Qualys(QLYS) - 2023 Q4 - Annual Report

Risk Factor Summary The business is subject to significant risks and uncertainties that could harm its business, reputation, financial condition, results of operations, revenue, and future prospects - The business is subject to significant risks and uncertainties that could harm its business, reputation, financial condition, results of operations, revenue, and future prospects. These include variability in operating results, inability to anticipate market needs, failure to scale the platform, challenges in renewing subscriptions and attracting new customers, and potential issues with research and development efforts[15][16] - Other key risks involve security incidents, long and unpredictable sales cycles, adverse economic conditions, service disruptions from shared cloud platforms, intense competition, and potential failures of solutions to detect vulnerabilities[16] - Additional risks include difficulties in expanding the sales force, reliance on third-party channel partners, challenges with international operations, and the potential for the cloud solutions market to not evolve as anticipated[16] Note Regarding Forward-Looking Statements This section clarifies that the report contains forward-looking statements subject to risks and uncertainties, with no obligation to update them - This Annual Report on Form 10-K contains forward-looking statements regarding future events or financial/operating performance, identifiable by words like 'anticipates,' 'believes,' 'expects,' 'plans,' or 'will'[20] - These statements are based on current expectations and projections but are subject to risks, uncertainties, assumptions, and other factors, including those detailed in the 'Risk Factors' section, which could cause actual results to differ materially[21] - The company disclaims any obligation to update forward-looking statements to reflect events or circumstances after the report date, except as required by law[22] PART I Item 1. Business Qualys, Inc. is a leading provider of cloud-based IT, security, and compliance solutions, offering an integrated platform to identify and manage IT/OT assets, prioritize vulnerabilities, quantify cyber risk, and implement remediation - Qualys is a pioneer and leading provider of a cloud-based platform delivering IT, security, and compliance solutions, enabling customers to identify and manage IT/OT assets, collect security data, discover and prioritize vulnerabilities, quantify cyber risk, and implement remediation[25] - The company's solutions are delivered through a software-as-a-service (SaaS) model, primarily with renewable annual subscriptions, leading to revenue growth from both existing and new customers[31] - Revenues were $554.5 million in 2023, $489.7 million in 2022, and $411.2 million in 2021[32] - The company serves over 10,000 customers worldwide, including a majority of the Forbes Global 100[32][55] Overview Qualys provides a cloud-based platform for IT, security, and compliance, delivering solutions via a SaaS model with renewable annual subscriptions - Qualys provides a cloud-based platform for IT, security, and compliance, helping organizations manage assets, analyze security data, prioritize vulnerabilities, and remediate cyber risks across various environments (on-premises, endpoints, cloud, containers, mobile)[25] - The company's solutions are delivered via a SaaS model with renewable annual subscriptions, recognizing revenue ratably over the subscription term[31] Revenue Growth (2021-2023) | Year | Revenues (in millions) | | :--- | :--------------------- | | 2023 | $554.5 | | 2022 | $489.7 | | 2021 | $411.2 | Our Platform Qualys' cloud platform offers an integrated suite of IT security, compliance, and asset management solutions through a scalable multi-tenant infrastructure - Qualys' cloud platform offers an integrated suite of IT security, compliance, web application security, asset management, and cloud security solutions (Qualys Cloud Apps), leveraging shared core services and a scalable multi-tenant cloud infrastructure[33] - The platform is delivered via 14 global shared cloud platforms or a private platform offering (Qualys PCP) for customers requiring on-premises deployment, both typically on a subscription basis[37] - Key advantages include no hardware to manage, real-time visibility, easy global scanning, seamless scaling, up-to-date resources, and secure data storage[29] Qualys Cloud Apps Qualys offers over 20 integrated Cloud Apps for asset management, vulnerability management, risk mitigation, threat detection, compliance, and cloud security - Qualys offers over 20 integrated Cloud Apps covering asset management (Cybersecurity Asset Management - CSAM), vulnerability management (Vulnerability Management, Detection and Response - VMDR, Web Application Scanning - WAS), risk mitigation (Patch Management - PM, Custom Assessment and Remediation - CAR), threat detection and response (Multi-Vector Endpoint Detection and Response - EDR, Context Extended Detection and Response - XDR), compliance (Policy Compliance - PC, File Integrity Monitoring - FIM), and cloud security (Qualys TotalCloud)[43][44][45][46][47][48][51][52][53] - These applications are designed to simplify security stacks, provide unified visibility, and automate the detection, measurement, prioritization, and remediation of cyber risk[40][41] Free Services Qualys provides free security and compliance services, including asset inventory and certificate management, to build awareness and encourage adoption - Qualys offers free security and compliance services, including Qualys Global AssetView for continuous, real-time asset inventory and Qualys Certificate Inventory for assessing Internet-facing certificates and tracking expirations[54] Our Growth Strategy Qualys' growth strategy focuses on continuous innovation, expanding existing customer use, acquiring new customers, and strategic technology acquisitions - Qualys' growth strategy includes continuing to innovate its cloud platform and solutions, expanding the use of its solutions by existing customers, driving new customer growth and global reach, and selectively pursuing technology acquisitions[55] - Recent acquisitions include certain intangible assets of Blue Hexagon Inc. in 2022 for deep learning AI and machine learning technologies, and TotalCloud in 2021 to strengthen cloud security solutions[57] Sales and Marketing Qualys sells solutions directly and indirectly through channel partners, employing various marketing efforts to build awareness and drive customer adoption - Qualys sells solutions directly through field sales (enterprises) and inside sales (SMBs), and indirectly through channel partners (managed security service providers, VARs, consulting firms)[56][57] Revenue from Channel Partners | Year | % of Revenues from Channel Partners | | :--- | :---------------------------------- | | 2023 | 43% | | 2022 | 42% | | 2021 | 41% | - Marketing efforts include online marketing, advertising, conferences, events, public relations, web-based seminars, and free trials/services to build awareness and encourage customer adoption[60][61] Customer Support Qualys provides 24x7x365 technical support from global centers, focusing on rapid issue resolution and leveraging customer insights for solution improvement - Qualys provides 24x7x365 technical support from global centers in Foster City, California; Raleigh, North Carolina; and Pune, India, focusing on rapid issue resolution and customer satisfaction[62] - The company also offers various training programs as part of its subscriptions and leverages customer insights for solution improvement[62] Research and Development and Operations Qualys invests significantly in R&D to enhance its cloud platform and solutions, with global teams and outsourced shared cloud platform operations - Qualys invests significant resources in R&D to enhance its cloud platform and solutions, with agile engineering teams and a research team focused on identifying threats and developing vulnerability signatures[63] - R&D is conducted in the United States, France, and India, enabling access to diverse talent and facilitating multiple updates and new feature deliveries annually[63][64][65] - Shared cloud platform operations are provided by third-party vendors across 14 global locations, with agreements extending through 2027[66] Competition Qualys operates in a highly fragmented and competitive market, competing on product functionality, breadth of offerings, delivery model, and customer support - Qualys competes in a highly fragmented and competitive market against established and emerging vulnerability management, compliance, and data security vendors[68] - Key competitors include Broadcom (Symantec Enterprise Security), CrowdStrike, Palo Alto Networks, Rapid7, and Tenable Holdings, as well as privately held security providers[69] - Principal competitive factors are product functionality, breadth of offerings, delivery model flexibility, ease of deployment/use, total cost of ownership, scalability, performance, customer support, and platform extensibility[70] Intellectual Property Qualys protects its intellectual property through trade secrets, copyrights, patents, trademarks, and contractual protections, holding 36 issued patents - Qualys protects its intellectual property through trade secrets, copyrights, patents, trademarks, and contractual protections[71] - As of December 31, 2023, the company held 36 issued patents (expiring 2029-2042) and an exclusive license to four U.S. patents[71] Human Capital Resources Qualys employs 2,188 full-time staff globally, focusing on competitive compensation, talent development, diversity, work-life balance, and community engagement - As of December 31, 2023, Qualys had 2,188 full-time employees, with 1,016 in R&D, 438 in sales and marketing, 504 in operations and customer support, and 230 in G&A[73] - Approximately 75% of employees are located outside the U.S., with 66% in Pune, India[73] - The company focuses on competitive compensation and benefits, talent development, diversity and inclusion (over 50% of executive team from underrepresented communities), promoting work-life balance (hybrid schedule), and community engagement[74][76][77][80][81] Sustainable Business Operations Qualys promotes environmental sustainability through cloud-based products, energy-efficient data centers, and adherence to high environmental standards by suppliers - Qualys' cloud-based products promote environmental sustainability by minimizing customer-deployed physical servers and reducing energy consumption[86] - The company operates its platforms in energy-efficient networks and data centers, with 8 of its 14 multi-tenant platforms in collocated facilities, leveraging economies of scale for power and cooling[87] - Qualys outsources manufacturing and recycling to suppliers adhering to high environmental standards like ISO 14001 and prohibits suppliers from profiting from conflict minerals[88] Available Information The company's public filings, including Annual Reports on Form 10-K, are available free of charge on its website and the SEC's website - The company's Annual Reports on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K, and amendments are available free of charge on its website (www.qualys.com) and the SEC's website (www.sec.gov)[90](index=90&type=chunk) Item 1A. Risk Factors This section details various risks that could materially and adversely affect Qualys' business, operating results, financial condition, or prospects - An investment in Qualys common stock involves a high degree of risk, and investors should carefully consider all risks and uncertainties described in this section[91] - The trading price of common stock could decline, and investors might lose all or part of their investment if any of these risks occur[91] Risks Related to Our Business and Industry Qualys faces risks from market demand fluctuations, inability to anticipate market needs, security incidents, intense competition, and reliance on third-party partners - Operating results may vary due to demand fluctuations, customer renewals, sales cycle length, competition, economic conditions, and foreign currency exchange rates[93][94] - Failure to anticipate market needs, enhance solutions, or effectively scale the platform could harm business and financial condition[98][103] - Security incidents, long sales cycles, adverse economic conditions, disruptions at shared cloud platforms, intense competition, and solution failures to detect vulnerabilities are significant operational risks[107][111][112][115][119][130] - Reliance on third-party channel partners (43% of 2023 revenues) and international operations (75% of employees outside US) expose the company to additional risks, including currency fluctuations and regulatory complexities[135][137][141][142] Risks Related to Intellectual Property, Legal, Tax and Regulatory Matters Risks include software errors, data privacy concerns, intellectual property infringement, export controls, and changes in tax laws or audits - Risks include undetected software errors, privacy and data handling concerns (e.g., GDPR, CCPA, CPRA), and the evolving legal and ethical landscape of AI/machine learning technologies[160][162][164][169] - Failure to comply with open source software licenses or issues with third-party software/data could restrict sales or harm reputation[170][173] - Inadequate protection of proprietary technology, intellectual property infringement claims by third parties, governmental export/import controls, and changes in tax laws or audits could result in significant costs and harm business[175][180][183][186][187] Risks Related to Ownership of Our Common Stock The common stock's trading price is subject to fluctuations, and future share sales or anti-takeover provisions could impact stockholder value - The trading price of common stock is subject to significant fluctuations due to various factors, including company announcements, market conditions, operating results, and analyst estimates[189][198] - Actual operating results may differ significantly from guidance, and future sales of shares by existing stockholders could cause the stock price to decline[192][196] - The company has a share repurchase program (authorized $1.2 billion as of Feb 7, 2024, $83.7 million remaining as of Dec 31, 2023) but cannot guarantee its full consummation or enhancement of stockholder value[200][280] - Qualys does not intend to pay dividends on its common stock, limiting returns to stock value, and anti-takeover provisions in charter documents could make acquisitions more difficult[201][202] General Risk Factors General risks include disruptive technologies, inability to maintain profitability, reliance on critical accounting estimates, and changes in financial accounting standards - Disruptive technologies could supplant cloud-based solutions, and the company may not maintain profitability in the future despite market growth forecasts[204][205][206] - Financial results rely on critical accounting estimates, and changes in financial accounting standards could cause adverse and unexpected revenue fluctuations[207][208] Item 1B. Unresolved Staff Comments There are no unresolved staff comments to report - The company has no unresolved staff comments[211] Item 1C. Cybersecurity Qualys has established a robust Information Security Management System (ISMS) and Computer Security Incident Response Team (CSIRT) to assess, identify, and manage cybersecurity risks, integrating these processes into its enterprise risk management - Qualys has an ISMS aligned with ISO/IEC 27001 standards for assessing, identifying, and managing material cybersecurity risks, integrated into overall enterprise risk management[212] - The company has not encountered any cybersecurity threats that have materially impaired its operations or financial standing[220] Risk Management and Strategy Qualys conducts routine risk assessments, implements safeguards, trains employees, and maintains a CSIRT for incident response, adhering to industry standards - Qualys routinely conducts risk assessments to identify cybersecurity threats and weaknesses, implementing and maintaining safeguards, and training employees on cybersecurity policies[213][214][215] - A Computer Security Incident Response Team (CSIRT) is in place to identify, characterize, and provide diagnostic/corrective actions for security incidents, adhering to NIST, FedRAMP, ISO, and FISMA standards[216] - The Incident Response Program includes periodic testing and training through tabletop exercises and simulated attack scenarios, and the company engages third-party assessors for external validation of its security posture[217][219] Governance The board of directors, through its Audit and Risk Committee, oversees cybersecurity risk, with the CISO and Security Steering Committee managing day-to-day operations - The board of directors, through its Audit and Risk Committee, oversees cybersecurity risk, with the CISO and Security Steering Committee responsible for day-to-day management[221][222] - The CISO, a cybersecurity industry expert, reports to the CEO and provides quarterly briefings to the Audit and Risk Committee on risks, incidents, and the threat landscape[222][223][224] Item 2. Properties Qualys' principal executive offices are in Foster City, California, with additional offices globally and shared cloud platforms at third-party facilities across ten countries - Principal executive offices are in Foster City, California (76,922 sq ft, lease expiring April 30, 2028)[225] - Additional offices include 281,787 sq ft in Pune, India (lease expiring February 2025), North Carolina, France, United Arab Emirates, and United Kingdom[225] - Shared cloud platforms are operated at third-party facilities in the U.S., Canada, Switzerland, Netherlands, UAE, Australia, UK, Italy, Kingdom of Saudi Arabia, and India, with agreements through 2027[226] Item 3. Legal Proceedings As of December 31, 2023, Qualys has not incurred a material loss from any ongoing legal proceedings, though litigation is inherently unpredictable - As of December 31, 2023, there has not been a reasonable possibility of incurring a material loss from any ongoing legal proceedings[227] - Litigation is inherently unpredictable, and changes in estimates or assumptions could materially impact results of operations, financial position, and cash flows[227] Item 4. Mine Safety Disclosures This item is not applicable to Qualys, Inc - This item is not applicable[228] PART II Item 5. Market for Registrant's Common Equity, Related Stockholder Matters and Issuer Purchases of Equity Securities Qualys' common stock trades on NASDAQ under 'QLYS', with approximately 48 record holders, no cash dividends, and an authorized share repurchase program - Qualys common stock is listed and traded on the NASDAQ Global Select Market under the symbol 'QLYS'[231] - As of February 12, 2024, there were approximately 48 holders of record of the company's common stock[232] - The company has never declared or paid any cash dividends and does not expect to in the foreseeable future, intending to retain future earnings for business development and growth[233] Share Repurchase Program Summary (Q4 2023) | Period | Total Number of Shares Purchased | Average Price Paid per Share | Approximate Dollar Value of Shares that May Yet Be Purchased under the Plan or Program | | :------------------------------- | :------------------------------- | :--------------------------- | :-------------------------------------------------------------------------------- | | October 1, 2023 - October 31, 2023 | 76,000 | $156.94 | $94,828,514 | | November 1, 2023 - November 30, 2023 | 49,112 | $171.10 | $86,425,300 | | December 1, 2023 - December 31, 2023 | 14,400 | $190.51 | $83,681,929 | | Total (Q4 2023) | 139,512 | N/A | N/A | - As of December 31, 2023, approximately $83.7 million remained available for share repurchases under the authorized program. On February 7, 2024, an additional $200.0 million was authorized, increasing the total to $1.2 billion[238][239][280] Market Information Qualys' common stock is listed and traded on the NASDAQ Global Select Market under the symbol 'QLYS' - Qualys' common stock is listed and traded on the NASDAQ Global Select Market under the symbol 'QLYS'[231] Holders of Record As of February 12, 2024, there were approximately 48 holders of record of Qualys' common stock - As of February 12, 2024, there were approximately 48 holders of record of Qualys' common stock[232] Dividend Policy Qualys has never paid cash dividends on its common stock and does not anticipate doing so, intending to retain future earnings for business growth - Qualys has never declared or paid any cash dividends on its common stock and does not anticipate doing so in the foreseeable future, intending to retain future earnings for business development and growth[233] Stock Price Performance Graph This section provides a cumulative total return graph comparing Qualys' stock performance against market indices from 2018 to 2023 Cumulative Total Return (December 31, 2018 = $100) | Index | Dec 31, 2018 | Dec 31, 2019 | Dec 31, 2020 | Dec 31, 2021 | Dec 31, 2022 | Dec 31, 2023 | | :-------------------------- | :----------- | :----------- | :----------- | :----------- | :----------- | :----------- | | Qualys, Inc. | $100.00 | $111.55 | $163.06 | $183.60 | $150.16 | $262.62 | | NASDAQ Global Select Market | $100.00 | $135.60 | $193.97 | $238.82 | $160.92 | $233.41 | | NASDAQ Computer | $100.00 | $150.34 | $225.48 | $310.84 | $199.64 | $322.34 | | S&P 500 | $100.00 | $131.49 | $155.68 | $200.37 | $164.08 | $207.21 | Purchases of Equity Securities by the Issuer and Affiliated Purchasers Qualys has an active share repurchase program, with $83.7 million remaining as of December 31, 2023, and an additional $200.0 million authorized in February 2024 Common Stock Repurchases (Q4 2023) | Period | Total Number of Shares Purchased | Average Price Paid per Share | Approximate Dollar Value of Shares that May Yet Be Purchased under the Plan or Program | | :------------------------------- | :------------------------------- | :--------------------------- | :-------------------------------------------------------------------------------- | | October 1, 2023 - October 31, 2023 | 76,000 | $156.94 | $94,828,514 | | November 1, 2023 - November 30, 2023 | 49,112 | $171.10 | $86,425,300 | | December 1, 2023 - December 31, 2023 | 14,400 | $190.51 | $83,681,929 | | Total | 139,512 | N/A | N/A | - As of December 31, 2023, $83.7 million remained available under the $1.0 billion share repurchase program. An additional $200.0 million was authorized on February 7, 2024, increasing the total authorization to $1.2 billion[238][239][280] - The company repurchased 1.3 million shares for $170.8 million in 2023, 2.5 million shares for $317.3 million in 2022, and 1.1 million shares for $130.0 million in 2021[438] Item 6. [Reserved] This item is reserved and contains no information - This item is reserved[240] Item 7. Management's Discussion and Analysis of Financial Condition and Results of Operations This section provides a detailed discussion and analysis of Qualys' financial condition and results of operations, covering revenue growth, expenses, and liquidity - Revenues increased by $64.7 million (13%) in 2023 compared to 2022, driven by increased demand for subscription services, with 80% from existing customers and 20% from new customers[256] - Net income increased to $151.6 million in 2023 from $108.0 million in 2022, representing a 40.4% increase[312] - Net cash provided by operating activities was $244.6 million in 2023, up from $198.9 million in 2022[274] Key Financial Highlights (2023 vs. 2022) | Metric | 2023 (in thousands) | 2022 (in thousands) | Change ($) | Change (%) | | :------------------------------------ | :------------------ | :------------------ | :--------- | :--------- | | Revenues | $554,458 | $489,723 | $64,735 | 13% | | Cost of Revenues | $107,485 | $102,788 | $4,697 | 5% | | Research and Development Expenses | $110,472 | $101,186 | $9,286 | 9% | | Sales and Marketing Expenses | $111,691 | $97,221 | $14,470 | 15% | | General and Administrative Expenses | $61,741 | $57,981 | $3,760 | 6% | | Total Other Income, Net | $15,582 | $3,153 | $12,429 | 394% | | Income Tax Provision | $27,056 | $25,708 | $1,348 | 5% | | Net Income | $151,595 | $107,992 | $43,603 | 40.4% | Overview Qualys provides cloud-based IT, security, and compliance solutions via a SaaS model, driving revenue growth from existing and new customers - Qualys provides cloud-based IT, security, and compliance solutions through its Enterprise TruRisk Platform, helping organizations manage assets, identify vulnerabilities, and achieve compliance[242] - The company operates on a software-as-a-service (SaaS) model with renewable annual subscriptions, driving revenue growth from both existing and new customers[244] - In 2023, 60% of revenues were from U.S. customers, with sales conducted through field sales, inside sales, and channel partners (managed security service providers, cloud providers, VARs, consulting firms)[245] Impacts of Current Macroeconomic Environment Macroeconomic factors like inflation, interest rates, and geopolitical conflicts could adversely affect Qualys' business by reducing IT security spending - Macroeconomic factors such as supply chain issues, inflation, rising interest rates, labor shortages, and geopolitical conflicts could adversely affect Qualys' long-term business by potentially reducing IT security spending and extending sales cycles[246] Key Components of Results of Operations This section details the components of revenues, cost of revenues, operating expenses, other income/expense, and income tax provision - Revenues are primarily derived from subscription sales to cloud-based IT, security, and compliance solutions, typically invoiced annually and recognized ratably over the subscription term[247][248] - Cost of revenues includes personnel expenses for platform operations and support, depreciation of equipment, shared cloud platform costs, and software/license fees, expected to increase in absolute dollars[249] - Operating expenses (R&D, Sales & Marketing, G&A) are primarily driven by personnel costs, with R&D focused on continuous improvement and new solutions, Sales & Marketing on expanding sales force and programs, and G&A on supporting growth and compliance[250][251][252] - Other income (expense), net, includes interest and returns from marketable securities, non-marketable securities gains/losses, and foreign exchange gains/losses. Income tax provision is based on federal, state, and foreign income taxes, with estimates for deferred tax assets and liabilities[253][254] Results of Operations Revenues increased by 13% in 2023, driven by subscription services, with changes in cost of revenues and operating expenses impacting net income Consolidated Statements of Operations Data as Percentage of Revenues | Item | 2023 | 2022 | | :-------------------------- | :--- | :--- | | Revenues | 100% | 100% | | Cost of revenues | 19% | 21% | | Gross profit | 81% | 79% | | Operating expenses: | | | | Research and development | 20% | 21% | | Sales and marketing | 20% | 20% | | General and administrative | 12% | 11% | | Total operating expenses | 52% | 52% | | Income from operations | 29% | 27% | | Total other income, net | 3% | —% | | Income before income taxes | 32% | 27% | | Income tax provision | 5% | 5% | | Net income | 27% | 22% | - Revenues increased by $64.7 million (13%) in 2023, with 80% from existing customers and 20% from new customers. 62% of the increase was from U.S. customers, and 54% of the increase was from partners[256] - Cost of revenues increased by $4.7 million (5%) in 2023 due to higher personnel costs and shared cloud platform costs, partially offset by lower depreciation and amortization[257] - R&D expenses increased by $9.3 million (9%) due to higher personnel costs. Sales and marketing expenses increased by $14.5 million (15%) due to increased headcount and travel. G&A expenses increased by $3.8 million (6%) due to personnel costs, partially offset by lower professional and legal expenses[258][259][260] - Total other income, net, increased by $12.4 million (394%) in 2023, primarily due to a $11.7 million increase in interest income from higher market interest rates and a $1.2 million decrease in foreign currency loss[261] - Income tax provision increased by $1.3 million (5%) in 2023, primarily due to increased pretax income and lower excess tax benefits from stock-based compensation, partially offset by higher foreign tax credits and lower R&D capitalization for tax purposes[263][264] Key Operating and Non-GAAP Financial Performance Metrics This section presents key operating metrics like Net Dollar Expansion Rate and non-GAAP financial measures such as Adjusted EBITDA for performance evaluation Net Dollar Expansion Rate (LTM) | Year Ended December 31, | Net Dollar Expansion Rate | | :---------------------- | :------------------------ | | 2023 | 105% | | 2022 | 109% | - Adjusted EBITDA is monitored as a non-GAAP measure to evaluate operational performance, excluding certain non-cash and non-recurring items[269][270] Adjusted EBITDA Reconciliation | Metric | 2023 (in thousands) | 2022 (in thousands) | | :------------------------------------------ | :------------------ | :------------------ | | Net income | $151,595 | $107,992 | | Net income as a percentage of revenues | 27% | 22% | | Depreciation and amortization | $23,904 | $28,936 | | Amortization of intangible assets | $3,087 | $5,686 | | Income tax provision | $27,056 | $25,708 | | Stock-based compensation | $69,079 | $53,408 | | Total other income, net | $(15,582) | $(3,153) | | Adjusted EBITDA | $259,139 | $218,577 | | Adjusted EBITDA as a percentage of revenues | 47% | 45% | Liquidity and Capital Resources Qualys manages liquidity through cash, marketable securities, and operating cash flow, with material cash requirements for leases, capital expenditures, and share repurchases - As of December 31, 2023, principal liquidity sources included $482.2 million in cash, cash equivalents, and marketable securities, with $94.8 million of cash held outside the U.S.[274] Summary of Cash Flows (in thousands) | Activity | 2023 | 2022 | | :---------------------------------------- | :--------- | :--------- | | Net cash provided by operating activities | $244,605 | $198,854 | | Net cash (used in) provided by investing activities | $(73,166) | $145,068 | | Net cash used in financing activities | $(141,493) | $(306,031) | | Net increase in cash, cash equivalents and restricted cash | $29,946 | $37,891 | - Material cash requirements include operating lease obligations ($31.1 million as of Dec 31, 2023), capital expenditures ($15.0-$20.0 million expected in 2024), and other non-cancelable purchase obligations ($70.6 million)[279] - The company expects to continue share repurchases under its program, with $83.7 million remaining as of December 31, 2023, and an additional $200.0 million authorized in February 2024[279][280] Critical Accounting Estimates Financial statement preparation requires significant estimates and assumptions, particularly for income taxes and stock-based compensation, which involve management judgment - The preparation of financial statements requires significant estimates and assumptions, particularly for income taxes and stock-based compensation[281] - Judgments in income tax provisions include geographic income mix, future income expectations, interpretation of tax laws, and outcomes of audits. Stock-based compensation fair value estimates rely on assumptions like expected life and stock price volatility[282][284] Item 7A. Quantitative and Qualitative Disclosures About Market Risk Qualys is exposed to market risks, primarily foreign currency exchange rate fluctuations and interest rate sensitivity, mitigated by forward contracts and investment portfolio management - Qualys is exposed to foreign currency exchange rate fluctuations, particularly between the U.S. Dollar and EUR, GBP, INR, and CAD, affecting operations and cash flows[286] - The company uses foreign currency forward contracts to reduce exposure to these fluctuations, with designated cash flow hedges for forecasted revenue and expenses, and non-designated contracts for assets/liabilities[286] - Interest rate sensitivity primarily relates to cash, cash equivalents, and marketable securities. A hypothetical 100 basis point increase in interest rates would decrease the fair value of marketable securities by $1.4 million as of December 31, 2023[287] Item 8. Financial Statements and Supplementary Data This section presents Qualys' audited consolidated financial statements for the years ended December 31, 2023, 2022, and 2021, including the Balance Sheets, Statements of Operations, Comprehensive Income, Cash Flows, and Stockholders' Equity, along with detailed notes. The independent registered public accounting firm issued unqualified opinions on both the financial statements and internal control over financial reporting - The independent registered public accounting firm, Grant Thornton LLP, issued an unqualified opinion on Qualys' consolidated financial statements as of and for the year ended December 31, 2023[293] - An unqualified opinion was also expressed on the effectiveness of the company's internal control over financial reporting as of December 31, 2023[294][301] Reports of Independent Registered Public Accounting Firm Grant Thornton LLP issued unqualified opinions on Qualys' consolidated financial statements and the effectiveness of internal control over financial reporting - Grant Thornton LLP provided an unqualified opinion on the consolidated financial statements for the three years ended December 31, 2023, and on the effectiveness of internal control over financial reporting as of December 31, 2023[293][294][301][302] - No critical audit matters were determined for the current period audit of the financial statements[297] Consolidated Balance Sheets This table presents Qualys' financial position, including assets, liabilities, and stockholders' equity, as of December 31, 2023, and 2022 Consolidated Balance Sheets (in thousands) | Asset/Liability | December 31, 2023 | December 31, 2022 | | :------------------------------------------ | :------------------ | :------------------ | | Assets: | | | | Cash and cash equivalents | $203,665 | $173,719 | | Short-term marketable securities | $221,893 | $147,608 | | Accounts receivable, net | $146,226 | $121,795 | | Total current assets | $599,998 | $473,338 | | Long-term marketable securities | $56,644 | $59,206 | | Property and equipment, net | $32,599 | $47,428 | | Total assets | $812,618 | $700,941 | | Liabilities: | | | | Deferred revenues, current | $333,267 | $293,728 | | Total current liabilities | $389,208 | $352,188 | | Deferred revenues, noncurrent | $31,671 | $23,490 | | Total liabilities | $444,444 | $411,812 | | Stockholders' Equity: | | | | Total stockholders' equity | $368,174 | $289,129 | Consolidated Statements of Operations This table details Qualys' revenues, expenses, and net income for the fiscal years ended December 31, 2023, 2022, and 2021 Consolidated Statements of Operations (in thousands, except per share data) | Item | 2023 | 2022 | 2021 | | :------------------------------------------ | :--------- | :--------- | :--------- | | Revenues | $554,458 | $489,723 | $411,172 | | Gross profit | $446,973 | $386,935 | $321,733 | | Total operating expenses | $283,904 | $256,388 | $234,050 | | Income from operations | $163,069 | $130,547 | $87,683 | | Total other income, net | $15,582 | $3,153 | $1,714 | | Income before income taxes | $178,651 | $133,700 | $89,397 | | Income tax provision | $27,056 | $25,708 | $18,437 | | Net income | $151,595 | $107,992 | $70,960 | | Net income per share: | | | | | Basic | $4.11 | $2.81 | $1.82 | | Diluted | $4.03 | $2.74 | $1.77 | Consolidated Statements of Comprehensive Income This table presents Qualys' net income and other comprehensive income (loss) for the fiscal years ended December 31, 2023, 2022, and 2021 Consolidated Statements of Comprehensive Income (in thousands) | Item | 2023 | 2022 | 2021 | | :------------------------------------------ | :--------- | :--------- | :--------- | | Net income | $151,595 | $107,992 | $70,960 | | Other comprehensive income (loss), net of tax | $243 | $(2,954) | $1,491 | | Comprehensive income | $151,838 | $105,038 | $72,451 | Consolidated Statements of Cash Flows This table summarizes Qualys' cash flows from operating, investing, and financing activities for the fiscal years ended December 31, 2023, 2022, and 2021 Consolidated Statements of Cash Flows (in thousands) | Activity | 2023 | 2022 | 2021 | | :---------------------------------------- | :--------- | :--------- | :--------- | | Net cash provided by operating activities | $244,605 | $198,854 | $200,616 | | Net cash (used in) provided by investing activities | $(73,166) | $145,068 | $(29,532) | | Net cash used in financing activities | $(141,493) | $(306,031) | $(107,888) | | Net increase in cash, cash equivalents and restricted cash | $29,946 | $37,891 | $63,196 | | Cash, cash equivalents and restricted cash at end of period | $206,365 | $176,419 | $138,528 | Consolidated Statements of Stockholders' Equity This section outlines changes in Qualys' stockholders' equity, including net income, stock issuances, and share repurchases, for the past three fiscal years - Total stockholders' equity increased from $289.1 million in 2022 to $368.2 million in 2023[320] - Key changes in stockholders' equity in 2023 included net income of $151.6 million, issuance of common stock from option exercises ($45.6 million) and ESPP ($6.1 million), and repurchase of common stock ($170.8 million)[320] Notes to Consolidated Financial Statements These notes provide detailed information and explanations supporting the consolidated financial statements, including accounting policies and estimates NOTE 1. The Company and Summary of Significant Accounting Policies This note describes Qualys, Inc. and its significant accounting policies, including revenue recognition, fair value measurements, and recent accounting pronouncements - Qualys, Inc. is a Delaware-incorporated company providing cloud-based IT, security, and compliance solutions, headquartered in Foster City, California, with wholly-owned subsidiaries globally[322] - Financial statements are prepared in accordance with U.S. GAAP, requiring management estimates for revenue recognition, credit loss allowance, goodwill/intangible asset valuation, leases, stock-based compensation, and income tax provision[323][324] - No single customer or channel partner accounted for more than 10% of revenues or accounts receivable in 2023 or 2022, indicating dispersed credit risk[326] - Recently issued ASUs 2023-07 (enhanced segment disclosures) and 2023-09 (enhanced income tax disclosures) are effective for fiscal years beginning after December 15, 2023, and 2024, respectively, with impact analysis ongoing[363][364] NOTE 2. Fair Value of Financial Instruments This note details the fair value measurement of Qualys' financial instruments, categorizing them by Level 1, 2, or 3 inputs - Qualys measures financial instruments at fair value using a hierarchy: Level 1 (quoted prices in active markets), Level 2 (observable inputs other than Level 1), and Level 3 (unobservable inputs)[367][368][369] Fair Value of Financial Assets and Liabilities (December 31, 2023, in thousands) | Item | Level 1 | Level 2 | Fair Value | | :------------------------------ | :------ | :------ | :--------- | | Assets: | | | | | Money market funds | $87 | — | $87 | | Commercial paper | — | $54,279 | $54,279 | | U.S. Treasury and government agencies | — | $208,536 | $208,536 | | Corporate bonds | — | $56,465 | $56,465 | | Asset-backed securities | — | $13,881 | $13,881 | | Foreign currency forward contracts | — | $111 | $111 | | Total assets | $87 | $333,272 | $333,359 | | Liabilities: | | | | | Foreign currency forward contracts | — | $1,986 | $1,986 | | Total liabilities | — | $1,986 | $1,986 | - Unrealized losses on marketable securities as of December 31, 2023, were primarily due to rising market interest rates, not credit risk, and the company does not intend to sell these securities before recovery of their amortized cost basis[376] - Qualys uses foreign currency forward contracts as designated cash flow hedges for forecasted subscription revenue and operating expenses, and as non-designated hedges for foreign currency denominated assets/liabilities[378][381] NOTE 3. Accumulated Other Comprehensive Income (Loss) This note presents the components of accumulated other comprehensive income (loss), including unrealized gains/losses on marketable securities and derivatives Accumulated Other Comprehensive Income (Loss) (in thousands) | Item | December 31, 2023 | December 31, 2022 | December 31, 2021 | | :------------------------------------------ | :------------------ | :------------------ | :------------------ | | Balances at beginning of period | $(1,947) | $1,007 | $(484) | | Net change during the period | $243 | $(2,954) | $1,491 | | Balances at end of period | $(1,704) | $(1,947) | $1,007 | - Other comprehensive income (loss) consists of unrealized gains (losses) on marketable securities and derivative financial instruments designated as cash flow hedges, net of tax[359] - A net unrealized loss of $1.5 million before tax on GBP and EUR forward contracts is expected to be reclassified into revenue within the next 12 months[380] NOTE 4. Property and Equipment, Net This note provides a breakdown of Qualys' property and equipment, net of accumulated depreciation and amortization, as of December 31, 2023 and 2022 Property and Equipment, Net (in thousands) | Category | December 31, 2023 | December 31, 2022 | | :-------------------------- | :------------------ | :------------------ | | Computer equipment | $179,002 | $173,832 | | Computer software | $26,133 | $25,808 | | Leasehold improvements | $20,924 | $21,009 | | Scanner appliances | $18,369 | $15,696 | | Furniture, fixtures and equipment | $6,699 | $6,524 | | Total property and equipment | $251,127 | $242,869 | | Less: accumulated depreciation and amortization | $(218,528) | $(195,441) | | Property and equipment, net | $32,599 | $47,428 | - Depreciation and amortization expenses for property and equipment were $23.9 million in 2023, $28.2 million in 2022, and $28.5 million in 2021, mainly recorded in cost of revenues[387] - Physical scanner appliances and other computer equipment leased to customers had a net carrying value of $10.1 million in 2023 and $6.7 million in 2022[386] NOTE 5. Revenue from Contracts with Customers This note details Qualys' revenue recognition policies, disaggregates revenue by sales channel, and presents expected revenue from remaining performance obligations - Revenue is derived from subscriptions to cloud solutions, generally recognized ratably over contract terms (typically one year)[347][350] - Deferred revenue recognized in 2023 was $292.2 million (from 2022 balance of $317.2 million), and in 2022 was $254.9 million (from 2021 balance of $290.6 million)[388] Revenue by Sales Channel (in thousands) | Sales Channel | 2023 | 2022 | 2021 | | :-------------- | :--------- | :--------- | :--------- | | Direct | $314,988 | $285,382 | $243,389 | | Partner | $239,470 | $204,341 | $167,783 | | Total | $554,458 | $489,723 | $411,172 | Expected Revenue from Remaining Performance Obligations (as of December 31, 2023, in thousands) | Year | Expected Revenue | | :--- | :--------------- | | 2024 | $200,872 | | 2025 | $122,465 | | 2026 | $46,327 | | 2027 | $4,291 | | 2028 | $397 | | 2029 and thereafter | $63 | | Total | $374,415 | NOTE 6. Acquisitions This note describes Qualys' asset acquisitions, including Blue Hexagon Inc. in 2022 and TotalCloud in 2021, and their accounting treatment - On October 4, 2022, Qualys acquired certain assets of Blue Hexagon Inc. for $10.0 million in cash, accounted for as an asset acquisition, recognizing $11.5 million in developed technology and $0.4 million in assembled workforce[394] - On August 19, 2021, Qualys acquired developed technology intangible assets of TotalCloud for $1.2 million in cash, strengthening its cloud security solution[395][397] - There were no changes in the carrying amount of goodwill for the years ended December 31, 2023, and 2022[398] NOTE 7. Intangible Assets, Net This note provides a breakdown of Qualys' intangible assets, net of accumulated amortization, and expected future amortization expense Intangible Assets, Net (December 31, 2023, in thousands) | Category | Weighted Average Life (Years) | Weighted Average Remaining Life (Years) | Cost | Accumulated Amortization | Net Book Value | | :-------------------------------- | :---------------------------- | :------------------------------------ | :--------- | :----------------------- | :------------- | | Developed technology | 4.6 | 1.1 | $40,141 | $(30,667) | $9,474 | | Patent licenses | 14.0 | 0.7 | $1,387 | $(1,322) | $65 | | Assembled workforce | 2.0 | 0.8 | $359 | $(223) | $136 | | Total intangibles subject to amortization | N/A | N/A | $41,887 | $(32,212) | $9,675 | | Intangible assets not subject to amortization | N/A | N/A | N/A | N/A | $40 | | Total intangible assets, net | N/A | N/A | N/A | N/A | $9,715 | - Intangible assets amortization expenses were $3.1 million in 2023, $5.7 million in 2022, and $6.7 million in 2021[400] Expected Future Amortization Expense (as of December 31, 2023, in thousands) | Year | Amortization Expense | | :--- | :------------------- | | 2024 | $2,904 | | 2025 | $2,556 | | 2026 | $2,477 | | 2027 | $1,738 | | Total | $9,675 | NOTE 8. Leases This note details Qualys' operating lease arrangements for offices, equipment, and cloud facilities, including lease expenses and maturity schedules - Qualys leases offices, computer equipment, and shared cloud platform facilities under non-cancelable operating leases through 2028[403] - Lease expense was $16.1 million in 2023, $14.9 million in 2022, and $16.8 million in 2021[403] Operating Lease Liabilities Maturities (as of December 31, 2023, in thousands) | Year | Total Minimum Lease Payments | | :--- | :--------------------------- | | 2024 | $13,053 | | 2025 | $7,747 | | 2026 | $4,498 | | 2027 | $4,353 | | 2028 | $1,466 | | Total | $31,117 | - The weighted average remaining lease term for operating leases was 3.1 years, and the weighted average discount rate was 5.2% as of December 31, 2023[404] NOTE 9. Commitment and Contingencies This note outlines Qualys' purchase commitments and indemnification agreements, noting no material losses from legal proceedings as of December 31, 2023 Purchase Commitments (as of December 31, 2023, in thousands) | Year | Purchase Commitments | | :--- | :------------------- | | 2024 | $20,743 | | 2025 | $18,768 | | 2026 | $12,365 | | 2027 | $9,784 | | Total | $61,660 | - Qualys enters into indemnification agreements, primarily for directors, executive officers, customers, and resellers, but has not incurred or recorded any liability in connection with such indemnifications to date[406] - As of December 31, 2023, there was no reasonable possibility of incurring a material loss from any ongoing legal proceedings[409] NOTE 10. Stockholders' Equity and Stock-based Compensation This note details Qualys' equity structure, stock-based compensation plans, related expenses, and share repurchase activities - Qualys is authorized to issue 20.0 million shares of preferred stock ($0.001 par value), with no shares issued or outstanding as of December 31, 2023[410] - The Restated 2012 Equity Incentive Plan and 2021 Employee Stock Purchase Plan (ESPP) govern equity awards. As of December 31, 2023, 1.8 million shares were available for future grants under the 2012 Plan and 0.5 million under the ESPP[412][413][414] Stock-based Compensation Expenses (in thousands) | Category | 2023 | 2022 | 2021 | | :------------------------------------------ | :--------- | :--------- | :--------- | | Cost of revenues | $7,300 | $5,305 | $3,782 | | Research and development | $21,091 | $14,585 | $10,750 | | Sales and marketing | $12,234 | $9,837 | $6,323 | | General and administrative | $28,454 | $23,681 | $46,724 | | Total stock-based compensation | $69,079 | $53,408 | $67,579 | - As of December 31, 2023, unrecognized stock-based compensation expenses totaled $23.3 million for options, $94.3 million for RSUs, $1.4 million for performance-based RSUs, and $0.3 million for ESPP, to be recognized over weighted-average periods of 0.1 to 2.8 years[417] - The company repurchased 1.3 million shares for $170.8 million in 2023, 2.5 million shares for $317.3 million in 2022, and 1.1 million shares for $130.0 million in 2021 under its share repurchase program[438] NOTE 11. Employee Benefits Plan This note provides information on Qualys' employee benefits plans, including contributions to the 401(k) Plan and India Provident Fund Plan Employee Benefits Plan Contributions (in millions) | Plan | 2023 | 2022 | 2021 | | :-------------------- | :--- | :--- | :--- | | 401(k) Plan | $4.1 | $3.5 | $2.4 | | India Provident Fund Plan | $2.3 | $2.0 | $1.7 | NOTE 12. Income Taxes This note details Qualys' income tax provision, effective tax rate reconciliation, deferred tax assets/liabilities, and unrecognized tax benefits Income Before Income Taxes by Geography (in thousands) | Geography | 2023 | 2022 | 2021 | | :---------- | :--------- | :--------- | :--------- | | Domestic | $164,958 | $122,013 | $80,472 | | Foreign | $13,693 | $11,687 | $8,925 | | Total | $178,651 | $133,700 | $89,397 | Income Tax Provision (in thousands) | Category | 2023 | 2022 | 2021 | | :-------------------------- | :--------- | :--------- | :--------- | | Current income tax provision | $43,684 | $46,161 | $28,160 | | Deferred income tax benefit | $(16,628) | $(20,453) | $(9,723) | | Income tax provision | $27,056 | $25,708 | $18,437 | Effective Tax Rate Reconciliation | Item | 2023 | 2022 | 2021 | | :------------------------------------------ | :--- | :--- | :--- | | Federal statutory rate | 21.0% | 21.0% | 21.0% | | State taxes | 2.6% | 2.3% | 3.1% | | Stock-based compensation | 2.7% | 3.4% | 10.3% | | Excess tax benefits related to stock-based compensation | (2.9)% | (5.2)% | (5.4)% | | Foreign source income | 0.3% | 3.8% | 0.4% | | Foreign-derived intangible income deduction | (4.4)% | (4.9)% | (7.0)% | | Income tax provision (Effective Tax Rate) | 15.1% | 19.2% | 20.6% | - As of December 31, 2023, Qualys had net deferred tax assets of $62.8 million, with a valuation allowance of $12.4 million primarily against California deferred tax assets[445][446] - Total unrecognized tax benefits were $11.9 million as of December 31, 2023, with $6.1 million impacting the income tax provision if recognized[448] NOTE 13. Segment and Geographic Area Information This note confirms Qualys operates in one reportable segment and provides revenue and long-lived asset information by geographic area - Qualys operates in one reportable segment, with the CEO acting as the chief operating decision maker, assessing performance and allocating resources on a consolidated basis[451] Revenue by Geographic Area (in thousands) | Geographic Area | 2023 | 2022 | 2021 | | :---------------- | :--------- | :--------- | :--------- | | United States | $332,315 | $292,291 | $252,428 | | Foreign | $222,143 | $197,432 | $158,744 | | Total revenues | $554,458 | $489,723 | $411,172 | Long-Lived Assets by Geographic Area (in thousands) | Geographic Area | December 31, 2023 | December 31, 2022 | | :---------------- | :-----