Qualys, Inc. (QLYS)

Qualys reported second-quarter 2026 revenue of $182.2 million on August 4, 2026, up 11% from $164.1 million a year earlier 1. Net income under US accounting rules (GAAP) was $52.4 million, or $1.50 per diluted share 1.

Operating cash flow rose 77% to $59.6 million, and GAAP operating income reached $61.9 million, 34% of revenue 1. Gross margin was 83%, against 82% a year earlier 1.

Management now expects full-year 2026 revenue of $732.0 million to $738.0 million, up from its earlier range of $721.0 million to $727.0 million 1. For the third quarter it expects $185.5 million to $187.5 million 1.

The chief executive, Sumedh Thakar, pointed to adoption of its AI-native Risk Operations Center, a growing federal pipeline and early engagement with QFlex as signs of demand 1. The 10-Q adds that existing customers supplied 97% of the quarter's revenue increase and new customers only 3% 2.

The newest quarterly report on file covers the period ended June 30, 2026 2. In the same quarter its TotalCloud product achieved FedRAMP High authorization, the top level of the US government's cloud-security program, sponsored by the Drug Enforcement Administration 16.

Qualys was founded and incorporated in December 1999 and launched its first cloud product, Vulnerability Management (scanning computers for known security weaknesses), in 2000 3. Today it sells software as a service, mostly as renewable annual subscriptions 3. Customers are usually billed for the whole term up front, and the company recognizes that money as revenue evenly across the term 3.

As Vulnerability Management gained acceptance, the company added products for the growing IT, security and compliance needs of its customers 3. Customers can now subscribe to more than 20 Cloud Apps, and many use several 3.

One acquisition appears in the filed record: Blue Hexagon, which the 10-K dates to October 4, 2022 3. The company also says it may selectively pursue technology acquisitions and acquire development teams 3.

Revenue grew from $554.5 million in 2023 to $607.6 million in 2024 and $669.1 million in 2025 3. In 2025 it rose 10%, or $61.6 million, which the company attributes to demand for its subscription services 3.

Most of that growth came from customers it already had: 76% of the 2025 increase, with 24% from new customers 3. Foreign customers supplied 63% of the increase 3.

The mix has moved abroad: customers in the United States produced 60% of revenue in 2023, 58% in 2024 and 56% in 2025 3. Partners such as resellers and security service providers supplied 49% of 2025 revenue and 80% of its increase 3.

Profit grew with revenue 3. Operating income was $163.1 million in 2023, $187.2 million in 2024 and $222.0 million in 2025, and net income was $151.6 million, $173.7 million and $198.3 million 3.

Costs rose more slowly than sales 3. Cost of revenues rose 3% to $114.8 million in 2025, mainly on $4.7 million more personnel cost, partly offset by $3.3 million less depreciation and amortization 3.

Cash from operations was $309.4 million in 2025 and $244.1 million in 2024 3. Deferred revenue, money billed but not yet earned, added $21.7 million in 2025 and $30.8 million in 2024 3. The 10-K lists tariffs, high interest rates and extended sales cycles among uncertainties that could lead customers to cut security spending 3.

The company returns cash through share repurchases: $170.8 million in 2023, $139.9 million in 2024 and $183.4 million in 2025 3. The board first authorized a $100.0 million program on February 12, 2018, and the total authorized reached $1.6 billion after a further $200.0 million on February 5, 2026 3.

The latest stretch is the first half of 2026, when revenue was $357.8 million, up 10% from $324.0 million a year earlier 2. Net income for the half was $103.0 million, against $94.8 million 2.

What the company sells

Qualys sells a cloud platform that finds a customer's computers and software, spots their security weaknesses, ranks the risk and helps fix it 3. The 10-K says more than 10,000 customers use it, including a majority of the Forbes Global 100 3. It is delivered through 15 global shared cloud platforms or a private version placed inside the customer's own systems 3.

A subscription fee covers an unlimited number of scans for a specified number of devices or web applications 3.

Asset inventory and the risk score

Cybersecurity Asset Management (CSAM) keeps a running inventory of known and unknown assets, flags software that is out of date or unauthorized, and includes External Attack Surface Management for internet-facing assets nobody listed 3.

Enterprise TruRisk Management (ETM) pulls security data from Qualys and third-party tools into one view and expresses cyber risk in financial terms using the TruRisk score 3. The 10-K says ETM correlates signals across more than 25 threat intelligence feeds 3.

Finding and ranking weaknesses

Vulnerability Management, Detection and Response (VMDR) discovers assets, checks them against the latest known weaknesses and ranks the ones attackers are actively using 3. Total Application Security tests websites, mobile app back ends and APIs, the links software uses to talk to other software 3.

Fixing, detecting and proving compliance

Patch Management deploys fixes automatically on Windows, Linux and Mac systems and third-party software 3. Custom Assessment and Remediation lets security teams write their own scripts to respond to threats 3.

Multi-Vector Endpoint Detection and Response combines asset, software, vulnerability and network data to judge attacks on laptops and servers 3. File Integrity Monitoring tracks file changes to meet compliance rules 3.

Policy Audit checks system settings against 900+ pre-built policies, 20,000 controls and 350 supported technologies, covering over 90 regulations and frameworks 3.

Cloud security and government work

TotalCloud is a cloud-native application protection platform (CNAPP), one product that watches a customer's cloud accounts for misconfigurations and threats 3.

On May 14, 2026, Qualys announced that TotalCloud achieved FedRAMP High authorization, sponsored by the Drug Enforcement Administration 61. It extends the Qualys Government Platform's authorization to cloud-native application protection 1.

Qualys also gives away Global AssetView, an asset inventory, and Certificate Inventory, which tracks expiring internet-facing certificates 3.

Where the revenue comes from

Customers in the United States produced 56% of 2025 revenue 3. By sales channel, 51% was direct and 49% came through partners 3.

In the quarter ended June 30, 2026, 46% of revenue was direct and 54% came from partners 2.

People and places

Sumedh Thakar is president and chief executive, and Joo Mi Kim is chief financial officer 17.

On December 31, 2025, Qualys had 2,625 full-time employees, among them 1,262 in research and development and 524 in sales and marketing 3. About 78% worked outside the United States, and 70% of employees were located in India 3.

Headquarters are a 76,922 square-foot leased facility in Foster City, California, and the company leases 321,333 square feet in Pune, India 3. It runs shared cloud platforms at third-party facilities in countries including Canada, Switzerland, the Netherlands and Australia 3.

Rivals

The 10-K names CrowdStrike, Palo Alto Networks, Rapid7 and Tenable Holdings as public rivals, and Invicti, Tanium and Wiz as private ones 3. The 10-Q says Google acquired Wiz in March 2026 2.

Problems and risks

As of December 31, 2025, the company said there had not been a reasonable possibility of a material loss from any ongoing legal proceeding 3. No single customer accounted for more than 10% of revenue in 2025, 2024 or 2023 3.

The 10-K warns that FedRAMP and other government certification rules may change and could restrict sales to government customers until Qualys attains the revised certification 3.

The umbrella, in words

The brand is Qualys, with its Enterprise TruRisk Platform and the Qualys Cloud Apps described above 3. The list of subsidiaries is filed as Exhibit 21.1 to the 10-K 3.

The record names one purchase, Blue Hexagon, which the 10-K dates to October 4, 2022 3. The business highlights also name agreements, not ownership: a joint offering with Converge, which offers cyber insurance, and collaboration with Anthropic Project Glasswing and OpenAI's Trusted Access for Cyber program 1.

The properties are leases: Foster City to April 30, 2034, and Pune through June 2031 3.

BlackRock reported owning 5,090,379 shares and Vanguard 4,181,323 shares, each in a Schedule 13G/A cited in the proxy statement filed April 22, 2026 4. The chief executive, Thakar, held 142,682 shares himself as of April 14, 2026 4.

The board has seven members in three classes, and stockholders elected three Class II directors at the annual meeting on June 10, 2026 5.

For the third quarter of 2026, management expects revenue of $185.5 million to $187.5 million, or 9% to 10% growth, and GAAP earnings of $1.43 to $1.50 per diluted share 1.

For the full year, management expects GAAP earnings of $5.76 to $5.90 per diluted share, up from an earlier $5.40 to $5.61, and non-GAAP earnings of $7.74 to $7.88 1.

Those estimates rest on about 35.2 million diluted shares for the year and 35.0 million for the third quarter 1.

The 10-Q says the company expects revenue growth from new and existing customers to continue 2. It also expects to keep using cash to repurchase shares in 2026, with about $229.8 million left under the program on June 30, 2026 2.

Its stated growth plan has four parts: keep investing in research and development, sell more products to its more than 10,000 customers, win new customers and channel partners, and selectively pursue technology acquisitions 3.

Thakar said in the August 4, 2026 release that the quarter's achievements "bolster our confidence in reaccelerating long-term growth in the business" 1.

Two directors, Jeffrey Hank and Thakar, have terms that expire at the 2027 annual meeting 5. The 2026 meeting also approved the amended 2012 Equity Incentive Plan 5.

The 10-K says the company expects to keep expanding its shared cloud platforms and its customer support teams, which it expects to raise the cost of revenues in dollars 3. It also expects research and development and sales and marketing spending to keep rising in dollars 3.

The company also plans to partner with security providers that can host its private cloud offering, to reach new markets and geographies 3.

Shared cloud platform agreements run with varying terms through 2030, and the Foster City lease runs to April 30, 2034 3.