0001107843-26-000008
SEC filingRevenue grew 10% YoY with gross margin expansion to 83%, driven by existing customer renewals and partner-led growth.
Qualys, Inc. is a leading provider of a cloud-based platform delivering information technology (IT), security and compliance solutions. Its integrated suite, the Qualys Enterprise TruRisk Platform, enables customers to identify and manage assets, collect and analyze security data, discover and prioritize vulnerabilities, quantify cyber risk, and implement and verify remediation actions. The company was founded in December 1999 and initially launched its Vulnerability Management solution in 2000. Today, Qualys serves over 10,000 customers worldwide, including a majority of the Forbes Global 100, and has grown revenues to $669.1 million in 2025.
The Business section does not disclose formal reporting segments. Qualys operates as a single platform business, offering a suite of cloud-based solutions referred to as Qualys Cloud Apps. Revenue is derived from subscription fees for access to these solutions, with no segment-level breakdown provided.
Qualys' platform is delivered via 15 global shared cloud platforms or through a private cloud platform (PCP) for customers. Key products include: Cybersecurity Asset Management (CSAM) for continuous asset inventory; Enterprise TruRisk Management (ETM) for unified cyber risk visibility; Vulnerability Management, Detection and Response (VMDR) for automated vulnerability lifecycle management; Total Application Security (TAS) for web app and API security; Patch Management (PM) for automated patching; Multi-Vector Endpoint Detection and Response (EDR) for threat detection; Policy Audit (PA) for compliance assessments; File Integrity Monitoring (FIM) for change tracking; and TotalCloud (TC) for cloud-native protection (CNAPP). Free services like Global AssetView and Certificate Inventory are also offered.
Qualys markets and sells through a global sales force organized into field (enterprise) and inside (SMB) teams, divided into Americas, EMEA, and APAC. Channel partners—including security consulting organizations, cloud providers, managed service providers, and resellers—generated 49% of revenues in 2025. No customer accounts for more than 10% of revenues. Customer support is provided 24/7/365 from centers in Foster City, CA; Raleigh, NC; and Pune, India.
Qualys faces competition from established and emerging vulnerability management, compliance, and data security vendors. Named competitors include CrowdStrike, Palo Alto Networks, Rapid7, Tenable Holdings, and privately held Invicti, Tanium, and Wiz (which announced a pending acquisition by Google). Competitive factors include product functionality, breadth of offerings, deployment ease, total cost of ownership, and scalability.
Qualys' growth strategy comprises four pillars: (1) continued innovation and enhancement of the platform and solutions; (2) expanding usage within the existing customer base by selling additional subscriptions; (3) driving new customer growth and global reach through targeted sales, free services, and channel partnerships; and (4) selectively pursuing technology acquisitions to strengthen capabilities, including in deep learning AI and machine learning.
As of December 31, 2025, Qualys employed 2,625 full-time individuals, with 1,262 in R&D, 524 in sales and marketing, 592 in operations and customer support, and 247 in general and administrative roles. Approximately 78% of employees are outside the United States, with 70% in India. The company emphasizes talent development, diversity and inclusion, work-life balance, and community engagement through various initiatives.
Qualys reported total revenues of $669.1 million for the year ended December 31, 2025, a 10% increase from $607.6 million in 2024. The growth was primarily driven by increased demand for subscription services, with 76% of the incremental revenue coming from existing customers and 24% from new customers. Geographically, 37% of the growth came from the U.S. and 63% from international markets. Partner channels contributed 80% of the revenue increase, while direct sales contributed 20%.
Cost of revenues increased by only 3% to $114.8 million, largely due to a $4.7 million rise in personnel costs and $1.9 million in license expenses, partially offset by a $3.3 million decrease in depreciation and amortization. As a result, gross margin improved to 83% from 82% in the prior year.
Operating expenses grew at a slower pace than revenue. Research and development expenses rose 5% to $117.3 million, reflecting increased headcount and incentive compensation. Sales and marketing expenses increased 12% to $143.5 million, driven by higher personnel costs, marketing spend, and travel. General and administrative expenses grew 4% to $71.6 million, primarily due to personnel costs and license fees, partially offset by higher overhead allocations to other departments. Total operating expenses as a percentage of revenue decreased from 51% to 50%, leading to an operating margin of 33% compared to 31% in 2024.
Net income rose to $198.3 million (30% of revenue) from $173.7 million (29%) in 2024, a 14% increase. Adjusted EBITDA was $313.4 million, representing a 47% margin, consistent with the prior year.
Qualys operates as a single reporting segment. The MD&A highlights the revenue mix between direct and partner channels: 51% direct and 49% through partners in 2025, with partners contributing a disproportionate 80% of the revenue growth. International markets (outside U.S.) accounted for 63% of the incremental revenue, underscoring the company's expanding global footprint.
Management expects continued revenue growth from both new and existing customers, supported by strong market demand for its cloud-based IT, security, and compliance solutions. The company plans to maintain investments in research and development, sales and marketing, and general and administrative functions, which are expected to increase in absolute dollars. Capital expenditures for 2026 are projected to be between $8 million and $12 million. Additionally, on February 5, 2026, the Board authorized an additional $200 million share repurchase program, bringing total authorization to $1.6 billion. No specific quantitative guidance for revenue or earnings was provided.
As of December 31, 2025, Qualys held $250.3M in cash and cash equivalents and $446.5M in marketable securities (short- and long-term combined), totaling $696.8M in liquid assets. The company has no debt. Stockholders' equity stood at $561.2M. Deferred revenue (current and noncurrent) was $417.4M, reflecting the subscription-based model.
Purchase commitments for goods and services amounted to $41.3M as of year-end. The obligation schedule: $28.1M due within one year, $12.6M in years 1-3, and $0.7M beyond 3 years. No other material contractual obligations were disclosed.
Qualys returned $182.9M to shareholders through share repurchases in 2025, buying 1.4 million shares. As of December 31, 2025, $160.5M remained under the buyback program. On February 5, 2026, the Board authorized an additional $200.0M increase. The company does not pay dividends and has no debt. Capital expenditures were $5.0M in 2025, primarily for property and equipment.
Qualys operates as a single segment. Revenues were $669.1M in 2025, split 56% domestic ($377.5M) and 44% foreign ($291.7M). The CODM evaluates performance using consolidated net income ($198.3M for 2025). No further segment-level operating income or margins are disclosed in the notes.
Qualys faces elevated cybersecurity risks from targeted attacks due to its security solutions nature. The adoption of AI/ML technologies introduces new vulnerabilities and regulatory scrutiny. Privacy regulations (GDPR, CCPA, emerging AI laws) impose compliance burdens and potential fines. The company has experienced security incidents and continues to invest in defenses.
Competition is intense with established players (CrowdStrike, Tenable, Palo Alto Networks) and new entrants (Wiz). Pricing pressure may compress margins. Qualys differentiates via cloud platform breadth but risks losing market share if competitors bundle offerings more effectively.
Economic weakness, inflation, tariffs, and geopolitical conflicts (Ukraine, Middle East) dampen IT spending. The company notes longer sales cycles since 2023. Currency fluctuations (22% revenue in foreign currencies) add volatility.
Dependence on channel partners (49% of revenue) and third-party cloud infrastructure creates concentration risk. Sales cycles of 6-18 months make revenue unpredictable. Global operations (78% employees abroad) expose to regulatory and currency risks.
Export controls, tariffs, and sanctions affect international sales. Data transfer mechanisms (EU-US Data Privacy Framework) face legal challenges. Open source software licenses could force source code disclosure. Intellectual property litigation is a constant threat.
Research and development investments may not yield timely products. Acquisitions carry integration risks. Share repurchases ($1.6B authorized) reduce cash but may not enhance value. The company has maintained profitability but future growth is uncertain.
The provided document excerpt does not contain the cash flow statement. The index references the statement on page 58, but the actual figures are absent. Therefore, no analysis of cash flows is possible.