Table of Contents (Exact name of registrant as specified in its charter) __________________ UNITED STATES SECURITIES AND EXCHANGE COMMISSION Delaware 77-0534145 (State or other jurisdiction of incorporation or organization) Washington, D.C. 20549 __________________ FORM 10-Q __________________ x Quarterly Report Pursuant to Section 13 or 15(d) of the Securities Exchange Act of 1934 For the Quarterly Period Ended March 31, 2025 o Transition Report Pursuant to Section 13 or 15(d) of the Securities Exchange Ac ...

Financial Data and Key Metrics Changes - Revenues grew by 10% to $159.9 million, with channel contributions increasing to 49% of total revenues compared to 45% a year ago [19][20] - Adjusted EBITDA for Q1 was $74.8 million, representing a 47% margin, consistent with the previous year [23] - Free cash flow was $107.6 million, maintaining a 57% margin compared to 57% in the prior year [23] - EPS for Q1 was $1.67, with full-year EPS guidance raised to a range of $6.00 to $6.30, up from the prior range of $5.50 to $5.90 [24][25] Business Line Data and Key Metrics Changes - Patch management and cybersecurity asset management combined accounted for 15% of total bookings and 24% of new bookings on an LTM basis [21] - Total Cloud CNAP made up 5% of LTM bookings, reflecting customer demand for comprehensive risk management solutions [21][22] Market Data and Key Metrics Changes - U.S. and international revenue mix was 57% and 43%, respectively, with international growth outpacing domestic growth [20] - Customers spending $500,000 or more grew by 6% year-over-year to 2,003 [14] Company Strategy and Development Direction - The company is focusing on a partner-first strategy to drive growth, emphasizing the consolidation of security tools and risk management solutions [62] - The introduction of the Risk Operations Center (ROC) aims to help organizations manage cyber risks proactively, reducing the chance of breaches [7][10] - The company is expanding its Total AI and TruRisk capabilities to address evolving threats associated with AI technologies [9] Management's Comments on Operating Environment and Future Outlook - Management noted that while cybersecurity remains a priority, there is increased scrutiny on spending and longer decision-making cycles due to macroeconomic uncertainty [28][29] - The company expects revenue growth for the full year 2025 to be in the range of 7% to 8%, with a cautious outlook on new business growth [25][58] Other Important Information - The company has made progress towards achieving FedRAMP high certification, which is expected to fuel growth [16] - The company has repurchased 9.6 million shares since the start of its repurchase program, returning nearly $1.1 billion in cash to shareholders [23] Q&A Session Summary Question: Thoughts on the macro environment and customer spending - Management observed that cybersecurity remains important, but there is more scrutiny on spending and longer decision cycles [28][29] Question: Customer journey with the ROC - The ROC consolidates risk signals from multiple tools, providing actionable insights and remediation plans, which helps customers save time and resources [30][32] Question: Impact of macro challenges on deals - No material deals were pushed or pulled; however, there was some pushback on upsell rates from existing customers [37] Question: Competitive landscape and response to competitors - Management expressed confidence in their approach to vulnerability management, focusing on prioritizing and remediating significant risks rather than just identifying vulnerabilities [40][41] Question: Growth in Total Cloud CNAP and audit readiness - The Total Cloud CNAP is still in early stages but has seen growth, with a focus on helping customers prepare for audits and manage risks effectively [76][79]

Financial Data and Key Metrics Changes - Revenues grew 10% to $159.9 million, with channel contributions increasing to 49% of total revenues from 45% a year ago [19][20] - Adjusted EBITDA for Q1 was $74.8 million, representing a 47% margin, consistent with the previous year [22] - Free cash flow was $107.6 million, maintaining a 57% margin compared to the prior year [22][23] - EPS for Q1 was $1.67, with full-year EPS guidance raised to $6.00 - $6.30 from a prior range of $5.50 - $5.90 [23][24] Business Line Data and Key Metrics Changes - Patch management and cybersecurity asset management accounted for 15% of total bookings and 24% of new bookings on an LTM basis [21] - Total Cloud CNAP made up 5% of LTM bookings, reflecting customer demand for comprehensive risk management [21] Market Data and Key Metrics Changes - International revenue grew 16% compared to 6% growth in the U.S., with a revenue mix of 57% U.S. and 43% international [20] - Customers spending $500,000 or more increased by 6% year-over-year to 2,003 [15] Company Strategy and Development Direction - The company is focusing on a partner-first strategy to drive growth, with an emphasis on consolidating security tools and enhancing risk management capabilities [18][62] - Qualys aims to expand its Total AI and TruRisk capabilities to address evolving threats associated with AI technologies [10] - The company is advancing its managed risk operations (MROC) services and plans to certify additional strategic partners [16][62] Management's Comments on Operating Environment and Future Outlook - Management noted ongoing macroeconomic uncertainty affecting customer spending and decision-making cycles, leading to a more scrutinized budget environment [28][29] - Despite challenges, the company remains confident in its long-term growth potential and ability to gain market share [15][18] - Guidance for full-year revenue growth is set at 7% to 8%, with expectations of continued adoption of cloud-native security solutions [24][25] Other Important Information - The company has repurchased 9.6 million shares since February 2018, returning nearly $1.1 billion to shareholders [23] - Qualys is on track to achieve FedRAMP high certification, which is expected to fuel growth [17] Q&A Session Summary Question: Thoughts on the macro environment and customer spending - Management observed that cybersecurity remains a priority, but there is increased scrutiny on spending and longer decision cycles [28] Question: Customer journey with the Risk Operations Center (ROC) - The ROC consolidates risk signals from multiple tools, providing actionable insights and remediation plans, which helps customers save time and resources [31][32] Question: Impact of macro challenges on deals - No material deals were pushed or pulled; however, there was some pushback on anticipated upsell rates from existing customers [37][38] Question: Competitive landscape and response to competitors expanding into network-based VM - Management expressed confidence in Qualys's focus on prioritizing and remediating vulnerabilities rather than just identifying them [40] Question: Growth in Total Cloud CNAP and audit readiness - The Total Cloud CNAP is still in early stages but has seen growth, with audit readiness becoming a significant area of focus for customers [78][80]

Qualys Enterprise TruRisk Platform - Qualys is transforming its focus to deliver desired business outcomes leveraging risk analytics with the Qualys Enterprise TruRisk Platform[10, 12] - The Qualys Enterprise TruRisk Platform offers comprehensive risk reduction by eliminating cyber risk, saving time, reducing MTTR, and consolidating the IT-security stack[20, 21] - The platform provides one view across the entire global hybrid-IT environment, allowing customers to consolidate their stack for better security outcomes, with no hardware to buy or manage[31] Market Opportunity and Customer Base - Qualys estimates its current total addressable market at $55 billion in CY2025E, expanding to $79 billion in CY2028E[35] - Qualys has a blue-chip global customer base of over 10,000 subscription customers[37] - 72% of the Forbes Global 50, 55% of the Forbes Global 500, and 33% of the Forbes Global 2000 are Qualys' subscription customers[37] Financial Performance - Qualys' 2024 revenues reached $608 million, with an adjusted EBITDA of $283 million, representing a 47% adjusted EBITDA margin[45] - The company's Q1 2025 revenues were $160 million, with an adjusted EBITDA of $75 million, maintaining a 47% adjusted EBITDA margin[45] - Qualys generated $232 million in free cash flow in 2024[50] - The company's adjusted EBITDA margin of 47% in 2024 is higher than the peer median of 25% for select security and SaaS companies[53]

Financial Performance - Revenues for Q1 2025 increased by 10% to $159.9 million compared to $145.8 million in Q1 2024[3] - GAAP net income for Q1 2025 rose by 20% to $47.5 million, or $1.29 per diluted share, compared to $39.7 million, or $1.05 per diluted share, in Q1 2024[6] - Operating cash flow for Q1 2025 increased by 28% to $109.6 million, representing 69% of revenues compared to 59% in Q1 2024[8] - Non-GAAP net income for Q1 2025 was $61.4 million, or $1.67 per diluted share, compared to $54.7 million, or $1.45 per diluted share, in Q1 2024[6] - GAAP operating income for Q1 2025 increased by 16% to $51.8 million, representing 32% of revenues compared to 31% in Q1 2024[5] - Net income for the same period rose to $47,534 thousand, representing a net income margin of 30%, up from 27% in the prior year[33] - Basic net income per share increased to $1.30 for the three months ended March 31, 2025, compared to $1.08 in the same period of 2024[35] Guidance and Expectations - The company raised its full year 2025 revenue guidance to a range of $648 million to $657 million, reflecting a growth of 7% to 8% over 2024[12] - The company expects Q2 2025 revenues to be in the range of $159.7 million to $162.7 million, representing 7% to 9% growth over Q2 2024[11] Cash Flow and Assets - Non-GAAP free cash flows for the three months ended March 31, 2025, were $107,550 thousand, compared to $83,454 thousand in the same period of 2024[37] - Cash and cash equivalents increased to $290,671 thousand as of March 31, 2025, up from $232,182 thousand at the end of 2024[29] - Total assets reached $996,471 thousand as of March 31, 2025, compared to $973,537 thousand at the end of 2024[29] - Total liabilities were $498,436 thousand as of March 31, 2025, slightly up from $496,421 thousand at the end of 2024[29] Revenue and Deferred Revenue - Current deferred revenue as of March 31, 2025, was $366,824 thousand, compared to $332,128 thousand in the same period of the previous year[39] - Revenues for the three months ended March 31, 2025, increased to $159,899 thousand, a growth of 10% compared to $145,805 thousand in the same period of 2024[27] Adjusted Metrics - Adjusted EBITDA for Q1 2025 increased by 8% to $74.8 million, maintaining a margin of 47% of revenues[7] - Adjusted EBITDA for the three months ended March 31, 2025, was $74,752 thousand, maintaining 47% as a percentage of revenues, consistent with the previous year[33] Stock-Based Compensation - Stock-based compensation totaled $18,820 thousand for the three months ended March 31, 2025, down from $19,031 thousand in the same period of 2024[35] New Initiatives - The company introduced the Managed Risk Operation Center (mROC) to help partners expand revenue streams through a unified managed service[15] - Qualys launched TotalAppSec, a comprehensive application risk management solution, enhancing its cybersecurity offerings[15]

Core Insights - The rapid adoption of AI is leading organizations to implement solutions without adequate security controls, raising concerns about potential security breaches, with 72% of CISOs expressing worry about generative AI risks [1] - Qualys TotalAI is designed to address AI-specific security challenges, ensuring that only trusted models are deployed, thus balancing innovation with risk management [2][3] Group 1: Qualys TotalAI Features - TotalAI goes beyond basic assessments by testing models for vulnerabilities such as jailbreak risks, bias, and sensitive information exposure, aligning with OWASP Top 10 for LLMs [2] - The platform provides visibility, intelligence, and automation to protect AI workloads throughout their lifecycle, enhancing operational resilience and brand trust [3] - TotalAI detects 40 different attack scenarios, including advanced jailbreak techniques and bias amplification, to strengthen model resilience against exploitation [6] Group 2: Availability and Resources - Qualys TotalAI is now available for a 30-day trial, allowing organizations to explore its capabilities [4] - Qualys, Inc. is a leading provider of cloud-based security solutions, serving over 10,000 subscription customers globally, including many from the Forbes Global 100 and Fortune 100 [5]

Industry Overview - Cybersecurity has transitioned from a back-office concern to a boardroom priority due to the increasing frequency and sophistication of cyberattacks, with global cybercrime costs projected to rise from $9.22 trillion in 2024 to $15.63 trillion by 2029 [1] - The global cybersecurity market is expected to grow from $193.73 billion in 2024 to $562.72 billion by 2032, reflecting a compound annual growth rate (CAGR) of 14.3% [2] - The growth in the cybersecurity market is driven by increasing enterprise IT complexity, rising regulatory scrutiny, and the need for real-time protection of data, identities, and infrastructure [2] Technological Advancements - Artificial intelligence (AI) is revolutionizing the cybersecurity landscape, enabling more efficient detection, prevention, and response to cyber threats [3] - AI can analyze large volumes of data, detect anomalies, and identify potential breaches in real time, providing a proactive approach to security [3] Company Highlights - Companies like Fortinet, Zscaler, Okta, and Qualys are heavily investing in AI-driven security solutions to enhance their capabilities and position themselves for long-term growth in the expanding cybersecurity market [4] - Okta specializes in identity and access management (IAM) and is ramping up its AI capabilities to address the complexities of digital identities [6] - Qualys focuses on vulnerability management and cloud security, integrating advanced AI models into its platforms for faster detection and remediation of security threats [10][11] - Fortinet offers a comprehensive suite of cybersecurity solutions, differentiating itself with high-performance security at lower costs, and has integrated AI-driven analytics into its services [13][14][15] - Zscaler is a pioneer in zero-trust security, enhancing its platform with AI-powered security analytics to improve threat detection and response [16][17][18] Financial Performance - Okta reported 19,650 customers at the end of fiscal Q4 2025, with a 7% year-over-year increase in customers with over $100,000 in Annual Contract Value (ACV) [8] - Qualys' AI-powered platform is expected to drive customer adoption and revenue growth, positioning it well in the market [12] - Fortinet has consistently delivered profitability and strong free cash flow, reflecting its growing market share and demand for AI-enhanced security solutions [15] - Zscaler has maintained robust financial performance with expanding revenues driven by demand for its AI-enhanced offerings [18]

Core Insights - Enterprises are facing an increasing compliance burden, with nearly 70% of service organizations subject to at least six regulatory frameworks, leading to resource strain and higher costs [1] - Misconfigurations complicate compliance efforts, often resulting in non-compliance and regulatory penalties, highlighting the need for automated compliance management solutions [1] - Qualys Policy Audit offers a solution by automating evidence mapping to various compliance frameworks, ensuring continuous compliance and reducing audit failures [3] Compliance Challenges - Organizations struggle with complex regulations, limited staff, and tight budgets, making compliance costly and prone to errors [3] - Time-consuming tasks such as auditing and reporting are susceptible to human error, necessitating a more efficient approach [1] Qualys Policy Audit Features - Qualys Policy Audit provides comprehensive coverage across 450 technologies, over 1,000 out-of-the-box policies, and more than 90 frameworks, ensuring organizations remain audit-ready [3] - The solution reduces audit failure rates by up to 95%, helping organizations mitigate risks of fines and penalties [6] - Automated ITSM workflows enhance communication between teams, ensuring timely information flow and streamlined compliance tracking [6] New Offerings - Qualys is introducing Audit Fix, which allows users to proactively address audit findings before they escalate into compliance issues, utilizing predefined scripts and policies [4] - Customizable remediation workflows integrated into Policy Audit significantly reduce breach exposure and accelerate compliance efforts [4] Availability and Resources - Qualys Policy Audit will be available in Q2, with a 30-day trial offered on their website [5] - Additional resources include a blog and a webinar focused on the new standard for audit readiness [5] Company Overview - Qualys, Inc. is a leading provider of cloud-based security and compliance solutions, serving over 10,000 subscription customers globally, including many Fortune 100 companies [6][7] - The Qualys Enterprise TruRisk Platform automates vulnerability detection and compliance across various IT environments, enhancing overall security posture [8]

Core Viewpoint - Qualys, Inc. will report its financial results for Q1 2025 on May 6, 2025, after market close [1] Group 1: Financial Reporting - The financial results for the first quarter of 2025 will be announced after market hours on May 6, 2025 [1] - A conference call and live webcast will be held at 5:00 p.m. Eastern Time on the same day to discuss the results [2] Group 2: Company Overview - Qualys, Inc. is a leading provider of cloud-based security, compliance, and IT solutions with over 10,000 subscription customers globally, including many from the Forbes Global 100 and Fortune 100 [3] - The company offers a platform that automates security and compliance solutions, leading to improved agility and cost savings for organizations [3] Group 3: Product and Technology - The Qualys Enterprise TruRisk Platform utilizes a single agent for continuous security intelligence and automates vulnerability detection and compliance across various IT environments [4] - Qualys has established strategic partnerships with major cloud service providers like Amazon Web Services, Google Cloud Platform, and Microsoft Azure [4]

Core Insights - Qualys, Inc. has become the Major Partner and official Cybersecurity Partner of the San Francisco Unicorns for the 2025 Cognizant Major League Cricket season, highlighting its commitment to community engagement and support for local sporting events [1][3][5] Group 1: Partnership Details - The partnership includes the Qualys logo prominently displayed on the Unicorns' matchday and training jerseys, as well as branding opportunities across various media assets [4] - Qualys aims to reflect its values of innovation and determination through this partnership, aligning with the Unicorns' mission to promote cricket in the U.S. [3][5] Group 2: Team and Event Information - The San Francisco Unicorns debuted in Major League Cricket in 2023 and are set to play their first three games of the 2025 season at the Oakland Coliseum, starting with a match against Washington Freedom on June 12 [6][9] - The team features top international cricket talents, including Cooper Connolly, Jake Fraser-McGurk, and Matt Short, promising exciting performances for fans [3][9] Group 3: Company Overview - Qualys, Inc. is a leading provider of cloud-based security, compliance, and IT solutions, serving over 10,000 subscription customers globally, including many from the Forbes Global 100 and Fortune 100 [10] - The company specializes in automating security and compliance solutions, offering significant cost savings and improved business outcomes for organizations [10][11]