriad training programs directed at maintaining a harassment-free, diverse, and secure workplace.

18 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1. Business