Qualys(QLYS) - 2022 Q4 - Annual Report

Part I Business Qualys, Inc. provides a leading cloud-based platform for IT, security, and compliance solutions, serving over 10,000 global customers via a SaaS model with annual subscriptions - Qualys is a pioneer and leading provider of a cloud-based platform delivering IT, security, and compliance solutions to over 10,000 customers worldwide[21][29] - The business model is primarily software-as-a-service (SaaS) with renewable annual subscriptions, recognized ratably[28] - In 2022, the company introduced new Cloud Apps: Custom Assessment and Remediation (CAR), Context Extended Detection and Response (XDR), and Network Detection and Response (NDR)[40] Revenue Growth (2020-2022) | Year | Revenues (in millions) | | :--- | :--- | | 2022 | $489.7 | | 2021 | $411.2 | | 2020 | $363.0 | Our Platform The Qualys Cloud Platform delivers integrated IT, security, and compliance solutions through a scalable multi-tenant infrastructure, utilizing sensors and agents for continuous visibility - The platform consists of Qualys Cloud Apps, core services, and a scalable multi-tenant cloud infrastructure, leveraging physical/virtual sensors and cloud agents for continuous visibility[30][31] - Solutions are delivered via 11 global shared cloud platforms or a Qualys Private Cloud Platform (PCP) for on-premises or dedicated cloud environments[35] - Core services include Asset Tagging and Management, Reporting and Dashboards, Remediation and Workflow, and a Big Data Correlation and Analytics Engine using Elasticsearch[36][43] Our Growth Strategy Qualys's growth strategy centers on continuous innovation, expanding existing customer solutions, driving new customer acquisition, and selective technology acquisitions - Continuously innovate and enhance the cloud platform, with CAR, XDR, and NDR introduced in 2022[75] - Expand solution usage within the existing base of over 10,000 customers[75] - Drive new customer growth through free services and by expanding relationships with channel partners like AWS, Microsoft Azure, and Google Cloud Platform[75][77] - Selectively pursue technology acquisitions, such as the 2022 acquisition of Blue Hexagon Inc. to add AI/machine learning capabilities for threat detection[75] Sales and Marketing Qualys employs a dual sales strategy with direct and inside teams, significantly leveraging channel partners who accounted for 42% of 2022 revenues - Sales are conducted through a direct field sales team for enterprises and an inside sales team for SMBs[76] - Channel partners, including Accenture, IBM, and Verizon, are a key sales channel, with Qualys selling subscriptions to partners for resale[77][78] Revenue from Channel Partners | Year | Revenue from Channel Partners (%) | | :--- | :--- | | 2022 | 42% | | 2021 | 41% | | 2020 | 42% | Human Capital Resources As of December 31, 2022, Qualys had 2,143 employees, with 75% located outside the U.S. and 66% in Pune, India, promoting diversity and a hybrid work model Employee Headcount by Department (as of Dec 31, 2022) | Department | Number of Employees | | :--- | :--- | | Research and Development | 1,062 | | Sales and Marketing | 376 | | Operations and Customer Support | 478 | | General and Administrative | 227 | | Total | 2,143 | - Approximately 75% of employees were located outside the U.S., with 66% in Pune, India[94] - The company promotes diversity, with two of seven board members being women and over 50% of the executive team from underrepresented communities[96] Risk Factors The company faces significant risks including operational variability, innovation challenges, intense competition, security incidents, reliance on third-party partners, international operations, and evolving legal and regulatory landscapes - Business & Operational Risks: Potential for fluctuating operating results, failure to innovate or scale the platform, reliance on subscription renewals, and adverse economic conditions[108][111][115] - Security & Service Risks: The platform may be subject to security incidents, potentially harming reputation and leading to liability, with service disruptions at shared cloud platforms also posing a risk[121][128] - Market & Competition Risks: Intense competition from established players like Broadcom, CrowdStrike, Palo Alto Networks, Rapid7, and Tenable, with solution failures potentially harming the brand[133][140] - Dependency Risks: Reliance on third-party channel partners (generating 42% of 2022 revenue), risks of international operations (75% of employees outside the U.S.), and dependence on key management personnel[145][147][158] - Legal & Regulatory Risks: Evolving data privacy laws (GDPR, CCPA), use of open-source software, potential IP infringement claims, and compliance with export controls could impose significant costs[173][178][188] Properties Qualys's principal executive offices are in Foster City, California, with a major office in Pune, India, and shared cloud platforms operated from third-party facilities globally - Principal executive offices are located in Foster City, California (76,922 sq. ft. lease until April 2028)[218] - A major office is located in Pune, India (281,787 sq. ft. lease until February 2025)[218] - Shared cloud platforms are operated at third-party facilities in the U.S., Canada, Switzerland, India, and the Netherlands[219] Legal Proceedings As of December 31, 2022, Qualys accrued $1.5 million for a probable legal loss, noting that litigation outcomes are unpredictable and could materially impact financial results - As of December 31, 2022, the company had an accrual of $1.5 million in accrued liabilities for a legal matter where loss is probable and estimable[411] - The company states it is not reasonably possible that it has incurred a material loss from any other ongoing legal proceedings, individually or combined[220] Part II Market for Registrant's Common Equity, Related Stockholder Matters and Issuer Purchases of Equity Securities Qualys common stock trades on Nasdaq under "QLYS"; the company has never paid dividends but has an active share repurchase program, authorizing $900.0 million as of year-end 2022, with 847,598 shares repurchased in Q4 2022 - The company's common stock is traded on the Nasdaq Global Select Market under the symbol "QLYS"[224] - Qualys has never declared or paid cash dividends and does not expect to in the foreseeable future[226] - The board authorized a share repurchase program, with an aggregate authorization of $900.0 million as of December 31, 2022, and an additional $100.0 million authorized on February 9, 2023[234][235] Share Repurchases (Q4 2022) | Period | Total Shares Purchased | Average Price Paid per Share | | :--- | :--- | :--- | | Oct 2022 | 231,057 | $136.68 | | Nov 2022 | 285,100 | $121.98 | | Dec 2022 | 331,441 | $115.09 | | Total Q4 | 847,598 | | Management's Discussion and Analysis of Financial Condition and Results of Operations In fiscal year 2022, Qualys reported $489.7 million in revenue, a 19% increase, with net income rising to $108.0 million, supported by strong liquidity and healthy operating cash flow of $198.9 million Financial Highlights (2022 vs 2021) | Metric | 2022 (in millions) | 2021 (in millions) | Change (%) | | :--- | :--- | :--- | :--- | | Revenues | $489.7 | $411.2 | +19% | | Gross Profit | $386.9 | $321.7 | +20% | | Income from Operations | $130.5 | $87.7 | +49% | | Net Income | $108.0 | $71.0 | +52% | | Diluted EPS | $2.74 | $1.77 | +55% | - The Net Dollar Expansion Rate was 109% for 2022, indicating strong growth from existing customers[266] - Adjusted EBITDA for 2022 was $218.6 million (45% of revenues), compared to $191.2 million (46% of revenues) in 2021[271] - Cash provided by operating activities was $198.9 million in 2022, with $317.3 million used for share repurchases[272][276] Results of Operations For 2022, revenues grew 19% to $489.7 million, driven by customer expansion, while operating expenses increased across R&D and Sales & Marketing, leading to a 49% rise in income from operations to $130.5 million Revenue Analysis (2022 vs 2021) | Metric | 2022 | 2021 | Change ($) | Change (%) | | :--- | :--- | :--- | :--- | :--- | | Revenues | $489.7M | $411.2M | +$78.6M | +19% | Operating Expenses Analysis (2022 vs 2021) | Expense Category | 2022 (in millions) | 2021 (in millions) | Change (%) | | :--- | :--- | :--- | :--- | | Cost of Revenues | $102.8 | $89.4 | +15% | | Research & Development | $101.2 | $81.3 | +24% | | Sales & Marketing | $97.2 | $76.5 | +27% | | General & Administrative | $58.0 | $76.3 | -24% | - The $18.3 million decrease in G&A expenses was primarily due to a $27.3 million stock-based compensation expense in 2021 related to the former CEO's grants[259] Liquidity and Capital Resources As of December 31, 2022, Qualys held $380.5 million in cash and generated $198.9 million from operations, with major cash uses including $317.3 million for share repurchases and $15.4 million for capital expenditures Cash Flow Summary (2022 vs 2021) | Cash Flow Activity | 2022 (in millions) | 2021 (in millions) | | :--- | :--- | :--- | | Cash from Operating Activities | $198.9 | $200.6 | | Cash from (used in) Investing Activities | $145.1 | ($29.5) | | Cash used in Financing Activities | ($306.0) | ($107.9) | - The principal source of liquidity as of December 31, 2022, was $380.5 million in cash, cash equivalents, and marketable securities[272] - Major cash uses in 2022 were $317.3 million for share repurchases and $15.4 million for capital expenditures[275][276] - Material cash requirements include $46.4 million for operating leases and $77.1 million for other purchase obligations[278][279] Financial Statements and Supplementary Data This section presents Qualys's audited consolidated financial statements for 2022, with Grant Thornton LLP providing an unqualified opinion on both financial statements and internal controls, highlighting stock-based compensation tax effects as a critical audit matter - The independent auditor, Grant Thornton LLP, issued an unqualified opinion on the financial statements and the effectiveness of internal control over financial reporting as of December 31, 2022[292][302] - The auditor identified the tax effects of temporary and permanent differences related to stock-based compensation as a critical audit matter due to its complexity and required expertise[297][298] Consolidated Balance Sheet Highlights (as of Dec 31, 2022) | Category | Amount (in thousands) | | :--- | :--- | | Total Assets | $700,941 | | Cash, cash equivalents, and marketable securities | $380,533 | | Total Current Assets | $473,338 | | Total Liabilities | $411,812 | | Deferred Revenues (Current & Noncurrent) | $317,218 | | Total Current Liabilities | $352,188 | | Total Stockholders' Equity | $289,129 | Consolidated Statement of Operations (Year Ended Dec 31, 2022) | Category | Amount (in thousands) | | :--- | :--- | | Revenues | $489,723 | | Gross Profit | $386,935 | | Income from Operations | $130,547 | | Net Income | $107,992 | Controls and Procedures Management, including the CEO and CFO, concluded that disclosure controls and internal control over financial reporting were effective as of December 31, 2022, with the independent auditor concurring and no material changes identified - The CEO and CFO concluded that the company's disclosure controls and procedures were effective as of December 31, 2022[453] - Management concluded that the company's internal control over financial reporting was effective as of December 31, 2022, based on the COSO framework[456] - No material changes in internal control over financial reporting occurred during the fourth quarter of 2022[458] Part III Directors, Executive Officers and Corporate Governance Information on directors, executive officers, and corporate governance is incorporated by reference from the 2023 Proxy Statement, with the company maintaining a public code of business conduct and ethics - The information for this item is incorporated by reference from the registrant's Proxy Statement for the 2023 Annual Meeting of Stockholders[462] - The company has adopted a code of business conduct and ethics applicable to all employees, officers, and directors, available on its website[463] Executive Compensation Information regarding executive compensation is incorporated by reference from the company's 2023 Proxy Statement - The information for this item is incorporated by reference from the registrant's Proxy Statement for the 2023 Annual Meeting of Stockholders[464] Security Ownership of Certain Beneficial Owners and Management and Related Stockholder Matters Information on security ownership of beneficial owners and management is incorporated by reference from the company's 2023 Proxy Statement - The information for this item is incorporated by reference from the registrant's Proxy Statement for the 2023 Annual Meeting of Stockholders[465] Certain Relationships and Related Transactions, and Director Independence Information on certain relationships, related transactions, and director independence is incorporated by reference from the company's 2023 Proxy Statement - The information for this item is incorporated by reference from the registrant's Proxy Statement for the 2023 Annual Meeting of Stockholders[466] Principal Accounting Fees and Services Information on principal accounting fees and services is incorporated by reference from the company's 2023 Proxy Statement - The information for this item is incorporated by reference from the registrant's Proxy Statement for the 2023 Annual Meeting of Stockholders[467] Part IV Exhibits and Financial Statement Schedules This section lists financial statements and exhibits filed with the Form 10-K, including corporate governance documents, material contracts, and CEO/CFO certifications - This section provides a list of all financial statements and exhibits filed with the Form 10-K[470][471] - Key exhibits include the Amended and Restated Certificate of Incorporation, various equity incentive plans, and certifications from the CEO and CFO as required by the Sarbanes-Oxley Act[471][472]