QUALYS, INC.

Previous wording

Our success significantly depends to a significant extent on establishing and maintaining relationships with a variety of channel partners and we anticipate that we will continue to depend on these partners in order to grow our business. For the six months ended June 30, 2025, we derived approximately 49% of our revenues from sales of subscriptions for our solutions through channel partners, and the percentage of revenues derived from channel partners may increase in future periods. Our agreements with our channel partners are generally non-exclusive and do not prohibit them from working with our competitors or offering competing solutions, and many of our channel partners have more established relationships with our competitors. If our channel partners choose to place greater emphasis on products of their own or those offered by our competitors, do not effectively market and sell our solutions, or fail to meet the needs of our customers, then our ability to grow our business and sell our solutions may be adversely affected. In addition, the loss of one or more of our larger channel partners, who may cease marketing our solutions with limited or no notice, and our possible inability to replace them, could adversely affect our sales. Moreover, our ability to expand our distribution channels depends in part on our ability to educate our channel partners about our solutions, which can be complex. Our failure to effectively manage our relationship with channel partners, or any reduction or delay in their sales of our solutions or conflicts between channel sales and our direct sales and marketing activities may harm our results of operations. Even if we are successful, these relationships may not result in greater customer usage of our solutions or increased revenues.

Current wording

Our success significantly depends to a significant extent on establishing and maintaining relationships with a variety of channel partners and we anticipate that we will continue to depend on these partners in order to grow our business. For the nine months ended September 30, 2025, we derived approximately 49% of our revenues from sales of subscriptions for our solutions through channel partners, and the percentage of revenues derived from channel partners may increase in future periods. Our agreements with our channel partners are generally non-exclusive and do not prohibit them from working with our competitors or offering competing solutions, and many of our channel partners have more established relationships with our competitors. If our channel partners choose to place greater emphasis on products of their own or those offered by our competitors, do not effectively market and sell our solutions, or fail to meet the needs of our customers, then our ability to grow our business and sell our solutions may be adversely affected. In addition, the loss of one or more of our larger channel partners, who may cease marketing our solutions with limited or no notice, and our possible inability to replace them, could adversely affect our sales. Moreover, our ability to expand our distribution channels depends in part on our ability to educate our channel partners about our solutions, which can be complex. Our failure to effectively manage our relationship with channel partners, or any reduction or delay in their sales of our solutions or conflicts between channel sales and our direct sales and marketing activities may harm our results of operations. Even if we are successful, these relationships may not result in greater customer usage of our solutions or increased revenues.

Previous wording

In addition, as of June 30, 2025, approximately 78% of our employees were located outside of the United States, with 69% of our employees located in India. Accordingly, we are exposed to changes in laws governing our employee relationships in various U.S. and foreign jurisdictions, including laws and regulations regarding wage and hour requirements, fair labor standards, employee data privacy, unemployment tax rates, workers’ compensation rates, citizenship requirements and payroll and other taxes which may have a direct impact on our operating costs. We may continue to expand our international operations and international sales and marketing activities. Expansion in international markets has required, and will continue to require, significant management attention and resources. We may be unable to scale our infrastructure effectively or as quickly as our competitors in these markets and our revenues may not increase to offset any increased costs and operating expenses, which would cause our results to suffer.

Current wording

In addition, as of September 30, 2025, approximately 78% of our employees were located outside of the United States, with 70% of our employees located in India. Accordingly, we are exposed to changes in laws governing our employee relationships in various U.S. and foreign jurisdictions, including laws and regulations regarding wage and hour requirements, fair labor standards, employee data privacy, unemployment tax rates, workers’ compensation rates, citizenship requirements and payroll and other taxes which may have a direct impact on our operating costs. We may continue to expand our international operations and international sales and marketing activities. Expansion in international markets has required, and will continue to require, significant management attention and resources. We may be unable to scale our infrastructure effectively or as quickly as our competitors in these markets and our revenues may not increase to offset any increased costs and operating expenses, which would cause our results to suffer.

Previous wording

Our reporting currency is the U.S. dollar and we generate a majority of our revenues in U.S. dollars. However, for thesix months ended June 30, 2025, we incurred approximately 27% of our expenses in foreign currencies, primarily the Euro, British Pound, and Indian Rupee, principally with respect to salaries and related personnel expenses associated with our European and Indian operations. Additionally, for the six months ended June 30, 2025, approximately 25% of our revenues were generated in foreign currencies. Accordingly, changes in exchange rates may have a material adverse effect on our business, operating results and financial condition. The exchange rate between the U.S. dollar and foreign currencies has fluctuated substantially in recent years and may continue to fluctuate substantially in the future. We expect that a majority of our revenues will continue to be generated in U.S. dollars for the foreseeable future and that a significant portion of our expenses, including personnel costs, as well as capital and operating expenditures, will continue to be denominated in the Euro, British Pound and Indian Rupee. The result of our operations may be adversely affected by foreign exchange fluctuations.

Current wording

Our reporting currency is the U.S. dollar and we generate a majority of our revenues in U.S. dollars. However, for thenine months ended September 30, 2025, we incurred approximately 29% of our expenses in foreign currencies, primarily the Euro, British Pound, and Indian Rupee, principally with respect to salaries and related personnel expenses associated with our European and Indian operations. Additionally, for the nine months ended September 30, 2025, approximately 25% of our revenues were generated in foreign currencies. Accordingly, changes in exchange rates may have a material adverse effect on our business, operating results and financial condition. The exchange rate between the U.S. dollar and foreign currencies has fluctuated substantially in recent years and may continue to fluctuate substantially in the future. We expect that a majority of our revenues will continue to be generated in U.S. dollars for the foreseeable future and that a significant portion of our expenses, including personnel costs, as well as capital and operating expenditures, will continue to be denominated in the Euro, British Pound and Indian Rupee. The result of our operations may be adversely affected by foreign exchange fluctuations.

Previous wording

We have continued to grow over the last several years, with revenues increasing from $489.7 million in 2022 to $607.6 million in 2024, and headcount increasing from 1,823 employees at the beginning of 2022 to 2,484 employees as of June 30, 2025. We rely on information technology systems to help manage critical functions such as order processing, revenue recognition and financial forecasts. To manage any future growth effectively we must continue to improve and expand our IT systems, financial infrastructure, and operating and administrative systems and controls, and continue to manage headcount, capital and processes in an efficient manner. We may not be able to successfully implement improvements to these systems and processes in a timely or efficient manner.

Current wording

We have continued to grow over the last several years, with revenues increasing from $489.7 million in 2022 to $607.6 million in 2024, and headcount increasing from 1,823 employees at the beginning of 2022 to 2,575 employees as of September 30, 2025. We rely on information technology systems to help manage critical functions such as order processing, revenue recognition and financial forecasts. To manage any future growth effectively we must continue to improve and expand our IT systems, financial infrastructure, and operating and administrative systems and controls, and continue to manage headcount, capital and processes in an efficient manner. We may not be able to successfully implement improvements to these systems and processes in a timely or efficient manner.

Previous wording

The privacy, data protection, and cybersecurity laws and regulations we must comply with also are subject to change. For example, the United Kingdom has enacted a Data Protection Act, and has implemented legislation referred to as the "UK GDPR," which substantially implement the GDPR in the United Kingdom. This legislation provides for substantial penalties for noncompliance of up to the greater of £17.5 million or four percent of the previous year’s annual revenues. While the European Union has deemed the United Kingdom an "adequate country" to which personal data could be exported from the European Economic Area ("EEA"), this decision is required to be renewed in 2025 and may be modified, revoked, or challenged in the interim, creating uncertainty regarding transfers of personal data to the United Kingdom from the EEA, particularly in light of modifications to the Data Protection Act and UK GDPR in the Data (Use and Access) Bill, which received Royal Assent on June 19, 2025, and aims to modernize and streamline the UK's data protection framework. It remains unclear how United Kingdom data protection laws or regulations will develop in the medium to longer term and how data transfers to and from the United Kingdom will be regulated. Additionally, we have self-certified under the EU-U.S. Data Privacy Framework, the Swiss-U.S. Data Privacy Framework, and the United Kingdom extension to the EU-U.S. Data Privacy Framework, and have adopted certain standard contractual clauses approved by the European Commission ("SCCs") as part of our data processing agreements with regard to certain transfers of personal data from the EEA to the U.S. Both the EU-U.S. Data Privacy Framework and SCCs have, however, been subject to legal challenge. In its July 16, 2020 opinion, the CJEU imposed additional obligations on companies when relying on SCCs to transfer personal data. The European Commission has published revised SCCs addressing the CJEU concerns on June 4, 2021, that are required to be implemented. The United Kingdom has adopted new standard contractual clauses ("UK SCCs"), that became effective as of March 21, 2022, and which also are required to be implemented. The EU-U.S. Data Privacy Framework, Swiss-U.S. Data Privacy Framework, United Kingdom extension to the EU-U.S. Data Privacy Framework, revised SCCs and UK SCCs, guidance and opinions of regulators, and other developments relating to cross-border data transfer may require us to implement additional contractual and technical safeguards for any personal data transferred out of Europe, which may increase compliance costs, lead to increased regulatory scrutiny or liability, and which may adversely impact our business, financial condition and operating results. We may be unsuccessful in maintaining legitimate means for our transfer and receipt of personal data from the EEA, United Kingdom, Switzerland, or other jurisdictions. We may experience reluctance or refusal by current or prospective customers in t…

Excerpt shortened here; the source contains the full paragraph.

Current wording

The privacy, data protection, and cybersecurity laws and regulations we must comply with also are subject to change. For example, the United Kingdom has enacted a Data Protection Act, and has implemented legislation referred to as the "UK GDPR," which substantially implement the GDPR in the United Kingdom. This legislation provides for substantial penalties for noncompliance of up to the greater of £17.5 million or four percent of the previous year’s annual revenues. While the European Union has deemed the United Kingdom an "adequate country" to which personal data could be exported from the European Economic Area ("EEA"), this decision is required to be renewed in 2025 and may be modified, revoked, or challenged in the interim, creating uncertainty regarding transfers of personal data to the United Kingdom from the EEA, particularly in light of modifications to the Data Protection Act and UK GDPR in the Data (Use and Access) Bill, which received Royal Assent on June 19, 2025, and aims to modernize and streamline the UK's data protection framework. It remains unclear how United Kingdom data protection laws or regulations will develop in the medium to longer term and how data transfers to and from the United Kingdom will be regulated. Additionally, we have self-certified under the EU-U.S. Data Privacy Framework, the Swiss-U.S. Data Privacy Framework, and the United Kingdom extension to the EU-U.S. Data Privacy Framework, and have adopted certain standard contractual clauses approved by the European Commission ("SCCs") as part of our data processing agreements with regard to certain transfers of personal data from the EEA to the U.S. Both the EU-U.S. Data Privacy Framework and SCCs have, however, been subject to legal challenge. In its July 16, 2020 opinion, the CJEU imposed additional obligations on companies when relying on SCCs to transfer personal data. The European Commission has published revised SCCs addressing the CJEU concerns on June 4, 2021, that are required to be implemented. The United Kingdom has adopted new standard contractual clauses ("UK SCCs"), that became effective as of March 21, 2022, and which also are required to be implemented. The EU-U.S. Data Privacy Framework, Swiss-U.S. Data Privacy Framework, United Kingdom extension to the EU-U.S. Data Privacy Framework, revised SCCs and UK SCCs, guidance and opinions of regulators, and other developments relating to cross-border data transfer may require us to implement additional contractual and technical safeguards for any personal data transferred out of Europe, which may increase compliance costs, lead to increased regulatory scrutiny or liability, and which may adversely impact our business, financial condition and operating results. We may be unsuccessful in maintaining legitimate means for our transfer and receipt of personal data from the EEA, United Kingdom, Switzerland, or other jurisdictions. We may experience reluctance or refusal by current or prospective customers in t…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

Additionally, significant judgment is required in evaluating our tax positions and our worldwide tax provisions. During the ordinary course of business, there are many activities and transactions for which the ultimate tax determination is uncertain. In addition, our tax obligations and effective tax rates could be adversely affected by changes in the relevant tax, accounting and other laws, regulations, principles and interpretations, including those relating to income tax nexus, by recognizing tax losses or lower than anticipated earnings in jurisdictions where we have lower statutory rates and higher than anticipated earnings in jurisdictions where we have higher statutory rates, by changes in foreign currency exchange rates, or by changes in the valuation of our deferred tax assets and liabilities. The Tax Cuts and Jobs Act of 2017 (or "TCJA") introduced a Base Erosion and Anti-Abuse Tax which imposes a minimum tax on adjusted income of corporations with average applicable gross receipt of at least $500 million for prior three tax years and that make certain payments to related foreign persons. While these rules do not impact our results of operations in the current year, they could impact our financial results in future periods. The TCJA introduced provisions to reduce the deduction rates for foreign income in the U.S. beginning 2026 that may increase our effective income tax rate in the future. The Organization for Economic Cooperation and Development has issued model rules in connection with the Base Erosion and Profit Shifting integrated framework that determine multi-jurisdictional taxing rights (Pillar One) and the minimum rate of tax applicable to certain types of income (Pillar Two). Many countries have enacted legislation to apply the Pillar Two directive for tax years beginning in January 2024, which generally provides for a minimum effective tax rate of 15% on the income arising in each jurisdiction where the Company operates. These rules do not impact our current year’s financial results as the Company is below the revenue threshold. If applicable in the future, these rules could have an impact on our financial results, the extent of which is currently uncertain. We may be audited in various jurisdictions, and such jurisdictions may assess additional taxes, including sales taxes and value-added taxes against us. Although we believe our tax estimates are reasonable, the final determination of any tax audits or litigation could be materially different from our historical tax provisions and accruals, which could have a material adverse effect on our operating results or cash flows in the period or periods for which a determination is made.

Current wording

Additionally, significant judgment is required in evaluating our tax positions and our worldwide tax provisions. During the ordinary course of business, there are many activities and transactions for which the ultimate tax determination is uncertain. In addition, our tax obligations and effective tax rates could be adversely affected by changes in the relevant tax, accounting and other laws, regulations, principles and interpretations, including those relating to income tax nexus, by recognizing tax losses or lower than anticipated earnings in jurisdictions where we have lower statutory rates and higher than anticipated earnings in jurisdictions where we have higher statutory rates, by changes in foreign currency exchange rates, or by changes in the valuation of our deferred tax assets and liabilities. The TCJA introduced a Base Erosion and Anti-Abuse Tax which imposes a minimum tax on adjusted income of corporations with average applicable gross receipt of at least $500 million for prior three tax years and that make certain payments to related foreign persons. While these rules do not impact our results of operations in the current year, they could impact our financial results in future periods. The Organization for Economic Cooperation and Development has issued model rules in connection with the Base Erosion and Profit Shifting integrated framework that determine multi-jurisdictional taxing rights (Pillar One) and the minimum rate of tax applicable to certain types of income (Pillar Two). Many countries have enacted legislation to apply the Pillar Two directive for tax years beginning in January 2024, which generally provides for a minimum effective tax rate of 15% on the income arising in each jurisdiction where the Company operates. These rules do not impact our current year’s financial results as the Company is below the revenue threshold. If applicable in the future, these rules could have an impact on our financial results, the extent of which is currently uncertain. We may be audited in various jurisdictions, and such jurisdictions may assess additional taxes, including sales taxes and value-added taxes against us. Although we believe our tax estimates are reasonable, the final determination of any tax audits or litigation could be materially different from our historical tax provisions and accruals, which could have a material adverse effect on our operating results or cash flows in the period or periods for which a determination is made.

Previous wording

The market price of shares of our common stock could decline as a result of substantial sales of our common stock, particularly sales by our directors, executive officers, employees and significant stockholders, a large number of shares of our common stock becoming available for sale, or the perception in the market that holders of a large number of shares intend to sell their shares. As of June 30, 2025, we had approximately 36.1 million shares of our common stock outstanding.

Current wording

The market price of shares of our common stock could decline as a result of substantial sales of our common stock, particularly sales by our directors, executive officers, employees and significant stockholders, a large number of shares of our common stock becoming available for sale, or the perception in the market that holders of a large number of shares intend to sell their shares. As of September 30, 2025, we had approximately 35.9 million shares of our common stock outstanding.

Previous wording

In addition, as of June 30, 2025, there were approximately 1.3 million options and 0.9 million restricted stock units outstanding. If such options are exercised and restricted stock units are released, these additional shares will become available for sale. As of June 30, 2025, we had an aggregate of 2.2 million shares of our common stock reserved for future issuance under our Restated 2012 Equity Incentive Plan and 0.4 million shares reserved for future purchase under our 2021 Employee Stock Purchase Plan, which can be freely sold in the public market upon issuance. If a large number of these shares are sold in the public market, the sales could reduce the trading price of our common stock.

Current wording

In addition, as of September 30, 2025, there were approximately 1.3 million options and 1.0 million restricted stock units outstanding. If such options are exercised and restricted stock units are released, these additional shares will become available for sale. As of September 30, 2025, we had an aggregate of 1.9 million shares of our common stock reserved for future issuance under our Restated 2012 Equity Incentive Plan and 0.4 million shares reserved for future purchase under our 2021 Employee Stock Purchase Plan, which can be freely sold in the public market upon issuance. If a large number of these shares are sold in the public market, the sales could reduce the trading price of our common stock.

Previous wording

On February 12, 2018, we announced that our board of directors had authorized a $100.0 million repurchase program. On each of October 30, 2018, October 30, 2019, May 7, 2020, February 10, 2021 and February 9, 2023, we announced that our board of directors had authorized an increase of $100.0 million, and on each of November 3, 2021, May 4, 2022, February 7, 2024 and February 6, 2025, we announced that our board of directors had authorized an increase of $200.0 million to the share repurchase program, resulting in an aggregate authorization of $1.4 billion as of June 30, 2025. Although our board of directors authorized the share repurchase program, we are not obligated to repurchase any specific dollar amount or to acquire any specific number of shares. The share repurchase program could affect the price of our common stock, increase volatility and diminish our cash reserves. In addition, it may be suspended or terminated at any time, which may result in a decrease in the price of our common stock. Finally, our share repurchases in 2023 and 2024 were subject to the 1% excise tax introduced in the Inflation Reduction Act. The amount of share repurchases subject to the excise tax are reduced by the fair market value of any shares issued during the taxable year. This provision does not currently have a material impact to our results of operations. During the six months ended June 30, 2025, we repurchased 0.7 million shares of our common stock for approximately $88.8 million. As of June 30, 2025, approximately $254.6 million remained available for share repurchases pursuant to our share repurchase program.

Current wording

On February 12, 2018, we announced that our board of directors had authorized a $100.0 million repurchase program. On each of October 30, 2018, October 30, 2019, May 7, 2020, February 10, 2021 and February 9, 2023, we announced that our board of directors had authorized an increase of $100.0 million, and on each of November 3, 2021, May 4, 2022, February 7, 2024 and February 6, 2025, we announced that our board of directors had authorized an increase of $200.0 million to the share repurchase program, resulting in an aggregate authorization of $1.4 billion as of September 30, 2025. Although our board of directors authorized the share repurchase program, we are not obligated to repurchase any specific dollar amount or to acquire any specific number of shares. The share repurchase program could affect the price of our common stock, increase volatility and diminish our cash reserves. In addition, it may be suspended or terminated at any time, which may result in a decrease in the price of our common stock. Finally, our share repurchases in 2023 and 2024 were subject to the 1% excise tax introduced in the Inflation Reduction Act. The amount of share repurchases subject to the excise tax are reduced by the fair market value of any shares issued during the taxable year. This provision does not currently have a material impact to our results of operations. During the nine months ended September 30, 2025, we repurchased 1.0 million shares of our common stock for approximately $138.2 million. As of September 30, 2025, approximately $205.2 million remained available for share repurchases pursuant to our share repurchase program.