Qualys, Inc. (QLYS) Business Profile

What it does

Qualys sells cloud-based software that helps organizations find and manage their technology assets, identify security weaknesses and address cyber risk. Its customers include enterprises, government entities and smaller businesses. Founded in 1999 and headquartered in Foster City, Qualys is led by chief executive Sumedh Thakar.

Its Enterprise TruRisk Platform brings together information technology, security and compliance tools. Customers use it to inventory assets such as servers, computers and applications across their own facilities, endpoints, cloud environments, containers and mobile devices. The platform collects security data, identifies and prioritizes vulnerabilities, recommends or implements fixes, and checks whether those fixes were applied.

Qualys offers individual cloud applications for tasks including vulnerability management, patch deployment, asset management, compliance and cloud security. Sensors and software agents collect data from customer environments, while dashboards and reports give different teams access to the information. Customers can also use interfaces that let other software connect to the platform.

Qualys operates shared cloud platforms and offers a private version for customers or partners that want the platform within their own environment. The company also provides free asset inventory and certificate inventory services. In 2026, Qualys introduced InstaScan, designed to identify exposure using data already collected by its sensors, and TotalAI 2.0, which it says gives organizations visibility into their AI environments.

How it makes money

Qualys generated $669.1 million of revenue in 2025 and $182.2 million in the second quarter of 2026.

The company has one reportable segment and sells access to its cloud applications primarily through renewable annual subscriptions. Customers pay for the solutions they use, and a subscription generally permits unlimited scans of a specified number of devices or web applications. Customers can begin with one or more applications and expand to additional products or parts of their organization.

Qualys typically invoices the full subscription amount at the beginning of the term. It records the invoiced amount as deferred revenue until earned, then recognizes revenue over the subscription period. Customers receive support and training as part of their subscriptions.

Some subscriptions include physical or virtual scanner appliances for examining systems behind a customer’s firewall. Those appliances do not function without the subscription and are not sold separately. Qualys also provides equipment to some customers using its private cloud platform; physical appliances and equipment must be returned if the subscription is not renewed.

The company sells directly and through channel partners. In a partner transaction, Qualys sells the subscription to the partner, which resells it to the customer and retains the difference between its purchase and resale prices. Qualys then provides the customer direct access to its software.

In 2026, Qualys made its QFlex purchasing model generally available to enterprise customers. The company says it gives customers flexibility to commit across the platform and shift their investments as needs change. Qualys said only a small percentage of customers had signed up at that point.

Customers and how it sells

Qualys sells to enterprises, government entities and small and medium-sized businesses across industries including financial services, healthcare, manufacturing, retail and technology. As of December 31, 2025, it had over 10,000 customers worldwide, including a majority of the Forbes Global 100. No customer accounted for more than 10% of revenue in 2025.

The company uses a field sales force for enterprises and government entities and an inside sales force for smaller businesses. Its channel partners include managed security service providers, resellers and consulting firms. Partners generated 49% of revenue in 2025; their contribution was 54% of total revenues in the second quarter of 2026.

In 2025, United States revenue was $377.5 million, or 56.4% of the total, and foreign revenue was $291.7 million, or 43.6%. Qualys assigns customer geography based on billing addresses. Its sales teams cover the Americas; Europe, the Middle East and Africa; and Asia-Pacific.

Qualys supports customers from centers in Foster City, California; Raleigh, North Carolina; and Pune, India. It also offers free trials and services to introduce prospective customers to its platform.

Suppliers and costs

Qualys uses third-party vendors for its shared cloud operations. Those operations are located in countries including the United States, Canada, Switzerland, the Netherlands, India and Australia, and the agreements have varying terms through 2030. Qualys also outsources product manufacturing and recycling to suppliers and vendors.

The main cost of delivering its services is personnel expense for employees who operate shared cloud platforms and support customers. Other costs include cloud platform usage, depreciation of equipment and scanner appliances, software and license fees, maintenance, contractors and acquired intangible assets.

Research and development expense is principally compensation for development teams, with additional spending on contractors and software. Sales and marketing expense includes employee compensation, commissions, promotional events and lead-generation programs. General and administrative expense includes staff, professional services and software licenses.

Qualys had 2,625 employees as of December 31, 2025. It expects continued investment in cloud infrastructure, support, research and development, and sales and marketing to increase those costs in absolute dollars.

Competitive position

Qualys competes in a fragmented market with vulnerability management, compliance and data security vendors. Named competitors include CrowdStrike, Palo Alto Networks, Rapid7 and Tenable Holdings, as well as private providers Invicti, Tanium and Wiz. Qualys also seeks to replace security and compliance tools developed internally by organizations.

The company identifies product functionality, breadth, deployment, cost, scalability, support and platform extensibility as competitive factors. It says many primary competitors have greater name recognition, more established customer relationships, larger marketing budgets and greater resources. As Qualys extends into additional applications, it expects to face competition in those markets too.

The platform combines applications that share scanners, agents, collected data, user permissions and an interface. Customers can add applications after their initial deployment, and outside developers can use APIs to build applications or embed Qualys technology. Qualys also maintains vulnerability research and updates for its customers.

Our reading: The shared data and workflows provide a moderate source of customer stickiness because customers can use several applications on one platform, although the evidence does not establish how difficult switching is. Our reading: The installed customer base provides a moderate distribution advantage for selling additional applications, but competitors with greater resources and established relationships can contest those sales. Our reading: Research, proprietary technology and patents support the offering, but the evidence does not establish a strong barrier to competing products.

Growth opportunities

Qualys plans to grow by adding capabilities to its platform, selling more applications to existing customers and reaching new customers through its sales force and partners. It also may pursue acquisitions that add technology or development teams. The company intends to invest in research and development and expand relationships with consulting organizations, cloud providers, managed security providers and resellers.

Existing customers contributed 76% of the $61.6 million increase in revenue in 2025 compared with 2024, while new customers contributed the remaining 24%. Net dollar expansion was 103% for both the years ended December 31, 2025 and 2024. In the second quarter of 2026, the rate was 105%, up from 104% in the prior quarter.

Qualys is pursuing adoption of Enterprise TruRisk Management and remediation products among existing vulnerability management customers. In 2026, it described an existing customer that added VMDR, ETM, TruRisk Eliminate and TotalAI through a QFlex upsell. Qualys says early ETM customers are also bringing data from other vendors’ tools into the platform.

The company expects 2026 revenue in the range of $732 million to $738 million. Its guidance assumes net dollar expansion remains at current levels, with moderate growth contribution from new business. Qualys also sees federal customers as an opportunity, while saying that federal business is not yet a large part of its revenue.

Structural risks

• Renewals and expansion: Results can vary with customer demand, renewals and the extent to which existing customers subscribe to additional solutions. Deal timing, sales cycles and changes in billing terms can also affect results.
• Competition: Price competition, new technologies and competing product introductions can affect performance. Qualys says some competitors have larger budgets, stronger customer relationships and greater resources.
• Security and reliability: Actual or perceived security incidents, service interruptions, technical difficulties or products failing to operate as designed can affect results. New solutions may also fail to gain acceptance because of defects or insufficient interoperability.
• Customer spending: Economic uncertainty, reduced spending and extended sales cycles could lead customers to reduce or eliminate IT security purchases. Poor business conditions can also delay purchases of new products.
• Execution and costs: Qualys must introduce enhancements on time, hire employees and manage the costs of expanding its platform. New sales personnel may not immediately become productive, and their costs may not produce additional revenue.
• Acquisitions and integration: Acquired products or services may be difficult to integrate into the product suite, and acquired customers may not migrate to Qualys products. Acquisitions can also lead to goodwill or intangible asset impairment charges.

Bottom line

Our reading

Qualys is a subscription security-software business that uses a shared platform and an established customer base to sell additional applications over time (item1; item7). Its growth depends on renewals, expansion and new customers, while competitors with greater resources and the need to deliver reliable security services remain constraints (item1; item1a). QFlex and newer remediation tools offer routes to broader customer use, but their adoption is still developing (call_prepared; call_qa).