QLYS 10-K & 10-Q changes, risk factors and insider trading

We and our service providers and suppliers face threats from a variety of sources, including attacks on our networks and systems from numerous sources, including but not limited to traditional “hackers,” sophisticated nation-state and nation-state supported actors, other sources of malicious code (such as viruses and worms), ransomware, social engineering, denial of service attacks, and phishing attempts. We and our service providers and suppliers could be a target of cyber-attacks or other malfeasance designed to impede the performance of our solutions, penetrate our network security or the security of our cloud platform, products, or our internal systems, misappropriate proprietary information, gain access to our customers' systems and data, and/or cause interruptions to our services. We and our service providers and suppliers have experienced and may continue to experience security incidents and attacks of varying degrees from time to time. We have incurred costs to respond to such incidents and may continue to incur costs to support our efforts to enhance our security measures. Additionally, due to political uncertainty and military actions in parts of Eastern Europe and the Middle East, we and our service providers and suppliers are vulnerable to heightened risks of cybersecurity incidents and security and privacy breaches and incidents caused or initiated by nation-state or affiliated actors, including attacks that could materially disrupt our systems, operations and services, or impact our customers systems, operations, and services.

Our solutions, platforms, and system, and those of our service providers,providers and suppliers, may be, and have in the past been, subject to security incidents as a result of technical and non-technical issues, including as a result of intentional or inadvertent acts or omissions by our employees or service providers. With the increaselevel inof personnel working remotely, at least part-time in our case, we and our service providers and suppliers are at increased risk for security breaches and incidents. We have taken and intend to continue to take steps to monitor and enhance the security of our solutions, cloud platform, and other relevant systems, IT infrastructure, networks, and data; however, the unprecedented scale of remote work may require additional personnel and resources, which nevertheless cannot be guaranteed to fully safeguard our solutions, our cloud platform, or any systems, IT infrastructure networks, or data upon which we rely. Further, because our operations involve providing IT security solutions to our customers, we may be, and have in the past been, targeted for cyber-attacks and other security incidents. We also have incorporated AI/machine learning technologies into our technology, and may continue to incorporate additional AI/machine learning technologies in the future. Our use of such technologies may create additional cybersecurity risks or increase cybersecurity risks, including risks of technical error, security breaches and other incidents. Further, AI/machine learning technologies may be used in connection with certain cybersecurity attacks, resulting in heightened risks of security breaches and incidents.

A breach in or incident impacting our data security, an attack against our service availability, or any breach, incident, or attack impacting our third-party service providers,providers and suppliers, or a technical error or outage, could impact our networks or networks secured by our solutions, creating system disruptions or slowdowns and exploiting security vulnerabilities of our solutions, and the information stored on our networks or those of our third-party service providers could be accessed, used, disclosed publicly or to unauthorized persons, altered, lost, destroyed, or stolen, which could subject us to liability and cause us financial harm. If an actual or perceived disruption in the availability of our solutions or the breach or other compromise of our security measures or those of our service providers occurs, it could adversely affect the market perception of our solutions, result in a loss of competitive advantage, have a negative impact on our reputation, or result in the loss of customers, channel partners and sales, and it may expose us to the loss, unavailability or alteration of information, claims, demands and litigation, regulatory investigations, actions and other proceedingsproceedings, possible liability, and possiblethe liability.potential loss of our authorization under the Federal Risk and Authorization Management Program (“FedRAMP”). Any such actual or perceived security breach or incident or disruption could also divert the efforts of our technical and management personnel. We and our service providers may face difficulties or delays in identifying and responding to any security breach or incident. We also may incur significant costs and operational consequences of investigating, remediating, eliminating and putting in place additional tools and devices designed to prevent actual or perceived security incidents, as well as costs to respond to and otherwise address any breach or incident, including any to comply with any notification obligations resulting from any security incidents. In addition, any such actual or perceived security breach or incident could impair our ability to operate our business and provide solutions to our customers. If this happens, our reputation could be harmed, our revenues could decline and our business could suffer.

Our business depends to a significant extent on the overall demand for IT and on the economic health of our current and prospective customers. Economic weakness, customer financial difficulties, change in interest rates, inflationary pressures and potential for a recession, economic and regulatory uncertainty, and constrained spending on IT security, as well as longer sales cycles, which factors we have experienced insince 2023 and 2024,2023, have resulted and may in the future result in decreased revenue and earnings. In addition, continued governmental budgetary challenges in the United States and Europe, inflationary pressures and potential for a recession, and geopolitical turmoil in many parts of the world, including the ongoing military conflicts in parts of Eastern Europe and the Middle East, and other disruptions to global and regional economies and markets in many parts of the world, as well as uncertainties related to changes in public policies such as domestic and international regulations, taxestaxes, tariffs and non-tariff trade barriers, or international trade agreements, have and may continue to put pressure on global economic conditions and overall spending on IT security and may further increase inflation, both in the U.S. and globally, which could increase our operating costs in the future and reduce overall spending on IT security. For example, uncertainty as to the impact of the imposition of tariffs on certain countries by the current U.S. administration, as well as any potential retaliatory measures by impacted trade partners, could adversely impact trade relations, result in higher costs, and thereby decrease the purchasing power of our customers. General economic weakness may also lead to longer collection cycles for payments due from our customers, an increase in customer bad debt, restructuring initiatives and associated expenses, and impairment of investments. Furthermore, the continued weakness and uncertainty in worldwide credit markets, including the sovereign debt situation in certain countries in the European Union, may adversely impact our European operations, as well as our current and potential customers' available budgetary spending, which could lead to delays or reductions in planned purchases of our solutions.

We currently host substantially all of our solutions from third-party shared cloud platforms located in the United States, Canada, Switzerland, the Netherlands, United Arab Emirates, Australia, United Kingdom, Italy, the Kingdom of Saudi Arabia and India. These facilities are vulnerable to damage or interruption from earthquakes, hurricanes, floods, fires, cybersecurity attacks, terrorist attacks, employee negligence, power losses, technical errors, telecommunications failures and similar events. The facilities also could be subject to break-ins, sabotage, acts of war, intentional acts of vandalism and other misconduct. The occurrence of a natural disaster, an act of war, an act of terrorism or misconduct, a decision to close the facilities without adequate notice or other unanticipated problems could result in interruptions in our services.

We compete with large and small public companies, such as CrowdStrike, Palo Alto Networks, Rapid7, and Tenable Holdings, as well as privately held security providers including Invicti, Tanium, and Wiz.Wiz (which has announced a pending acquisition by Google). We also seek to replace IT, security and compliance solutions that organizations have developed internally. As we continue to extend our cloud platform’s functionality by further developing IT, security and compliance solutions, such as Cybersecurity Asset ManagementManagement, Patch Management, and PatchEnterprise TruRisk Management, we expect to face additional competition in these new markets. Our competitors may also attempt to further expand their presence in the IT, security and compliance market and compete more directly against one or more of our solutions.

Our success significantly depends to a significant extent on establishing and maintaining relationships with a variety of channel partners and we anticipate that we will continue to depend on these partners in order to grow our business. For the years ended December 31, 2024,2025, 20232024 and 2022,2023, we derived approximately 46%,49%, 43%46% and 42%43% of our revenues from sales of subscriptions for our solutions through channel partners, and the percentage of revenues derived from channel partners may increase in future periods. Our agreements with our channel partners are generally non-exclusive and do not prohibit them from working with our competitors or offering competing solutions, and many of our channel partners have more established relationships with our competitors. If our channel partners choose to place greater emphasis on products of their own or those offered by our competitors, do not effectively market and sell our solutions, or fail to meet the needs of our customers, then our ability to grow our business and sell our solutions may be adversely affected. In addition, the loss of one or more of our larger channel partners, who may cease marketing our solutions with limited or no notice, and our possible inability to replace them, could adversely affect our sales. Moreover, our ability to expand our distribution channels depends in part on our ability to educate our channel partners about our solutions, which can be complex. Our failure to effectively manage our relationship with channel partners, or any reduction or delay in their sales of our solutions or conflicts between channel sales and our direct sales and marketing activities may harm our results of operations. Even if we are successful, these relationships may not result in greater customer usage of our solutions or increased revenues.

Government entities have historically been particularly concerned about adopting cloud-based solutions for their operations, including security solutions, and increasing sales of subscriptions for our solutions to government entities may be more challenging than selling to commercial organizations. Selling to government entities can be highly competitive, expensive and time-consuming, often requiring significant upfront time and expense without any assurance that we will win a sale. WeFurthermore, government certification requirements applicable to our platform, including FedRAMP, may change and, in doing so, restrict our ability to sell into the governmental sector until we have invested inattained the creation of a cloud offering certified under the Federal Information Security Management Act for government usage but we cannot be sure that we will continue to sustainfull or renewrevised thiscertification. certification, that the government will continue to mandate such certification or that other government agencies or entities will use this cloud offering. Government demand and payment for our solutions may be impacted by public sector budgetary cycles and funding authorizations, with funding reductions or delays adversely affecting public sector demand for our solutions. GovernmentGovernmental entities may also have statutory, contractual or other legal rights to terminate contracts with us or our channel partners for convenience or duefor toother a default, and any such termination may adversely impact our future results of operations. Governments routinely investigate and audit government contractors’ administrative processes, and any unfavorable audit could result in the government refusing to continue buying our solutions, a reduction of revenues or fines or civil or criminal liability if the audit uncovers improper or illegal activities. Any such penalties could adversely impact our results of operations in a material way.reasons.

In order to remain competitive, we have in the past and may in the future seek to acquire additional businesses, products, services or technologies. For example, we acquired certain assets of Blue Hexagon on October 4, 2022. The environment for acquisitions in our industry is very competitive and acquisition candidate purchase prices may exceed what we would prefer to pay. Moreover, achieving the anticipated benefits of past and future acquisitions will depend in part upon whether we can integrate acquired operations, products and technology in a timely and cost-effective manner, and even if we achieve benefits from acquisitions, such acquisitions may still be viewed negatively by customers, financial markets or investors. The acquisition and integration process is complex, expensive and time-consuming, and may cause an interruption of, or loss of momentum in, product development and sales activities and operations of both companies, as well as divert the attention of management, and we may incur substantial cost and expense. We may issue equity securities which could dilute current stockholders’ ownership, incur debt, assume contingent or other liabilities and expend cash in acquisitions, which could negatively impact our financial position, stockholder equity and stock price. We may not find suitable acquisition candidates, and acquisitions we complete may be unsuccessful. If we consummate a transaction, we may be unable to integrate and manage acquired products and businesses effectively or retain key personnel. If we are unable to effectively execute acquisitions, our business, financial condition and operating results could be adversely affected.

A significant natural disaster, such as an earthquake, fire or a flood, or a significant power outage could have a material adverse impact on our business, operating results and financial condition. Our corporate headquarters and a significant portion of our operations are located in the San Francisco Bay Area, a region known for seismic activity. In addition, natural disasters could affect our business partners’ ability to perform services for us on a timely basis. In the event we or our business partners are hindered by any of the events discussed above, our ability to provide our solutions to customers could be delayed, resulting in our missing financial targets, such as revenues and net income, for a particular quarter. Further, if a natural disaster occurs in a region from which we derive a significant portion of our revenues, customers in that region may delay or forego subscriptions of our solutions, which may materially and adversely impact our results of operations for a particular period. In addition, war, acts of terrorism, pandemics or other health emergencies, or responses to these events could cause disruptions in our business or the business of our business partners, customers or the economy as a whole. All of the aforementioned risks may be exacerbated if the disaster recovery plans for us and our service providers and suppliers prove to be inadequate. To the extent that any of the above results in delays of customer subscriptions or commercialization of our solutions, our business, financial condition and results of operations could be adversely affected.

Although we maintain insurance coverage that may be applicable to certain liabilities in connection with these matters, we cannot be certain that our insurance coverage will be adequate for liabilities that actually are incurred, that insurance will continue to be available to us on economically reasonable terms, or at all, or that any insurer will not deny coverage as to any future claim. The successful assertion of one or more large claims against us that exceed available insurance coverage or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, could have a material and adverse effect on our business, including our financial condition, operating results and reputation.

We collect certain personal and confidential information of our customers in connection with subscriptions to our solutions. Additionally, the data that our solutions collect to help secure and protect the IT infrastructure of our customers may include additional personal or confidential information of our customers’ employees and their customers, and we may collect, store and otherwise process personal or confidential information more generally in connection with our business and operations. Privacy, data protection, and cybersecurity have become significant issues and the subject of extensive regulation in the United States and in many other countries where we offer our solutions. The regulatory frameworkframeworks for privacythese issuesmatters worldwide is currentlyare evolving and isare likely to remain uncertain for the foreseeable future. Many federal, state and foreign government bodies and agencies have adopted or are considering adopting laws and regulations regarding the collection, use, disclosure, retention, transfer, and other processing of personal information. In the United States, these include, for example, rules and regulations promulgated under the authority of the Federal Trade Commission, the Health Insurance Portability and Accountability Act of 1996, the Gramm-Leach-Bliley Act, state privacy laws, and state breach notification laws. Internationally, virtually every jurisdiction in which we operate has established its own data security and privacy legal framework with which we or our customers must comply.

These privacy, data protectionprotection, and information securitycybersecurity laws and regulations may result in ever-increasing regulatory and public scrutiny and escalating levels of enforcement and sanctions. Additionally, new laws and regulations relating to privacy and data protection continue to be proposed and enacted. For example, the European Union's General Data Protection Regulation (“GDPR”), which took effect in May of 2018, provides for substantial obligations relating to the handling, storagestorage, and other processing of data relating to individuals and administrative fines for violations, which can be up to the greater of four percent of the previous year’s annual revenue or €20 million. Additionally, Europe’s Network and Information System Directive (“NIS2”) and its implementing laws regulate cybersecurity risk-management and incident response capabilities of entities operating in a number of sectors. Non-compliance with NIS2 may lead to administrative fines of a maximum of €10 million or up to 2% of the total worldwide revenue of the preceding fiscal year. Similarly, the California Consumer Privacy Act (“CCPA”) requires covered companies to, among other things, provide certain disclosures to California consumers and affords such consumers rights to opt-out of certain sales of personal information. The CCPA also creates a private right of action for statutory damages for certain breaches of information. Additionally, the California Privacy Rights Act (“CPRA”), was approved by voters in the November 3, 2020 election. The CPRA modified the CCPA significantly, creating obligations relating to consumer data beginning on January 1, 2022, with enforcement authorized as of July 1, 2023. In addition, other states have enacted or proposed legislation that regulates the collection, use, and sale of personal information, including, for example, Washington's My Health, My Data Act and legislation similar to the CCPA adopted in Virginia, Colorado, Utah, Connecticut, Iowa, Indiana, Montana, Tennessee, Oregon, Florida, Delaware, Texas, Kentucky, New Jersey, New Hampshire, Maryland, Minnesota, Nebraska, and Rhode Island. Aspects of the CCPA, CPRA, and these other new and evolving state laws, as well their interpretation and enforcement, remain uncertain. The GDPR, CCPA, and other laws and regulations relating to privacy, data protection, and cybersecurity may be subject to new or changing interpretations by courts, and our interpretation of the law and efforts to comply with the rules and regulations of the law may be ruled invalid. We cannot predict the impact of the CCPA, CPRA, or other evolving privacy, data protection and cybersecurity obligations on our business or operations, but they may require us to modify our data processing practices and policies and incur substantial costs and expenses in an effort to comply.

The privacy, data protection, and cybersecurity laws and regulations we must comply with also are subject to change. For example, the United Kingdom has enacted a Data Protection Act, and has implemented legislation referred to as the “UK GDPR,” which substantially implement the GDPR in the United KingdomKingdom. followingThis legislation, which was modified in the UnitedData Kingdom’s(Use exitand fromAccess) theBill, Europeanwhich Union.received ThisRoyal legislationAssent on June 19, 2025, provides for substantial penalties for noncompliance of up to the greater of £17.5 million or four percent of the previous year’s annual revenues. While the European Union has deemed the United Kingdom an “"adequate country”" to which personal data could be exported from the European Economic Area (“EEA”), this decision is requiredsubject to be renewed after four years of being in effectrenewal and may be modified, revoked, or challenged in the interim,challenged, creating uncertainty regarding transfers of personal data to the United Kingdom from the EEA. It remains unclear how United Kingdom data protection laws or regulations will develop in the medium to longer term and how data transfers to and from the United Kingdom will be regulated. Additionally, we have self-certified under the EU-U.S. Data Privacy Framework, the Swiss-U.S. Data Privacy Framework, and the United Kingdom extension to the EU-U.S. Data Privacy Framework, and have adopted certain standard contractual clauses approved by the European Commission (“SCCs”) as part of our data processing agreements with regard to certain transfers of personal data from the EEA to the U.S. Both the EU-U.S. Data Privacy Framework and SCCs have, however, been subject to legal challenge. In its July 16, 2020 opinion, the CJEU imposed additional obligations on companies when relying on SCCs to transfer personal data. The European Commission has published revised SCCs addressing the CJEU concerns on June 4, 2021, that are required to be implemented. The United Kingdom has adopted new standard contractual clauses (“UK SCCs”), that became effective as of March 21, 2022, and which also are required to be implemented. The EU-U.S. Data Privacy Framework, Swiss-U.S. Data Privacy Framework, United Kingdom extension to the EU-U.S. Data Privacy Framework, revised SCCs and UK SCCs, guidance and opinions of regulators, and other developments relating to cross-border data transfer may require us to implement additional contractual and technical safeguards for any personal data transferred out of Europe, which may increase compliance costs, lead to increased regulatory scrutiny or liability, and which may adversely impact our business, financial condition and operating results. We may be unsuccessful in maintaining legitimate means for our transfer and receipt of personal data from the EEA, United Kingdom, Switzerland, or other jurisdictions. We may experience reluctance or refusal by current or prospective customers in these or other jurisdictions to use our products, and we and our customers may face a risk of regulatory enforcement actions or other proceedings relating to personal data transfers to us and by us from the EEA, United Kingdom, and Switzerland. Any such proceedings could result in substantial costs and diversion of resources, distract management and technical personnel and negatively affect our business, operating results and financial condition. Some countries also are considering or have passed legislation requiring local storage and processing of data, or similar requirements, which could increase the cost and complexity of delivering our services. Further, the European Union’s Data Act (the “Data Act”) became applicable on September 12, 2025. Compliance with the Data Act may require us to adjust contract terms with customers and develop technical measures for data portability. These changes may impact the duration of customer relationships and result in additional compliance and operational costs, which may affect our business.

In addition to laws and regulations, privacy advocacy and industry groups or other private parties may propose new and different standards relating to privacy, data protection, and cybersecurity that apply, or are alleged to apply, to us. Because theThe interpretation and application of privacy and data protection laws, regulations, standards and contractual obligations relating to these matters are uncertain, and it is possible that they may be interpreted and applied in a manner that is, or perceived to be, inconsistent with our data management practices or the features of our solutions. If so, in addition to the possibility of regulatory investigations and enforcement actions or other proceedings, fines, lawsuits and other claims, other forms of injunctive or operations-limiting relief, and damage to our reputations and loss of goodwill, we could be required to fundamentally change our business activities and practices or modify our solutions and may face limitations in our ability to develop new solutions and features, any of which could have an adverse effect on our business. Any inability to adequately address concerns relating to privacy, data protection, or cybersecurity, even if unfounded, or any actual or perceived inability to comply with applicable privacylaws, regulations, standards, or dataother protection laws, regulations and privacy standardsobligations relating to these matters, could result in cost and liability to us, damage our reputation, inhibit sales of subscriptions and harm our business.

Furthermore, the costs of compliance with, and other burdens imposed by, the laws, regulations, and privacystandards standardsrelating to privacy, data protection, or cybersecurity that are applicable to the businesses of our customers may limit the use and adoption of, and reduce the overall demand for, our solutions. Privacy and data protection concerns, whether valid or not valid, may inhibit market adoption of our solutions particularly in certain industries and foreign countries.

Taxing jurisdictions, including state and local entities, have differing rules and regulations governing sales and use or other taxes, and these rules and regulations are subject to varying interpretations that may change over time. In particular, the applicability of sales taxes to our subscription services in various jurisdictions is unclear. It is possible that we could face sales tax audits and that our liability for these taxes could exceed our estimates as tax authorities could still assert that we are obligated to collect additional amounts as taxes from our customers and remit those taxes to those authorities. Furthermore, certain jurisdictions, such as the U.K. and France, have enacted a digital services tax, which is generally a tax on gross revenue generated from users or customers located in those jurisdictions, and other jurisdictions are considering enacting similar laws. We could also be subject to audits with respect to state and international jurisdictions for which we may not have accrued tax liabilities. A successful assertion that we should be collecting additional sales or other taxes on our services in jurisdictions where we have not historically done so and do not accrue for sales taxes could result in substantial tax liabilities for past sales, discourage customers from purchasing our solutions or otherwise harm our business and operating results.

Additionally, significant judgment is required in evaluating our tax positions and our worldwide tax provisions. During the ordinary course of business, there are many activities and transactions for which the ultimate tax determination is uncertain. In addition, our tax obligations and effective tax rates could be adversely affected by changes in the relevant tax, accounting and other laws, regulations, principles and interpretations, including those relating to income tax nexus, by recognizing tax losses or lower than anticipated earnings in jurisdictions where we have lower statutory rates and higher than anticipated earnings in jurisdictions where we have higher statutory rates, by changes in foreign currency exchange rates, or by changes in the valuation of our deferred tax assets and liabilities. The Tax Cuts and Jobs Act of 2017 (or "“TCJA"”) introduced a Base Erosion and Anti-Abuse Tax which imposes a minimum tax on adjusted income of corporations with average applicable gross receipt of at least $500 million for prior three tax years and that make certain payments to related foreign persons. While these rules do not impact our results of operations in the current year, they could impact our financial results in future periods. The TCJA introduced provisions to reduce the deduction rates for foreign income in the US beginning 2026 that may increase our effective income tax rate in the future. The Organization for Economic Cooperation and Development (OECD) has issued model rules in connection with the Base Erosion and Profit Shifting integrated framework that determine multi-jurisdictional taxing rights (Pillar One) and the minimum rate of tax applicable to certain types of income (Pillar Two). Many countries have enacted legislation to apply the Pillar Two directive for tax years beginning in January 2024, which generally provides for a minimum effective tax rate of 15% on the income arising in eachcertain jurisdictionjurisdictions where the Company operates. TheseHowever, ruleson doJanuary not5, impact our current year’s financial results as2026, the CompanyOECD isannounced belowa the“side-by-side” revenueelective threshold.safe Ifharbor applicablethat inexempts theU.S. future,multinational theseentities rulesfrom couldcertain haveprovisions anof impactPillar Two for fiscal years beginning on ouror financialafter results,January the1, extent of which is currently uncertain.2026. We may be audited in various jurisdictions, and such jurisdictions may assess additional taxes, including sales taxes and value-added taxes against us. Although we believe our tax estimates are reasonable, the final determination of any tax audits or litigation could be materially different from our historical tax provisions and accruals, which could have a material adverse effect on our operating results or cash flows in the period or periods for which a determination is made.

On February 12, 2018, we announced that our board of directors had authorized a $100.0 million repurchase program. On each of October 30, 2018, October 30, 2019, May 7, 2020, February 10, 2021 and February 9, 2023, we announced that our board of directors had authorized an increase of $100.0 million, and on each of November 3, 2021, May 4, 2022 and2022, February 7, 2024, and February 6, 2025, we announced that our board of directors had authorized an increase of $200.0 million to the share repurchase program. On February 6,5, 20252026 we announced that our board of directors had authorized an increase of $200.0 million to the share repurchase program, resulting in an aggregate authorization of $1.4$1.6 billion to date ($1.2$1.4 billion as of December 31, 20242025). Although our board of directors authorized the share repurchase program, we are not obligated to repurchase any specific dollar amount or to acquire any specific number of shares. The share repurchase program could affect the price of our common stock, increase volatility and diminish our cash reserves. In addition, it may be suspended or terminated at any time, which may result in a decrease in the price of our common stock. Finally, our net share repurchases in 2023 and 2024 wereare subject to the 1% excise tax introduced in the Inflation Reduction Act.Act, Thewhich amountcould increase the cost to us of share repurchases subject to the excise tax are reduced by the fair market value of any shares issued during the taxable year. This provision does not currently have a material impact to our results of operations.repurchases. During the year ended December 31, 2024,2025, we repurchased 1.01.4 million shares of our common stock for approximately $140.3$182.9 million. As of December 31, 2024,2025, approximately $143.4$160.5 million remained available for share repurchases pursuant to our share repurchase program (excluding the $200.0 million increase to our share repurchase program announced on February 6,5, 20252026).

Our internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements in accordance with U.S. GAAP. Our current controls and any new controls that we develop may become inadequate because of changes in conditions in our business. Any failure to maintain effective controls, or any difficulties encountered in their improvement, could harm our operating results or cause us to fail to meet our reporting obligations. Any failure to maintain effective internal control over financial reporting also could adversely affect the results of periodic management evaluations regarding the effectiveness of our internal control over financial reporting that we are required to include in our periodic reports we file with the SEC under Section 404 of the Sarbanes-Oxley Act. While we arewere able to assert in our Annual Report on Form 10-K that our internal control over financial reporting was effective as of December 31, 2024,2025, we cannot predict the outcome of our testing in future periods. If we are unable to assert in any future reporting period that our internal control over financial reporting is effective (or if our independent registered public accounting firm is unable to express an opinion on the effectiveness of our internal controls), investors may lose confidence in our operating results and our stock price could decline. In addition, if we are unable to continue to meet these requirements, we may not be able to remain listed on the NASDAQ Stock Market.

We are a leading provider of a cloud-based platform delivering information technology (IT), security and compliance solutions that enable organizations to identify security risks to their IT infrastructures, help protect their IT systems and applications from ever-evolving cyber-attacks and achieve compliance with internal policies and external regulations. Our cloud platform addresses the growing security and compliance complexities and risks that are amplified by the dissolving boundaries between IT infrastructures and web environments, the rapid adoption of cloud computing, containers and serverless IT models, and the proliferation of geographically dispersed IT assets. Our integrated suite of IT, security and compliance solutions delivered on Qualys' Enterprise TruRisk Platform enables our customers to identify and manage their IT and operational technology (OT) assets, collect and analyze large amounts of IT security data, discover and prioritize vulnerabilities, quantify cyber risk exposure, recommend and implement remediation actions and verify the implementation of such actions. Organizations use our integrated suite of solutions to cost-effectively obtain a unified view of their internal and external IT and OT asset inventory as well as security and compliance posture across globally-distributed IT infrastructures as our solution offers a single platform for information technology,IT, information security, application security, endpoint, developer security and cloud teams.

The uncertainty surrounding macroeconomic factors in the U.S. and globally characterized by inflationary pressure, high interest rates, significant volatility of global markets, reduced spending and extended sales cycles, tariff and non-tariff trade barriers, economic and regulatory uncertainty, and geopolitical conflicts could have a material adverse effect on our long-term business and could lead to further economic disruption and expose us to greater risk as our current and potential customers may reduce or eliminate their overall spending on IT security. We will continue to evaluate the nature and extent of the impact to our business, financial position, results of operations and cash flows.

Cost of revenues increased by $4.0$3.3 million in 20242025 compared to 2023,2024, primarily due to an increase in sharedpersonnel cloud platform costcosts of $6.0 million, an increase in personnel costs, including stock-based compensation, of $4.6$4.7 million, driven by additional employees hired to support the growth of our business,business and an increase in incentive compensation, an increase in license expenses and professional service expenses of $1.2$1.9 million, partially offset by a decrease in depreciation and amortization expense of $7.8$3.3 million resulting from certain of our assets becoming fully depreciated or amortized.

Research and development expenses increased by $1.4$5.4 million in 20242025 compared to 2023,2024, primarily due to an increase in personnel costs, including stock-based compensation,costs of $2.8$4.4 million, driven by increasedadditional headcount,employees hired to support the growth of our business and an increase in incentive compensation, an increase in overhead allocations of $1.8 million, and an increase in shared cloud platform costs of $1.0 million, partially offset by a decrease in depreciationstock-based compensation of $1.1 million driven by lower average grant-date fair value and amortizationgeographic expense in property and equipment of $0.8 million,mix, and a decrease in overheadprofessional allocationservice expense of $0.6$0.7 million.

Sales and marketing expenses increased by $16.6$15.2 million in 20242025 compared to 2023,2024, primarily due to an increase in personnel costs, including stock-based compensation,costs of $12.9$8.8 million, driven by increased headcount, an increase in travelheadcount and entertainmenthigher costsales ofcommissions $1.8and million,incentive compensation, an increase in marketing expenses of $4.2 million, primarily related to tradedigital showsadvertising, ofsales $0.7event million,and sponsorship, an increase in overheadtravel allocationexpenses of $0.7$1.5 million, and an increase in subscribedoverhead license and software costsallocations of $0.5$0.7 million.

General and administrative expenses increased by $7.0$2.9 million in 20242025 compared to 2023,2024, primarily due to an increase in personnel costs, including stock-based compensation, of $6.3$4.1 million, driven by increasedan headcount,increase annualin merit increasesheadcount and refreshhigher grantsincentive compensation due to eligiblehigher employeesachievement andrates executives,compared to 2024, and an increase in subscribed software costs and otherlicense expenses of $0.7$0.9 million, partially offset by an increase in overhead allocations to other expense categories of $2.1 million.

Income tax provision increased by $9.1$12.4 million in 20242025 compared to 2023,2024, primarily due to the tax effect of ana increasedecrease in pretaxthe income,benefit increasefrom inFDII foreigndeduction withholdingas taxes,a result of the enactment of the OBBBA, along with a decrease in excess tax benefitbenefits from stock-based compensation comparedand to prior year, anda decrease in tax benefits from other discrete taxadjustments adjustments.compared The increase in tax expense was partially offset by an increase in foreign derived intangible income benefit, an increase in research and development tax credits, andto the recognitionprior of an income tax benefit related to uncertain tax positions due to statute lapse.year.

Our net dollar expansion ratesrate werewas 103% andfor 105% forboth the years ended December 31, 20242025 and 2023, respectively.2024.

The following unaudited table presents the reconciliation of net income to Adjusted EBITDA for the years ended December 31, 20242025 and 2023.2024:

As of December 31, 2024,2025, our principal source of liquidity was cash, cash equivalents and marketable securities of $575.3$696.8 million, including $119.9$155.3 million of cash held outside of the United States. The following summary of cash flows for the periods indicated havehas been derived from our consolidated financial statements included elsewhere in this report:

In 2024,2025, we used $100.9 million of cash for purchases of marketable securities net of sales and maturities, and used $5.0 million of cash in capital expenditures mainly related to computer equipment to support our growth and development and leasehold improvement for expansion of our office spaces, as compared to the use of $59.1 million of cash for purchases of marketable securities net of sales and maturities, and usedthe use of $12.3 million of cash in capital expenditures mainly related to computer equipment to support our growth and development and leasehold improvement for expansion of our office spaces and shared cloud platform facilities, as compared to the use of $64.4 million of cash for purchases of marketable securities net of sales and maturities, and the use of $8.8 million of cashfacilities in capital expenditures mainly related to computer equipment to support our growth and development in 2023.2024.

In 2024,2025, we used $183.4 million of cash for share repurchases and $25.0 million of cash in payment of employee withholding taxes upon vesting of restricted stock units, partially offset by $16.3 million of proceeds from employee exercise of stock options and $6.8 million of proceeds from issuance of common stock through our employee stock purchase plan (ESPP), as compared to $139.9 million of cash for share repurchasesrepurchase and $28.4 million of cash in payment of employee withholding taxes upon vesting of restricted stock units and $1.5 million payment of cash held in escrow as part of the Blue Hexagon acquisition on October 4, 2022, partially offset by $17.3 million of proceeds from employee exercise of stock options and $6.9 million of proceeds from issuance of common stock through our employee stock purchase plan ("ESPP"), as compared to $170.8 million of cash for share repurchase and $22.3 million of cash in payment of employee withholding taxes upon vesting of restricted stock units, partially offset by $45.6 million of proceeds from employee exercise of stock options and $6.1 million of proceeds from issuance of common stock through our ESPP in 2023.2024.

We recognize the fair value of our employee stock options and restricted stock units,units (RSU), including performance-based restricted stock units,units (PRSU), over the requisite service period. The fair value of each stock option is estimated on date of grant using the Black-Scholes-Merton option pricing model. Determining the appropriate fair value model and calculating the fair value of employee stock options requires the use of subjective assumptions, including the expected life of the stock option and stock price volatility. The recognition of expenses for performance based restricted stock units requires us to estimate the probability that the performance condition will be achieved and the number of awards that will vest are adjusted accordingly at each reporting period. The assumptions used in calculating the fair value of employee stock options and estimating the probability of achievement of performance metrics represent management’s best estimates, which require significant judgment and involve inherent uncertainties. If factors change and we use different assumptions, our stock-based compensation expense could be materially different in the future.

Our success depends to a significant extent on establishing and maintaining relationships with a variety of channel partners and we anticipate that we will continue to depend on these partners in order to grow our business. For the threesix months ended MarchJune 31,30, 2026, we derived approximately 52%53% of our revenues from sales of subscriptions for our solutions through channel partners, and the percentage of revenues derived from channel partners may increase in future periods. Our agreements with our channel partners are generally non-exclusive and do not prohibit them from working with our competitors or offering competing solutions, and many of our channel partners have more established relationships with our competitors. If our channel partners choose to place greater emphasis on products of their own or those offered by our competitors, do not effectively market and sell our solutions, or fail to meet the needs of our customers, then our ability to grow our business and sell our solutions may be adversely affected. In addition, the loss of one or more of our larger channel partners, who may cease marketing our solutions with limited or no notice, and our possible inability to replace them, could adversely affect our sales. Moreover, our ability to expand our distribution channels depends in part on our ability to educate our channel partners about our solutions, which can be complex. Our failure to effectively manage our relationship with channel partners, or any reduction or delay in their sales of our solutions or conflicts between channel sales and our direct sales and marketing activities may harm our results of operations. Even if we are successful, these relationships may not result in greater customer usage of our solutions or increased revenues.

In addition, as of MarchJune 31,30, 2026, approximately 79% of our employees were located outside of the United States, with 71% of our employees located in India. Accordingly, we are exposed to changes in laws governing our employee relationships in various U.S. and foreign jurisdictions, including laws and regulations regarding wage and hour requirements, fair labor standards, employee data privacy, unemployment tax rates, workers’ compensation rates, citizenship requirements and payroll and other taxes which may have a direct impact on our operating costs. We may continue to expand our international operations and international sales and marketing activities. Expansion in international markets has required, and will continue to require, significant management attention and resources. We may be unable to scale our infrastructure effectively or as quickly as our competitors in these markets and our revenues may not increase to offset any increased costs and operating expenses, which would cause our results to suffer.

Our reporting currency is the U.S. dollar and we generate a majority of our revenues in U.S. dollars. However, for the threesix months ended MarchJune 31,30, 2026, we incurred approximately 27%29% of our expenses in foreign currencies, primarily the Euro, British Pound, and Indian Rupee, principally with respect to salaries and related personnel expenses associated with our European and Indian operations. Additionally, for the threesix months ended MarchJune 31,30, 2026, approximately 26% of our revenues were generated in foreign currencies. Accordingly, changes in exchange rates may have a material adverse effect on our business, operating results and financial condition. The exchange rate between the U.S. dollar and foreign currencies has fluctuated substantially in recent years and may continue to fluctuate substantially in the future. We expect that a majority of our revenues will continue to be generated in U.S. dollars for the foreseeable future and that a significant portion of our expenses, including personnel costs, as well as capital and operating expenditures, will continue to be denominated in the Euro, British Pound and Indian Rupee. The result of our operations may be adversely affected by foreign exchange fluctuations.

We have continued to grow over the last several years, with revenues increasing from $554.5 million in 2023 to $669.1 million in 2025, and headcount increasing from 2,143 employees at the beginning of 2023 to 2,6832,718 employees as of MarchJune 31,30, 2026. We rely on information technology systems to help manage critical functions such as order processing, revenue recognition and financial forecasts. To manage any future growth effectively we must continue to improve and expand our IT systems, financial infrastructure, and operating and administrative systems and controls, and continue to manage headcount, capital and processes in an efficient manner. We may not be able to successfully implement improvements to these systems and processes in a timely or efficient manner.

The market price of shares of our common stock could decline as a result of substantial sales of our common stock, particularly sales by our directors, executive officers, employees and significant stockholders, a large number of shares of our common stock becoming available for sale, or the perception in the market that holders of a large number of shares intend to sell their shares. As of MarchJune 31,30, 2026, we had approximately 35.434.7 million shares of our common stock outstanding.

In addition, as of MarchJune 31,30, 2026, there were approximately 1.2 million options and 1.11.0 million restricted stock units outstanding. If such options are exercised and restricted stock units are released, these additional shares will become available for sale. As of MarchJune 31,30, 2026, we had an aggregate of 1.52.5 million shares of our common stock reserved for future issuance under our Restated 2012 Equity Incentive Plan and 0.3 million shares reserved for future purchase under our 2021 Employee Stock Purchase Plan, which can be freely sold in the public market upon issuance. If a large number of these shares are sold in the public market, the sales could reduce the trading price of our common stock.

On February 12, 2018, we announced that our board of directors had authorized a $100.0 million repurchase program. On each of October 30, 2018, October 30, 2019, May 7, 2020, February 10, 2021 and February 9, 2023, we announced that our board of directors had authorized an increase of $100.0 million, and on each of November 3, 2021, May 4, 2022, February 7, 2024, and February 6, 2025, we announced that our board of directors had authorized an increase of $200.0 million to the share repurchase program. Onand February 5, 20262026, we announced that our board of directors had authorized an increase of $200.0 million to the share repurchase program, resulting in an aggregate authorization of $1.6 billion as of MarchJune 31,30, 2026. Although our board of directors authorized the share repurchase program, we are not obligated to repurchase any specific dollar amount or to acquire any specific number of shares. The share repurchase program could affect the price of our common stock, increase volatility and diminish our cash reserves. In addition, it may be suspended or terminated at any time, which may result in a decrease in the price of our common stock. Finally, our net share repurchases are subject to the 1% excise tax introduced in the Inflation Reduction Act, which could increase the cost to us of share repurchases. During the threesix months ended MarchJune 31,30, 2026, we repurchased 0.51.3 million shares of our common stock for approximately $53.9$130.7 million. As of MarchJune 31,30, 2026, approximately $306.6$229.8 million remained available for share repurchases pursuant to our share repurchase program.

We market and sell our solutions to enterprises, government entities and small and medium-sized businesses across a broad range of industries, including education, financial services, government, healthcare, insurance, manufacturing, media, retail, technology and utilities. For the threesix months ended MarchJune 31,30, 2026 and 2025, approximately 55% and 57%, respectively, of our revenues were derived from customers in the United States based on our customers' billing addresses. We sell our solutions to enterprises and government entities primarily through our field sales force and to small and medium-sized businesses through our inside sales force. We generate a significant portion of sales through our channel partners, including managed security service providers, leading cloud providers, value-added resellers and consulting firms in the United States and internationally.

Research and development expenses consist primarily of personnel expenses, comprised of salaries, benefits, performance-based compensation and stock-based compensation, for our research and development teams. Other expenses include third-party contractor fees, software and license fees, amortization of intangibles related to acquisitions and overhead allocations. We expect to continue to devote resources to research and development in an effort to continuously improve our existing solutions as well as develop new solutions and capabilities, which in turn, is expected to increase the research and development expenses in absolute dollars.

We are subject to federal, state and foreign income taxes for jurisdictions in which we operate, and we use estimates in determining our income tax provision and deferred tax assets. Earnings from our non-U.S. activities are subject to income taxes in the local countries at rates which are generally similar to the U.S. statutory tax rate. We regularly assess the realizability of our net deferred tax assets. As of MarchJune 31,30, 2026, valuation allowances remain in certain jurisdictions where we believe it is necessary to see positive evidence, such as sustained achievement of sufficient profits, to meet a more likely than not stance that the valuation allowance should be reversed. The exact timing and amount of the valuation allowance release is subject to change based on the level of profitability achieved in future periods. Release of the valuation allowance would result in the recognition of deferred tax assets and a corresponding decrease to income tax expense in the period the release is recorded.

On July 4, 2025, OBBBA was signed into law. Beginning in 2026, the OBBBA changes to FDDEI Deduction and NCTI become effective. We have recognized the effects of these OBBBA provisions in our financial results for the threesix months ended MarchJune 31,30, 2026. These changes generally resulted in a decrease to our income tax provision for the period. We will continue to monitor the impact of the OBBBA and the range of potential outcomes, which will depend on facts in each year and anticipated guidance from the U.S. Department of the Treasury.

Comparison of Three and Six Months Ended MarchJune 31,30, 2026 and 2025

Revenues increased by $15.7$18.1 million for the three months ended MarchJune 31,30, 2026 compared to the same period in 2025, driven by increased demand for our subscription services by our end customers. Of the total increase of $15.7$18.1 million in revenues, 96%97% was from revenues from customers existing prior to JanuaryApril 1, 2026, and the remaining 4%3% was from new customers added in the three months ended MarchJune 31,30, 2026. Of the total increase of $15.7$18.1 million, 35%41% was from customers in the United States and the remaining 65%59% was from customers in foreign countries. Of the total increase of $15.7$18.1 million, 14%2% was from direct customers and the remaining 86%98% was from partners. In the three months ended MarchJune 31,30, 2026, 48%46% of total revenue was direct and the remaining 52%54% was from partners.

Cost of revenues increased by $1.1$1.4 million for the three months ended MarchJune 31,30, 2026 compared to the same period in 2025, primarily due to an increase in personnel costs of $0.9 million, driven by additional employees hired to support the growth of our business, an impairment of our property and equipment of $0.6 million, an increase in shared cloud platform costcosts of $0.2$0.4 million, and an increase of $0.6 million primarily attributable to overhead allocations and other costs. The increase was partially offset by a decrease in depreciation and amortization expense of $0.6$0.5 million resulting from certain of our assets that became fully depreciated or amortized.

Research and development expenses remainedincreased relativelyby flat$0.4 million for the three months ended MarchJune 31,30, 2026 compared to the same period in 2025, primarily due to an increase in overhead allocations of $1.0 million, partially offset by a decrease in shared cloud platform cost of $0.3 million, and lower average personnel costs, including stock-based compensation, driven by lower average grant-date fair value and geographic mix of the increased headcount to support product development, resulting in cost savings of $0.6 million, partially offset by an increase in overhead allocations of $0.5$0.3 million.

Sales and marketing expenses increased by $6.1$5.2 million for the three months ended MarchJune 31,30, 2026 compared to the same period in 2025, primarily due to an increase in personnel costs, including stock-based compensation, of $5.8$4.6 million, driven by an increase in headcount and higher sales commissions and incentive compensation, anand the remaining increase in sales event and sponsorship of $0.5 million, an increase in travel expenses of $0.5 million, and an increase in overhead allocations of $0.6 million,million partially offset by a decrease in marketing expenses of $1.3 million,was primarily relatedattributable to digitaloverhead advertising.allocations, travel expenses, and sales events and sponsorships.

Total other income, net decreased by $2.4$2.2 million for the three months ended MarchJune 31,30, 2026, compared to the same periods in 2025, primarily due to an impairment to our non-marketable security of $2.0 million, and unfavorable changes in foreign currency of $0.4$2.1 million, and a decrease in interest income of $0.1 million.

Income tax provision increased by $3.6$3.1 million for the three months ended MarchJune 31,30, 2026 compared to the same period in 2025, primarily dueattributable to anhigher increasepretax in non-deductible stock-based compensation,income, a decrease in benefitthe from thefederal R&D credit, and ana increase inhigher tax expense arising from discrete adjustments in the period, primarily related to share-based compensation. These increases were partially offset by ana increase in thehigher tax benefit from FDDEI rulesprovisions that became effective in 2026 under OBBBA.

Our net dollar expansion rates were 104%105% and 103%104% as of MarchJune 31,30, 2026 and MarchJune 31,30, 2025, respectively.

Because of these limitations, Adjusted EBITDA should be considered alongside other financial performance measures, including revenues, net income, cash flows from operating activities and our financial results presented in accordance with U.S. GAAP. The following unaudited table presents the reconciliation of net income to Adjusted EBITDA for the three and six months ended MarchJune 31,30, 2026 and 2025:

As of MarchJune 31,30, 2026, our principal source of liquidity was cash, cash equivalents and marketable securities of $729.3$703.5 million, including $190.8$182.6 million of cash held outside of the United States. The following summary of cash flows for the periods indicated has been derived from our condensed consolidated financial statements included elsewhere in this report:

During the threesix months ended MarchJune 31,30, 2026, we generated $77.1$153.6 million of cash from our net income, as adjusted for non-cash items mainly related to stock-based compensation expense, depreciation and amortization expense, impairment of non-marketable securities, and deferred taxes, as compared to $65.3$130.1 million during the threesix months ended MarchJune 31,30, 2025. In addition, we also generated $18.2$1.3 million of cash from changes in working capital during the threesix months ended MarchJune 31,30, 2026, of which $27.8$15.8 million was related to a net favorable change in accounts receivable and deferred revenue due to the timing of billings and collections, partially offset by an $9.6$14.5 million net unfavorable change in prepaid expenses and payables and accrued liabilities primarily due to the timing of payments. During the threesix months ended MarchJune 31,30, 2025, we generated $44.3$13.3 million of cash from changes in working capital, of which $36.0$13.5 million was attributedrelated to athe net favorable change in accounts receivable and deferred revenue due to the timing of collections and billings, and a $8.3$4.4 million net favorable change in payables and accrued liabilities primarily driven by the timing of payments, partially offset by a $4.6 million unfavorable change in prepaid expenses primarily driven by the timing of payments.

During the threesix months ended MarchJune 31,30, 2026, we used $4.7$9.0 million of cash for purchases of marketable securities net of sales and maturities, and used $1.7$5.4 million of cash in capital expenditures mainly related to purchases of computer equipment to support our growth and development, as compared to $5.0$82.8 million of cash for purchases of marketable securities net of sales and maturities, and $2.0$3.4 million of cash used in capital expenditures mainly related to purchases of computer equipment to support our growth and development and leasehold improvements for expansion of our office spaces during the threesix months ended MarchJune 31,30, 2025.

During the threesix months ended MarchJune 31,30, 2026, we used $53.5$131.4 million of cash for share repurchases, $10.4$13.9 million of cash in payment of employee withholding taxes upon vesting of restricted stock units, partially offset by $3.9 million of proceeds from issuance of common stock through our ESPP, and $0.3$0.9 million of proceeds from employee exercise of stock options, as compared to $39.7$89.5 million of cash used for share repurchases, and $10.8$15.3 million of cash used in payment of employee withholding taxes upon vesting of restricted stock units, partially offset by $5.6 million of proceeds from employee exercise of stock options, and $3.8 million of proceeds from issuance of common stock through our ESPP, and $2.6 million of proceeds from employee exercise of stock options during the threesix months ended MarchJune 31,30, 2025.

Our material cash requirements include our operating lease obligations to make payments under our non-cancelable lease agreements for our facilities and shared cloud platforms. We had fixed operating lease payment obligations of $69.2$65.6 million as of MarchJune 31,30, 2026, with $13.8$12.4 million expected to be paid within the next 12 months.

As of MarchJune 31,30, 2026, other than the changes described above in this section entitled “Liquidity and Capital Resources” in this Quarterly Report on Form 10-Q, there have been no other material changes to our cash requirements for purchase commitments as described in “Part II, Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations” of our Annual Report on Form 10-K for the fiscal year ended December 31, 2025.

We expect to continue to use cash to repurchase shares in 2026 under our share repurchase program authorized by our board of directors on February 5, 2018. On February 5, 2026, we announced that our board of directors authorized an additional $200.0 million to the share repurchase program authorization, increasing the total amount of authorized repurchase to $1.6 billion. As of MarchJune 31,30, 2026, approximately $306.6$229.8 million remained available under our share repurchase program. Shares will be repurchased from time to time in privately negotiated transactions or on the open market in accordance with Rule 10b-18 of the Exchange Act of 1934, including pursuant to a pre-set trading plan adopted in accordance with Rule 10b5-1 under the Exchange Act.