Item 1. Business
Item 1.
Business
 
Overview
 
We are a pioneer and leading provider of a cloud-based platform delivering information technology (IT), security and compliance solutions. Our integrated suite of IT, security and compliance solutions delivered on our Qualys Cloud Platform enables our customers to: 1) identify and manage their IT assets across on-premises, endpoints, cloud, containers, and mobile environments; 2) collect and analyze large amounts of IT security data; 3) discover and prioritize vulnerabilities; 4) recommend and implement remediation actions; and 5) verify the implementation of such actions. This helps organizations protect their systems and applications from ever-evolving cyber-attacks and helps achieve compliance with internal policies and external regulations.
 
Our cloud solutions address the growing IT, security and compliance complexities and risks that are amplified by the dissolving boundaries between internal and external IT infrastructures and web environments, the rapid adoption of cloud computing, containers and serverless IT models, and the proliferation of geographically dispersed IT assets. Organizations use our integrated suite of solutions to cost-effectively obtain a unified view of their IT asset inventory as well as security and compliance posture across globally-distributed IT infrastructures as our solution offers a single platform for information technology, information security, application security, endpoint, developer security and cloud teams.
 
IT infrastructures are more complex and globally-distributed today than ever before, as organizations of all sizes increasingly rely upon a myriad of interconnected information systems and related IT assets, such as servers, databases, web applications, routers, switches, desktops, laptops, other physical and virtual infrastructure, and numerous external networks and cloud services. In this environment, new and evolving digital technologies intended to improve organizations’ operations can also increase vulnerability to cyber-attacks, which can expose sensitive data, damage IT and physical infrastructures, and result in serious financial or reputational consequences. In addition, the rapidly increasing amount of data and devices in IT environments makes it more difficult to identify and remediate vulnerabilities in a timely manner. The predominant approach to IT security has been to implement multiple disparate security products that can be costly and difficult to deploy, integrate and manage and may not adequately protect organizations. As a result, we believe there is a large and growing opportunity for comprehensive cloud-based IT, security and compliance solutions delivered in a single platform.
 
We designed our Qualys Cloud Platform to transform the way organizations secure and protect their IT infrastructures and applications. Our cloud platform offers an integrated suite of solutions that automates the lifecycle of asset discovery and management, security assessments, and compliance management for an organization’s IT infrastructure and assets, whether such infrastructure and assets reside inside the organization, on their network perimeter, on endpoints or in the cloud. Since inception, our solutions have been designed to be delivered through the cloud and to be easily and rapidly deployed on a global scale, enabling faster implementation and lower total cost of ownership than traditional on-premises enterprise software products. Our customers, ranging from some of the largest global organizations to small businesses, are served from our globally-distributed cloud platform, enabling us to rapidly deliver new solutions, enhancements and security updates.
 
We believe that our cloud platform provides our customers with unique advantages, including:
 
•
No hardware to buy or manage. There is no infrastructure or software to buy and maintain thus reducing our customers’ operating costs; all services are accessible in the cloud via web interface. Qualys operates and maintains the platform.
 
•
Real-time visibility in one place, anytime and anywhere . Our customers can conveniently see their security and compliance posture across their global IT asset inventory in one browser window, without plugins or a virtual private network (VPN), whenever and wherever Internet access is available.
 
•
Easy global scanning. Our customers can easily perform scans on geographically distributed and segmented networks at the perimeter, behind the firewall, on dynamic cloud environments and on endpoints.
 
•
Seamless scaling. Our cloud platform is a scalable, comprehensive, and end-to-end solution for the IT, security and compliance needs of our customers. Our customers can seamlessly add new coverage, users and services after they have deployed our platform.
 
•
Up to date resources . Qualys has one of the largest knowledge bases of vulnerability signatures in the industry. All security updates are made in real-time.
 
•
Data stored securely . Data is securely stored and processed in a multi-tiered architecture of load-balanced servers. Our encrypted databases are physically and logically secured.
 
5
Table of Contents
 
We were founded and incorporated in December 1999 with a vision of transforming the way organizations secure and protect their IT infrastructure and applications and initially launched our first cloud solution, Vulnerability Management (VM), in 2000. As VM gained acceptance, we introduced additional solutions to help customers manage increasing IT, security and compliance requirements. Today, the suite of solutions that we offer on our cloud platform and refer to as the Qualys Cloud Apps helps our customers protect a range of assets across on-premises, endpoints, cloud, containers, and mobile environments. These Cloud Apps address and include:
 
 
•
IT Security: Vulnerability Management (VM),   Vulnerability Management, Detection and Response (VMDR), Threat Protection (TP), Continuous Monitoring (CM), Patch Management (PM), Multi-Vector Endpoint Detection and Response (EDR), Certificate Assessment (CRA), SaaS Detection and Response (SaaSDR), Secure Enterprise Mobility (SEM), Custom Assessment and Remediation (CAR), Context Extended Detection and Response (XDR), Network Detection and Response (NDR);
 
•
Compliance: Policy Compliance (PC), Security Configuration Assessment (SCA), PCI Compliance (PCI), File Integrity Monitoring (FIM), Security Assessment Questionnaire (SAQ), Out of-Band Configuration Assessment (OCA); 
 
•
Web Application Security: Web Application Scanning (WAS), Web Application Firewall (WAF);
 
•
Asset Management: Global AssetView (GAV), Cybersecurity Asset Management (CSAM), Certificate Inventory (CRI); and
 
•
Cloud/Container Security: Cloud Inventory (CI), Cloud Security Assessment (CSA), Container Security (CS).
 
We provide our solutions through a software-as-a-service model, primarily with renewable annual subscriptions. These subscriptions require customers to pay a fee in order to access each of our cloud solutions. We generally invoice our customers for the entire subscription amount at the start of the subscription term, and the invoiced amounts are treated as deferred revenues and are recognized ratably over the term of each subscription. We continue to experience revenue growth from our existing customers as they renew and purchase additional subscriptions, as well as from the addition of new customers to our cloud platform.
 
Our Qualys Cloud Platform is currently used by over 10,000 customers worldwide, including a majority of each of the Forbes Global 100 and Fortune 100. Our revenues increased to  $489.7 million in 2022 from $411.2 million in 2021 and $363.0 million in 2020 . 
 
Our Platform
 
Our cloud platform consists of a suite of IT security, compliance, web application security, asset management and cloud and container security solutions, which we refer to as the Qualys Cloud Apps, that leverages our shared and extensible core services and our highly scalable multi-tenant cloud infrastructure. We also provide open application program interfaces, or APIs, and other developer tools that allow third parties to embed our technology into their solutions and build applications on our cloud platform.
 
Our cloud platform utilizes physical and virtual sensors, and cloud agents that provide our customers with continuous visibility enabling customers to respond to threats immediately. Customers can extend visibility to all known IT infrastructure using our Out-of-Band Configuration Assessment sensor for systems that are air-gapped or otherwise difficult to assess.
 
The Qualys Cloud Platform automatically gathers and analyzes security and compliance data in a scalable, state-of-the-art backend. The technology underlying our cloud infrastructure enables us to ingest, process, analyze and store a high volume of sensor data coming from our agents, scanners and passive analyzers, and correlate information at very high speeds in a distributed manner for millions of devices.
 
6
Table of Contents
 
 
Our cloud platform is delivered to our customers via our 11 global shared cloud platforms, or via our private platform offering, Qualys Private Cloud Platform (PCP), for customers or partners that want the platform to reside within the customer's shared cloud platform. The PCP is a standalone version of our multi-layer, multi-tenant services architecture and is a fully integrated turnkey solution, making it more scalable, cost effective and faster to deploy within a customer's shared cloud platform. Solutions delivered through our PCP are typically on the same subscription basis as solutions delivered through our shared platform. Our PCP utilizes hardware and software owned by us and is physically located on the customer's premises. The customer is not permitted to take possession of the software or access the software code. We also offer our PCP as a subscription-based platform services to the customer using a virtual version of our software. This virtualized PCP allows us to extend our security and compliance solutions without the complexity and cost associated with deploying traditional enterprise software. We also offer Private Cloud Platform Appliance (PCPA), an on-premises IT, security and compliance solution packaged in a form-factor for medium-sized companies.
 
Qualys Core Services
 
Our core services enable integrated workflows, management and real-time analysis and reporting across all of our IT, security and compliance solutions for our customers inside their organizations, on the perimeter, on endpoints or in the cloud.
 
Our core services constitute dynamic and customizable dashboards and centrally managed, self-updating integrated Cloud Apps, through a natively integrated unified platform. Our interactive, dynamic dashboards and cloud platform allow our customers to aggregate and correlate all of their IT, security and compliance data in one place, drill down into details, and generate reports customized for different audiences. Our cloud platform’s powerful Elasticsearch clusters enable customers to instantly find detailed data on any asset.
 
7
Table of Contents
 
Our core services include:
 
•
Asset Tagging and Management. Enables customers to easily identify, categorize and manage large numbers of assets in highly dynamic IT environments and automates the process of inventory management and hierarchical organization of IT assets. Built on top of this core service is the Qualys GAV framework, which is a global asset inventory service enabling our customers to search for information on any IT asset, scaling to millions of assets for customers of all sizes, helping IT and security personnel to search IT assets and maintain an up-to-date inventory on a continuous basis.
 
•
Reporting and Dashboards. A highly configurable reporting engine that provides customers with reports and dashboards based on their roles and access privileges.
 
•
Questionnaires and Collaboration. A configurable workflow engine that enables customers to easily build questionnaires and capture existing business processes and workflows to evaluate controls and gather evidence to validate and document compliance.
 
•
Remediation and Workflow. An integrated workflow engine that allows customers to automatically generate helpdesk tickets for remediation and to manage compliance exceptions based on customer-defined policies, enabling subsequent review, commentary, tracking and escalation. This engine automatically distributes remediation tasks to IT administrators upon scan completion, tracks remediation progress and closes open tickets once patches are applied and remediation is verified in subsequent scans.
 
•
Big Data Correlation and Analytics Engine. Provides Elasticsearch capabilities for indexing, searching and correlating large amounts of security and compliance data with other security incidents and third-party security intelligence data. Embedded workflows enable customers to quickly assess risk and access information for remediation, incident analysis and forensic investigations.
 
•
Alerts and Notifications. Creates email notifications to alert customers of new vulnerabilities, malware infections, scan completion, open trouble tickets and system updates.
 
Qualys Cloud Apps
 
Many organizations have an array of heterogeneous point tools that do not interoperate well and are difficult and costly to maintain and integrate, making it difficult for Chief Information Officers (CIOs) and Chief Information Security Officers (CISOs) to obtain a single, unified view of their organization’s security and compliance posture. The Qualys Cloud Platform and its Cloud Apps help organizations escape this tool-fragmentation dilemma by drastically simplifying their security stacks and regaining unimpeded visibility across their IT environment.
 
The Cloud Apps are self-updating, centrally managed and tightly integrated, and cover a broad range of functionality in areas such as IT security, compliance, web application security, asset management and cloud and container security solutions.
 
From inception through December 31, 2021, we have added the following Cloud Apps: VM, PC, PCI, WAS, WAF, CM, SAQ, TP, FIM, GAV, SCA, CS, CI, CSA, CRI, CRA, OCA, PM, VMDR, EDR, SaaSDR, SEM, and CSAM. In 2022, we introduced CAR, XDR and NDR. 
 
We believe that our applications are easy to use and provide our customers with a high level of control because our applications are part of one platform, share a common user interface, utilize the same scanners and agents, access the same collected data, and leverage the same user permissions.
 
Our customers can subscribe to one or more of our IT, security and compliance Apps based on their initial needs and expand their subscriptions over time to new areas within their organization or to additional Qualys solutions. For VMDR, we offer four editions of our Qualys Cloud App: Enterprise for large enterprises, Express for medium-sized businesses, Express Lite for small-sized businesses, and Scan-on-Behalf for Scan-on-Behalf customers. For all other Qualys Cloud Apps, we offer four editions: Enterprise for large enterprises, Express for medium-sized businesses, Express Lite for small-sized businesses, and Consulting Edition for consultants, consulting organizations and Managed Service Providers (MSPs).
 
Many of our customers use multiple Cloud Apps to develop a more complete understanding of their respective environment’s IT, security and compliance posture. The Qualys Cloud Platform currently provides the following Cloud Apps to our customers:
 
8
Table of Contents
 
IT Security
 
Vulnerability Management (VM): VM is an industry leading and award-winning solution that automates network auditing and vulnerability management across an organization, including network discovery and mapping, asset management, vulnerability reporting and remediation tracking. Driven by our comprehensive knowledge base of known vulnerabilities, VM enables cost-effective protection against vulnerabilities without substantial resource deployment.
 
Vulnerability Management, Detection and Response (VMDR): VMDR enables organizations to automatically discover every asset in their environment, including unmanaged assets appearing on the network, inventory all hardware and software, and classify and tag critical assets. VMDR continuously assesses these assets for the latest vulnerabilities and applies the latest threat intel analysis to prioritize actively exploitable vulnerabilities. VMDR automatically detects the latest superseding patch for the vulnerable asset and easily deploys it for remediation. Finally, VMDR quantifies risk across vulnerabilities, assets and groups of assets helping organizations proactively reduce cyber risk exposure and track cyber risk reduction over time. By delivering all this in a single app workflow, VMDR automates the entire process and significantly accelerates an organization’s ability to respond to threats, thus preventing possible exploitation.
 
Threat Protection (TP): Thousands of new vulnerabilities are disclosed annually. With TP, customers can pinpoint their most critical threats and identify what they need to remediate first. TP continuously correlates external threat information against a customer's vulnerabilities and IT asset inventory, so customers know which threats pose the greatest risk to their organization at any given time. As Qualys engineers continuously validate and rate new threats from internal and external sources, TP’s live feed displays the latest vulnerability disclosures and maps them to customers’ impacted IT assets. Customers can see the assets affected by each threat, and drill down into details.
 
Continuous Monitoring (CM): Built on top of VM, CM is a next-generation cloud service that can detect network threats and unexpected changes before they turn into breaches. Whenever CM spots an anomaly in a network, it immediately sends targeted, informative alerts to the right people for each situation and each machine. CM tracks what happens throughout public perimeters, internal networks, and cloud environments - anywhere in the world.
 
Patch Management (PM): PM provides automated patch deployment capabilities for Windows, Linux, Mac and third party software by correlating vulnerabilities and the right set of remediation including patches and configuration fixes. It continuously gathers and uploads telemetry about installed software, open vulnerabilities and missing patches to the Qualys Cloud Platform. The resulting shared visibility of assets and their posture enables IT and security teams to collaborate using common vulnerability-centric terminology and provides a consistent data set to analyze, prioritize, deploy and verify patches more efficiently. 
 
Multi-Vector Endpoint Detection and Response (EDR): Traditional endpoint detection and response solutions focus only on endpoint activity to detect attacks. As a result, they lack the full context to analyze attacks accurately. This leads to an incomplete picture and a high rate of false positives and negatives, requiring organizations to use multiple point solutions and large incident response teams. Qualys fills the gaps by bringing a new multi-vector approach and the unifying power of its highly scalable Cloud Platform to EDR, providing vital context and comprehensive visibility to the entire attack chain, from prevention to detection to response. EDR unifies different context vectors like asset discovery, rich normalized software inventory, end-of-life visibility, vulnerabilities and exploits, misconfigurations, in-depth endpoint telemetry, and network reachability with a powerful backend to correlate it all for accurate assessment, detection and response.
 
Certificate Assessment (CRA): CRA assesses digital certificates and Transport Layer Security (TLS) configurations. CRA generates certificate instance grades using a straightforward methodology that allows administrators to assess often overlooked server SSL/TLS configurations without having to become SSL experts. It also identifies out-of-policy certificates with weak signatures or key length and shows how many unique Certificate Authorities were found in the environment and how many certificates each one issued.
 
SaaS Detection and Response (SaaSDR): SaaSDR leverages the Qualys Cloud platform to provide continuous visibility into SaaS applications such as Office 365, Salesforce and Zoom for configuration posture management, activity monitoring and data security insights.
 
Secure Enterprise Mobility (SEM): SEM extends the power of VMDR for in-depth inventory of mobile devices and their data, real time vulnerability and misconfiguration detection, and built-in remediation with patch orchestration for all Android and iOS/iPadOS devices across the enterprise.
 
         Custom Assessment and Remediation (CAR): Custom Assessment and Remediation opens the Qualys Cloud Platform for security architects allowing the creation of custom scripts in popular scripting languages, user-defined controls and automation, all seamlessly integrated within existing programs to quickly assess, respond to and remediate threats across global hybrid environments.   
 
         Context Extended Detection and Response (XDR): XDR provides context and clarity to enterprise security operations through risk-focused, single pane of glass visibility and control to improve enterprise-wide threat detection and incident response. It leverages the Cloud Platform's response capabilities - patching, fixing misconfigurations, killing processes and network connections, and quarantining hosts - to comprehensively remediate cyber security threats identified by Qualys XDR.  
 
         Network Detection and Response (NDR): Network detection and response monitors network traffic and analyzes it using deep learning artificial intelligence (AI) to detect cyber threats in data centers and in the public cloud.  The solution is able to detect both known and publicly undisclosed threats in real time. 
 
 
 
Compliance
 
Policy Compliance (PC): PC performs automated security configuration assessments on IT systems throughout a network, helping to reduce risk and continuously ensure compliance with internal policies and external regulations. PC leverages out-of-the-box library content to fast-track compliance assessments using industry-recommended best practices. PC also provides a centralized, interactive console for specifying baseline standards for different hosts. By automating requirement evaluation against multiple standards for operating systems, network devices, databases and server applications, PC enables the quick identification of security issues and works to prevent configuration drift. PC works to prioritize and track remediation and exceptions, while demonstrating a repeatable auditable process for compliance management.
 
Security Configuration Assessment (SCA): SCA provides automatic assessment of IT assets’ configurations using the latest Center for Internet Security (CIS) Benchmarks for operating systems, databases, applications and network devices. SCA provides intuitive workflows for assessing, monitoring, reporting and remediating security-related configuration issues. SCA’s CIS assessments are provided via a web-based user interface and delivered from the Qualys Cloud Platform, enabling centralized management with minimal deployment overhead. SCA users can automatically create downloadable reports and view dashboards.
 
9
Table of Contents
 
PCI Compliance (PCI): PCI streamlines and automates compliance with PCI DSS (Payment Card Industry Data Security Standard) requirements for protecting the collection, storage, processing and transmission of cardholder data. As an Approved Scanning Vendor, Qualys has been authorized by the PCI Security Standards Council to conduct the required quarterly scans. PCI scans all Internet-facing networks and systems with Six Sigma (99.9996%) accuracy, generates reports and provides detailed patching instructions. An auto-submission feature completes the compliance process once remediation is completed.
 
File Integrity Monitoring (FIM): FIM logs and centrally tracks file change events on common enterprise operating systems in organizations of all sizes. FIM provides customers with a simple way to achieve centralized cloud-based visibility of activity resulting from normal patching and administrative tasks, change control exceptions or violations, or malicious activity - then reports on that system activity as part of compliance mandates. FIM collects the critical details needed to quickly identify changes and root out activity that violates policy or is potentially malicious. FIM helps customers to comply with change control policy enforcement and change monitoring requirements.
 
Security Assessment Questionnaire (SAQ): SAQ automates and streamlines third-party and internal risk assessment processes, obviating the need to perform such processes manually via email and spreadsheets. SAQ easily designs surveys to assess procedural controls of IT and security policies and practices. SAQ automates the launch and monitoring of assessment campaigns, making the process agile, accurate, comprehensive, centralized, scalable and uniform across an organization. SAQ also provides tools for displaying, analyzing and acting on collected data, enabling the assessment of compliance with industry standards, regulations and internal policies of third parties, like vendors and partners, and of employees.
 
Out-of-Band Configuration Assessment (OCA): The OCA sensor and Cloud App allows customers to achieve complete visibility of all known IT infrastructure by pushing vulnerability and configuration data to the Qualys Cloud Platform from systems that are otherwise difficult to assess, such as highly locked-down systems, systems on disconnected or “air gap” networks, or in environments that are highly sensitive to scans. OCA’s expanded data collection approach significantly broadens the types of technologies supported by the Qualys Cloud Platform and provides deeper assessment of configuration so that customers have better visibility into potentially critical vulnerabilities and misconfigurations across their entire environment.
 
Web Application Security
 
Web Application Scanning (WAS): WAS continuously discovers and catalogs web applications – including new and unknown ones – and detects vulnerabilities and misconfigurations in web apps and APIs. Scaling to thousands of scans, it conducts incisive, thorough and precise testing of browser-based web apps, mobile app backends, and Internet of things (IoT) services. Its seamless integration with the Qualys Web Application Firewall (WAF) enables verification of attack protection, ticket creation and one click mitigation of vulnerabilities. WAS' powerful API enables integration with other systems and allows teams to detect issues within DevOps environments early in the application development process. Bundled malware detection capability with WAS uses reputational, behavioral, antivirus, and heuristic analyses to identify and alert on malware infecting a user's websites. By Integrating WAS with manual testing tools and bug bounty solutions, customers can build a comprehensive web application vulnerability testing program.
 
Web Application Firewall (WAF): WAF permits the reduction of application security cost and complexity with a unified platform to prevent any attempt to exploit vulnerabilities. Simple, scalable and adaptive, WAF enables the quick blocking of attacks, prevents disclosure of sensitive information, and controls when and where customer applications are accessed. WAF and WAS work together seamlessly. Customers scan web apps with WAS, deploy one-click virtual patches if needed in WAF, and manage it all from a centralized cloud-based portal. WAF can be deployed in minutes on prem or in the cloud, as a virtual machine or a container, supports load-balancing as well as TLS offloading, and does not require special hardware.
 
Asset Management
 
Global AssetView (GAV): GAV constantly gathers information on all assets, including system and hardware details, running services, open ports, installed software and user accounts. Asset discovery and inventory collection is done through a combination of Qualys network scanners, Cloud Agents and passive scanners, which together collect comprehensive data from on-premises or cloud infrastructure as well as remote endpoints. In order to create consistent and uniform asset data, GAV normalizes raw discovery data to standardize every manufacturer name, product name, model and software version using Qualys’ ever-evolving technology catalog as a reference. This catalog automatically extends IT asset inventory with non-discoverable metadata such as hardware and software release dates, end of life dates, and license categories. This new data layer allows teams to detect issues such as unauthorized software, outdated hardware or end-of-life software, which can help properly tag, support, and secure business-critical assets. 
 
10
Table of Contents
 
Cybersecurity Asset Management (CSAM): CSAM is an all-in-one solution that leverages the power of the Qualys Cloud Platform with its multiple native sensors and CMDB synchronization to continuously inventory known and unknown assets, discover installed applications, and overlay business and risk context to establish asset criticality. It identifies unauthorized or end-of-life and end-of-service software and the absence of required security tools, and assesses the health of the attack surface. Further, CSAM enables response options with threat alerts and software removal and delivers regulatory reporting in support of FedRAMP, PCI-DSS and other mandates.  CSAM includes External Attack Surface Management, which allows discovery of internet facing unknown assets.  
 
Certificate Inventory (CRI): CRI continuously scans global IT assets from a single console to discover internal and external certificates issued from any certificate authority across all enterprise IT assets, both on premise and in the cloud. As a result, certificates can be renewed before they expire, which stops certificate-related outages and improves availability. It collects all certificate, vulnerability and configuration data required for certificate inventory and analysis. CRI also reveals how many certificates are out of compliance or do not follow organizational policies for key length, for signature algorithms or for the use of trusted and approved Certificate Authorities through the use of highly customizable dashboards and provides users a comprehensive overview of Qualys SSL Labs-caliber certificate grades for internal and externally facing certificates.
 
Cloud / Container Security
 
Cloud Inventory (CI): CI delivers continuous visibility into public cloud accounts. In one single-pane view, it inventories virtual machines, storage buckets, databases, security groups, Access Control Lists (ACLs), Elastic Load Balancers (ELBs) and users – across all regions, multiple accounts and multiple cloud platforms. CI continuously tracks assets and enables users to quickly understand the topography of their cloud environment and uncover the root cause of incidents.
 
Cloud Security Assessment (CSA): CSA provides a continuous assessment of the security posture of an organization’s cloud resources against misconfigurations, malicious behavior, and nonstandard deployments. CSA evaluates resources against CIS benchmarks and best practices to identify misconfigured storage buckets, security groups, Relational Database Service, exposing data and the resource for public exploitation. CSA correlates host vulnerabilities and compliance data into intelligent insights which allow users to quickly detect risks throughout their complex cloud environments. With CSA, users gain real-time visibility into their up-to-date security and compliance posture of public clouds in one single-pane view.
 
Container Security (CS): CS delivers container-native visibility and protection throughout the entire lifecycle of containerized applications. It incorporates scanning of container images for software composition and enforcement of hardened container stack configurations for continuous policy compliance, whether the images are on the build machines, in the container registries or in the runtime cluster nodes. CS uses a unique 'layered-in' approach to provide deep visibility into all the application activities and automatically creates a behavior profile, which is enforced on each container for runtime protection. By integrating with continuous integration and continuous delivery pipelines and toolchains, CS enables DevSecOps processes and transparent enforcement of security and compliance without compromising the speed and agility of containers and serverless deployment models. This leads to significant cost benefits for enterprises compared to certain legacy security solutions.
 
Free Services
 
We also offer organizations of all sizes free security and compliance services based on the Qualys Cloud Platform:
 
•
Qualys Global AssetView app automatically creates a continuous, real-time inventory of known and unknown assets throughout a user's global IT footprint across on-premises, endpoints, multi-cloud, mobile, containers, operational technology and IoT. The app also automatically normalizes and categorizes assets to ensure clean, reliable, and consistent data. In-depth asset details provide fine-grained visibility on the system, services, installed software, network, and users. It also detects any device that connects to a user's networks, via passive scanning technology. Upon an unknown device detection, users can install a light-weight Qualys self-updating agent (3MB) to turn the device into a managed device or launch a vulnerability scan.
 
•
Qualys Cloud Inventory continuously discovers and tracks assets and resources across public cloud deployments to provide users both real-time and historical views of cloud inventory. It collects metadata about cloud assets and resources to help users understand the relationships between public cloud assets and resources across different dimensions and then discover their threat posture based on those attributes and relationships. Cloud Inventory is limited to three accounts per public cloud platform.
 
•
Qualys Certificate Inventory inventories and assesses all Internet-facing certificates to generate SSL/TLS configuration grades, identifies the certificate issuer and tracks certificate expirations to help stop expired and expiring certificates from interrupting critical business functions.
 
11
Table of Contents
 
Our Growth Strategy
 
We intend to strengthen our leadership position as a trusted provider of cloud-based IT, security and compliance solutions. The key elements of our growth strategy are:
 
•
Continue to innovate and enhance our cloud platform and suite of solutions. We intend to continue to make significant investments in research and development to extend our cloud platform’s functionality by developing new security solutions and capabilities and further enhancing our existing suite of solutions. From inception through December 31, 2021, we have added the following Cloud Apps: PC, PCI, WAS, WAF, CM, SAQ, TP, FIM, GAV, SCA, CS, CI, CSA, CRI, CRA, OCA, PM, VMDR, EDR, SaaSDR, SEM, and CSAM. In 2022, we introduced CAR, XDR and NDR. 
 
•
Expand the use of our suite of solutions by our large and diverse customer base. With more than 10,000 customers, across many industries and geographies, we believe we have a significant opportunity to sell additional solutions to our customers and expand their use of our suite of solutions. Because our customers typically initially deploy one or two of our solutions in select parts of their IT infrastructures, our existing customers serve as a strong source of new sales as they expand their scope and increase their subscriptions or choose to adopt additional solutions from our integrated suite of IT, security and compliance offerings. In this regard, we continue to expand our sales execution and marketing functions to increase adoption of our newly developed solutions among our existing customers.
 
•
Drive new customer growth and broaden our global reach. We are pursuing new customers by targeting key accounts, releasing free IT, security and compliance services and expanding both our sales and marketing organization and network of channel partners. We will continue to seek to make significant investments to encourage organizations to replace their existing security products with our cloud solutions. We intend to expand our relationships with key security consulting organizations, managed security service providers and value-added resellers to accelerate the adoption of our cloud platform. We seek to strengthen existing relationships as well as establish new relationships to increase the distribution and market awareness of our cloud platform and target new geographic regions. We also plan to partner with such security providers that can host our private cloud offering within their shared cloud platforms, helping us expand our reach in new markets and new geographies.
 
•
Selectively pursue technology acquisitions to bolster our capabilities and leadership position. We may explore acquisitions that are complementary to and can expand the functionality of our cloud platform. We may also seek to acquire development teams to supplement our own personnel and acquire technology to increase the breadth of our cloud-based IT, security and compliance solutions. In 2022, we acquired certain intangible assets of Blue Hexagon Inc., enabling us to leverage our cloud platform with AI/machine learning to uncover behavior patterns including active vulnerability exploitation, identification of advanced network threats, and adaptive risk mitigation across all assets and applications.  In 2021, we acquired certain intangible assets of Kandor Soft Labs Private Ltd. (TotalCloud), strengthening our cloud security solution by allowing customers to build user-defined workflows for custom policies and execute them on-demand for simplified security and compliance. In 2020, we acquired certain intangible assets of Spell Security Private Limited (Spell Security), expanding our endpoint behavior detection, threat hunting, malware research and multi-layered response capabilities for our EDR application.
 
Our Customers
 
We market and sell our solutions to enterprises, government entities and small and medium-sized businesses across a broad range of industries, including education, financial services, government, healthcare, insurance, manufacturing, media, retail, technology and utilities. As of December 31, 2022 , we had over 10,000 customers worldwide, including a majority of each of the Forbes Global 100 and Fortune 100. In each of 2022 , 2021 and 2020 , no one customer accounted for more than 10% of our revenues. In 2022 , 2021 and 2020 , 60% , 61% and 63%, respectively, of our revenues were derived from customers in the United States based on our customers' billing addresses. We sell our solutions to enterprises and government entities primarily through our field sales force and to small and medium-sized businesses through our inside sales force. We generate a significant portion of sales through our channel partners, including managed security service providers, value-added resellers and consulting firms in the United States and internationally.
 
Sales and Marketing
 
Sales
 
We market and sell our IT, security and compliance solutions to customers directly through our sales teams as well as indirectly through our network of channel partners.
 
12
Table of Contents
 
Our global sales force is organized into a field sales team, which focuses on enterprises, generally including organizations with more than 5,000 employees, and an inside sales team, which focuses on small to medium-sized businesses, which generally include organizations with less than 5,000 employees. Both our field and inside sales teams are divided into three geographic regions, the Americas; Europe, Middle East and Africa; and Asia-Pacific. We also further assign each of our sales teams into groups that focus on adding new customers or managing relationships with existing customers.
 
Our channel partners maintain relationships with their customers throughout the territories in which they operate and provide their customers with services and third-party solutions to help meet those customers’ evolving security and compliance requirements. As such, these partners offer our IT, security and compliance solutions in conjunction with one or more of their own products or services and act as a conduit through which we can connect with these prospective customers to offer our solutions. Our channel partners include security consulting organizations, managed service providers and resellers, such as Accenture, BT Managed Security, Cognizant Technology Solutions, Deutsche Telekom, DXC Technology, Fujitsu, Hindustan Computers Limited (HCL) Technologies, International Business Machines (IBM), Infosys, Nippon Telegraph and Telephone Corporation (NTT), Optiv, Tata Communications, Verizon, Wipro and TD SYNNEX Corporation (TD SYNNEX). Qualys has also established strategic partnerships with leading cloud providers like Amazon Web Services, Microsoft Azure and the Google Cloud Platform.
 
For sales involving a channel partner, the channel partner engages with the prospective customer directly and involves our sales team as needed to assist in developing and closing an order. When a channel partner secures a sale, we sell the associated subscription to the channel partner who in turn resells the subscription to the customer, with the channel partner earning a fee based on the total value of the order. Once the order is completed, we provide these customers with direct access to our solutions and other associated back-office applications, enabling us to establish a direct relationship as part of ensuring customer satisfaction with our solutions. At the end of the subscription term, the channel partner engages with the customer to execute a renewal order, with our sales team providing assistance as required. In 2022, 2021 and 2020, 42%, 41% and 42%, respectively, of our revenues were generated by channel partners.
 
Marketing
 
Our marketing programs include a variety of online marketing, advertising, conferences, events, public relations activities and web-based seminar campaigns targeted at key decision makers within our prospective customers.
 
We have a number of marketing initiatives to build awareness and encourage customer adoption of our solutions. We offer free trials and services to allow prospective customers to experience the quality of our solutions, to learn in detail about the features and functionality of our cloud platform, and to quantify the potential benefits of our solutions.
 
Customer Support
 
Qualys Support delivers 24x7x365 day customer technical support from global centers located in Foster City, California; Raleigh, North Carolina; and Pune, India. We recruit senior level technical personnel and trained subject matter experts who work closely with engineering and operations personnel to resolve issues quickly. Our IT, security and compliance solutions can be deployed easily and are designed to be implemented and operated without the need for significant professional services. We also offer various training programs as part of our subscriptions to all of our customers. In addition, we leverage the insights drawn from our customers to further improve the functionality of our IT, security and compliance solutions. Our mission is to ensure customer satisfaction and play a critical role in retaining and expanding our customer base.
 
13
Table of Contents
 
Research and Development and Operations
 
We devote significant resources to maintain, enhance and add new functionality to our Qualys Cloud Platform and the integrated suite of solutions that we offer. Our development organization consists of agile engineering teams with substantial security expertise in specific areas of our solutions. In addition to our development teams, we also built a sophisticated research team focused on identifying threats and developing signatures for vulnerabilities and compliance checks so that we can provide our customers with daily updates and enable them to scan their assets for the latest threats. We conduct our research and development in the United States, France and India, which gives us access to some of the best research and engineering talent in the world. Our focus remains to attract engineering talent as we continue to add new solutions and improve existing ones.
 
Our development team works closely with our customers and partners to gain valuable insights into their environments and gather feedback for threat research, product development and innovations. We typically release updates to our solutions, including enhancements and new features multiple times a year, and we measure the quality of our scan results on a frequent basis in an effort to maintain the highest level of scan accuracy.
 
The modular architecture of our cloud platform enables our engineering teams to simultaneously work on different features, accelerating the delivery of new functionalities to customers. Our research and development team also works collaboratively with our technical support team to ensure customer satisfaction and with our sales team to accelerate the adoption of our solutions.
 
Shared Cloud Platform Agreements
 
Our shared cloud platform operations are provided by large third-party vendors and are located in the United States, Canada, Switzerland, the Netherlands, United Arab Emirates, Australia, United Kingdom and India. Our shared cloud platform agreements have varying terms through 2025.
 
Competition
 
The expanding capabilities of our IT, security and compliance solutions have enabled us to address a growing array of opportunities in the cloud IT, security and compliance market. We compete with a large and broad array of established and emerging vulnerability management vendors, compliance vendors and data security vendors in a highly fragmented and competitive environment.
 
We compete with large and small public companies, such as Broadcom (Symantec Enterprise Security), CrowdStrike, Palo Alto Networks, Rapid7, and Tenable Holdings, as well as privately held security providers including Axonius, Checkmarx, Flexera, Invicti, Ivanti, Tanium, HelpSystems (Tripwire), Trustwave Holdings and Veracode. We also seek to replace IT, security and compliance solutions that organizations have developed internally. As we continue to extend our cloud platform’s functionality by further developing IT, security and compliance solutions, such as web application scanning and firewalls, we expect to face additional competition in these new markets. Our competitors may also attempt to further expand their presence in the IT, security and compliance market and compete more directly against one or more of our solutions.
 
We believe that the principal competitive factors affecting our markets include product functionality, breadth of offerings, flexibility of delivery models, ease of deployment and use, total cost of ownership, scalability and performance, customer support and extensibility of platform. We believe that our suite of solutions generally competes favorably with respect to these factors. However, many of our primary competitors have greater name recognition, longer operating histories, more established customer relationships, larger marketing budgets and significantly greater resources than we do.
 
14
Table of Contents
 
Intellectual Property
 
We rely on a combination of trade secrets, copyrights, patents and trademarks, as well as contractual protections, to establish and protect our intellectual property rights and protect our proprietary technology. As of December 31, 2022 , we have thirty issued patents, which expire from 2029 to 2040, several pending U.S. patent applications and an exclusive license to four U.S. patents. The inbound license remains in effect until the licensed patents are no longer enforceable, unless the applicable license agreement is first terminated by us or terminated by the licensor for a breach of the agreement or if we undergo certain bankruptcy events. The licenses are currently exclusive and will remain exclusive so long as we make an appropriately-timed written election and pay an annual fixed royalty for ten years thereafter. These exclusive licenses are subject to the licensor’s reservation of certain r ights in the patents and subject to the U.S. government’s reserved rights in the technology. We have a number of registered and unregistered trademarks. We require our employees, consultants and other third parties to enter into confidentiality and proprietary rights agreements and control access to software, documentation and other proprietary information. We view our trade secrets and know-how as a significant component of our intellectual property assets, as we have spent years designing and developing the Qualys Cloud Platform, which we believe differentiates us from our competitors.
 
We expect that software and other solutions in our industry may be subject to third-party infringement claims as the number of competitors grows and the functionality of products in different industry segments overlaps. Any of these third parties might make a claim of infringement against us at any time.
 
Human Capital Resources
 
We take a holistic approach to our human capital management strategy, striving to create a culture where talented people want to come to work, develop their careers, become leaders, and make a difference for all our stakeholders and communities. Doing the right thing for our people, our communities and our environment upholds the trust of our customers, partners, employees, and stockholders, enabling us to grow our business profitably and meet the diverse needs of our constituents.
 
As of December 31, 2022 , we had 2,143 full-time employees, including 1,062 in research and development, 376 in sales and marketing, 478 in operations and customer support, and 227 in general and administrative. As of December 31, 2022 , approximately 75% of our employees were located outside of the United States, with 66% of our employees located in Pune, India. None of our U.S. employees are covered by collective bargaining agreements. Employees in certain European countries and Brazil have collective bargaining arrangements at the national level. We believe our employee relations are good, and we have not experienced any work stoppages.
 
Diversity and Inclusion
 
We are proud to be a leader in the promotion and practice of diversity and inclusion. In addition to having offices and employees all over the world, we take pride in our cultural diversity. Qualys searches the globe for top talent in an effort to recruit and hire diverse individuals with a variety of skills, experiences, and backgrounds. Our objective is to continue to improve our hiring, development, advancement, and retention of diverse talent and to foster an inclusive environment.
 
Our board of directors and executive team are highly diverse. Two out of our current seven member board of directors are women, one is a man from an underrepresented community, and the board of directors seeks to identify strong candidates who provide a wide range of perspectives, competencies, and knowledge to complement the skills, diversity and experiences of the board of directors. Further, our executive team is gender and ethnically diverse, with more than 50% of the executive team from underrepresented communities.
 
15
Table of Contents
 
Health and Safety
 
We recognize that a healthy environment and safe workplaces are critical to our business, strategy, and communities. We address environmental issues in an integrated manner to encompass protection of the environment as well as the health and safety of our workforce. For example, in response to COVID-19 and the significant increases in remote workforces in March 2020, we mandated a work from home policy to protect our employees and our communities. We also released a free cloud-based remote endpoint protection solution for 60 days that allowed IT and security teams to protect the computers of remote employees and support the health and safety of our communities.
 
During 2022, our workforce gradually transitioned into a hybrid work schedule, which resulted in a significant portion of our workforce working either in-person on a part-time basis, or remotely on a permanent basis. Our top priority remains providing support for our employees, partners, and customers. We are fortunate that the nature of our business allows us to successfully operate in this dynamic hybrid environment. We believe that our hybrid policy will be a key enabler to support the broad needs of critical on-site to remote employees. 
 
We require our employees and managers to participate in myriad training programs directed at maintaining a harassment-free, diverse, and secure workplace. With our diverse employee population, we uphold the rights to work in an environment that promotes equal opportunity and prohibits discriminatory practices against race, color, national origin, ancestry, medical condition, religious creed (including religious dress and grooming practices), marital status, registered domestic partner status, sex, sexual orientation, gender identity and expression, genetic characteristics and information, age, veteran status, or any other protected characteristic. Creating a respectful workplace and preventing harassment to our employees remain our on-going commitment.
 
Compensation and Benefits
 
We provide robust compensation and benefits to our employees. In addition to competitive base salaries, all qualified employees are eligible for variable pay and equity awards.
 
To support the health and wellness of our workforce, we offer premium health coverage with minimal out-of-pocket contributions for our global employees.
 
Training and Development
 
We have experience with managing and developing a rapidly growing employee base. We believe every employee makes a difference, so we empower them in their roles and support them for maximum professional growth. We assist employees in achieving their career goals by helping them improve their skillsets and transition to other challenging roles. To support career growth inside and outside Qualys, we offer free self-paced or instructor-led certified training on core Qualys topics giving employees and non-employees an opportunity to achieve certifications.
 
Available Information
 
Our principal executive offices are located at 919 E. Hillsdale Blvd., 4th Floor, Foster City, California 94404. The telephone number of our principal executive offices is (650) 801-6100, and our main corporate website is www.qualys.com . Information contained on, or that can be accessed through, our website, does not constitute part of this Annual Report on Form 10-K and inclusion of our website address in this Annual Report on Form 10-K is an inactive textual reference only.
 
We make available our Annual Reports on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K and amendments to those reports filed or furnished pursuant to Section 13(a) or Section 15(d) of the Securities Exchange Act of 1934, as amended, free of charge on our website, www.qualys.com as soon as reasonably practicable after they are electronically filed with or furnished to the SEC. Additionally, copies of materials filed by us with the SEC may be accessed at the SEC's website, www.sec.gov .
 
16
Table of Contents