Qualys, Inc. (QLYS)

How it makes money

Qualys sells software as a service, almost entirely through renewable annual subscriptions: the customer pays a fee to access each Cloud App, and is normally invoiced for the whole subscription up front at the start of the term. That cash sits on the balance sheet as deferred revenue and is recognised as revenue evenly across the subscription period, so reported revenue is smooth even when bookings are lumpy. Growth comes from three places — existing customers renewing, existing customers buying more assets or more Cloud Apps, and new customers. The company measures the first two with a net dollar expansion rate, which was 103% in both 2025 and 2024. Enterprises and government bodies are sold to by a field sales force, smaller businesses by an inside sales force, and a large share of business flows through resellers, managed security service providers and consulting firms: channel partners generated 49% of revenues in 2025, up from 46% in 2024 and 43% in 2023. In the channel model Qualys sells the subscription to the partner, who resells it and keeps the margin. By customer billing address, 56% of 2025 revenues came from the United States. Economics are those of a mature software business: gross profit was 83% of revenues in 2025 and income from operations 33%.

Qualys has a real but limited advantage, and it comes from how hard the platform is to pull out once installed. Customers deploy agents, scanner appliances and passive sensors across their entire asset estate, connect them to their CMDB and ticketing systems, and accumulate years of vulnerability, configuration and audit history in one place; the compliance module alone ships with over 900 pre-built policies and 20,000 controls mapped to more than 90 regulations, which a security team has usually tuned to its own environment. Because the Cloud Apps share one interface, one set of sensors and one data store, adding a second or third module is cheap while replacing the platform means re-instrumenting everything. The filing describes exactly this pattern: customers typically start with one or two solutions and expand from there. But the advantage should not be overstated. Qualys itself discloses that it competes in a highly fragmented market against CrowdStrike, Palo Alto Networks, Rapid7, Tenable, Tanium, Invicti and Wiz, that many primary competitors have greater name recognition and significantly greater resources, and that sales prices are subject to competitive pressure and may decrease. Its 52 issued patents and its vulnerability-signature knowledge base help, but they do not stop rivals from bundling comparable scanning into broader security suites. A net dollar expansion rate of 103% says customers stay and spend a little more — not that they are locked in.

Demand sits between defensive and cyclical. On the defensive side, the subscriptions are annual and recognised ratably, so a downturn does not stop revenue overnight, and a large part of the spend is driven by regulation rather than choice — PCI DSS, HIPAA, SOX, NIST, FedRAMP and similar mandates require audits and evidence whether or not the economy is good, and attackers do not pause in a recession. On the cyclical side, Qualys states plainly that its business depends to a significant extent on overall demand for IT and on the economic health of its customers, and that economic weakness, inflation, interest-rate changes, constrained IT security spending and longer sales cycles — conditions it says it has experienced since 2023 — have already resulted in decreased revenue and earnings and may do so again. It also notes governmental budgetary pressure in the United States and Europe and uncertainty over tariffs and trade policy reducing customers' purchasing power. In practice the compliance floor holds, but the expansion layer — more assets under subscription, more Cloud Apps per customer — is where a tight IT budget shows up first, and that layer is what drives growth above the renewal base.

Key risks

• The business depends on renewals and on selling more to existing customers — Qualys states that if it is unable to renew existing subscriptions, sell additional subscriptions and attract new customers, its operating results would be harmed. Because revenue is recognised ratably over annual terms, a wave of non-renewals shows up gradually rather than all at once, but the base of recurring revenue erodes all the same.
• Competition and downward pressure on prices — The company discloses that it competes in a highly fragmented market and may lack sufficient financial or other resources to maintain or improve its competitive position, noting that many primary competitors have greater name recognition, longer operating histories, larger marketing budgets and significantly greater resources. It separately warns that sales prices are subject to competitive pressures and may decrease — through discounting, mix shift, or larger rivals bundling comparable products — which may reduce gross profits.
• A missed or false vulnerability damages the brand — Qualys warns that if its solutions fail to detect vulnerabilities, or incorrectly report vulnerabilities that are not there, its brand and reputation could be harmed with an adverse effect on the business. This is the core promise of a scanning product: the customer is buying an assurance that nothing was missed.
• Everything is delivered from third-party cloud facilities — Substantially all solutions are hosted from 15 shared cloud platforms operated by large third-party vendors in the United States, Canada, Switzerland, the Netherlands, the United Arab Emirates, Australia, the United Kingdom, Italy, Saudi Arabia and India. The company states these facilities are vulnerable to earthquakes, hurricanes, floods, fires, cyber-attacks, power losses and telecommunications failures, and that any disruption would interrupt or delay delivery to customers, reducing revenues.
• Reliance on channel partners for a large share of revenue — The company relies on third-party channel partners — managed security service providers, value-added resellers and consulting firms — to generate a substantial amount of its revenues, and states that failure to manage those distribution channels effectively could cause revenues to decline and harm growth prospects. Partners generated 49% of 2025 revenues, and it is the partner, not Qualys, who owns the renewal conversation with those end customers.
• Qualys itself can be attacked — The filing warns that its platform, products, website and internal systems may be subject to intentional disruption or other security incidents that could result in liability and adversely impact its reputation and future sales. A security vendor holding a detailed map of its customers' weakest points is an unusually attractive target, and a breach cuts directly at the reason customers buy.
• Long, unpredictable sales cycles make results lumpy — Qualys discloses that its sales cycle can be long and unpredictable and that sales efforts require considerable time and expense, so revenues may vary from period to period and operating results may fluctuate. It also flags separately that quarterly and annual results may vary enough to miss expectations and cause the share price to decline.

Concentration is low and the filing says so directly: in each of 2025, 2024 and 2023, no single customer accounted for more than 10% of revenues, and the platform served over 10,000 customers worldwide at the end of 2025 across education, financial services, government, healthcare, insurance, manufacturing, media, retail, technology and utilities. Qualys does not disclose a combined share for its largest customers, so no figure can be given here. Two concentrations do exist but are not customer concentrations in the usual sense: 49% of 2025 revenues were generated through channel partners rather than sold directly, and 56% came from customers with United States billing addresses — down from 58% in 2024 and 60% in 2023.