QUALYS, INC. (QLYS)

Item 7.     Management's Discussion and Analysis of Financial Condition and Results of Operations

You should read the following discussion in conjunction with our consolidated financial statements and the related notes included elsewhere in this Annual Report on Form 10-K. You should carefully review and consider the information regarding our financial condition and results of operations set forth under Part II-Item 7 (Management’s Discussion and Analysis of Financial Condition and Results of Operations) in our Annual Report on Form 10-K for the fiscal year ended December 31, 2023, filed with the SEC on February 22, 2024, for an understanding of our results of operations and liquidity discussions and analysis comparing fiscal year 2023 to fiscal year 2022, which information is hereby incorporated by reference. In addition to historical information, this discussion contains forward-looking statements that involve risks and uncertainties that could cause our actual results to differ materially from our expectations, as discussed in "Forward-Looking Statements" in Part I of this Annual Report on Form 10-K. Factors that could cause such differences include, but are not limited to, those described in the section titled "Risk Factors" and elsewhere in this Annual Report on Form 10-K.

Overview

We are a leading provider of a cloud-based platform delivering information technology (IT), security and compliance solutions that enable organizations to identify security risks to their IT infrastructures, help protect their IT systems and applications from ever-evolving cyber-attacks and achieve compliance with internal policies and external regulations. Our cloud platform addresses the growing security and compliance complexities and risks that are amplified by the dissolving boundaries between IT infrastructures and web environments, the rapid adoption of cloud computing, containers and serverless IT models, and the proliferation of geographically dispersed IT assets. Our integrated suite of IT, security and compliance solutions delivered on Qualys' Enterprise TruRisk Platform enables our customers to identify and manage their IT and operational technology (OT) assets, collect and analyze large amounts of IT security data, discover and prioritize vulnerabilities, quantify cyber risk exposure, recommend and implement remediation actions and verify the implementation of such actions. Organizations use our integrated suite of solutions to cost-effectively obtain a unified view of their internal and external IT and OT asset inventory as well as security and compliance posture across globally-distributed IT infrastructures as our solution offers a single platform for information technology, information security, application security, endpoint, developer security and cloud teams.

We were founded and incorporated in December 1999 with a vision of transforming the way organizations secure and protect their IT infrastructure and applications and initially launched our first cloud solution, Vulnerability Management (VM), in 2000. As VM gained acceptance, we introduced additional solutions to help customers manage increasing IT, security and compliance requirements. Today, the suite of solutions that we offer on our cloud platform and refer to as the Qualys Cloud Apps help our customers detect, measure, prioritize and remediate cyber risk spanning a range of assets across on-premises, endpoints, cloud, containers, and mobile environments.

We provide our solutions through a software-as-a-service model, primarily with renewable annual subscriptions. These subscriptions require customers to pay a fee in order to access each of our cloud solutions. We generally invoice our customers for the entire subscription amount at the start of the subscription term, and the invoiced amounts are treated as deferred revenues and are recognized ratably over the term of each subscription. We continue to experience revenue growth from our existing customers as they renew and purchase additional subscriptions, as well as from the addition of new customers to our cloud platform.

We market and sell our solutions to enterprises, government entities and small and medium-sized businesses across a broad range of industries, including education, financial services, government, healthcare, insurance, manufacturing, media, retail, technology and utilities. In 2024, 2023 and 2022, 58%, 60% and 60%, respectively, of our revenues were derived from customers in the United States based on our customers' billing addresses. We sell our solutions to enterprises and government entities primarily through our field sales force and to small and medium-sized businesses through our inside sales force. We generate a significant portion of sales through our channel partners, including managed security service providers, leading cloud providers, value-added resellers and consulting firms in the United States and internationally.

Impacts of Current Macroeconomic Environment

The uncertainty surrounding macroeconomic factors in the U.S. and globally characterized by inflationary pressure, high interest rates, significant volatility of global markets, reduced spending and extended sales cycles, and geopolitical conflicts could have a material adverse effect on our long-term business and could lead to further economic disruption and expose us to greater risk as our current and potential customers may reduce or eliminate their overall spending on IT security. We will continue to evaluate the nature and extent of the impact to our business, financial position, results of operations and cash flows.

42

Table of Contents

Key Components of Results of Operations

Revenues

We derive revenues from the sale of subscriptions to our IT, security and compliance solutions, which are delivered on our cloud platform. Subscriptions to our solutions allow customers to access our cloud-based IT, security and compliance solutions through a unified, web-based interface. Customers generally enter into one-year renewable subscriptions. The subscription fee entitles the customer to an unlimited number of scans for a specified number of devices or web applications and, if requested by a customer as part of their subscription, a specified number of physical or virtual scanner appliances. Our physical and virtual scanner appliances are requested by certain customers as part of their subscriptions in order to scan IT infrastructures within their firewalls and do not function without, and are not sold separately from, subscriptions for our solutions. In some cases, we also provide certain computer equipment used to extend our cloud platform into our customers' private cloud environment. Customers are required to return physical scanner appliances and computer equipment if they do not renew their subscriptions.

We typically invoice our customers for the entire subscription amount at the start of the subscription term. Invoiced amounts are reflected on our consolidated balance sheets as accounts receivable or as cash when collected, and as deferred revenues until earned and recognized ratably over the subscription period. Accordingly, deferred revenues represent the amount billed to customers that has not yet been earned or recognized as revenues, pursuant to subscriptions entered into in current and prior periods.

Cost of Revenues

Cost of revenues consists primarily of personnel expenses, comprised of salaries, benefits, performance-based compensation and stock-based compensation, for employees who operate our shared cloud platforms and provide support services to our customers. Other expenses include depreciation of shared cloud platform equipment, physical scanner appliances and computer hardware provided to certain customers as part of their subscriptions, expenses related to the use of shared cloud platforms, amortization of software and license fees, amortization of intangibles related to acquisitions, maintenance support, fees paid to contractors who supplement or support our operations center personnel and overhead allocations. We expect to continue to expand our shared cloud platform infrastructures and invest in our customer support and operations teams to support our customers and operations, which in turn, is expected to increase the cost of revenues in absolute dollars.

Operating Expenses

Research and Development

Research and development expenses consist primarily of personnel expenses, comprised of salaries, benefits, performance-based compensation and stock-based compensation, for our research and development teams. Other expenses include third-party contractor fees, software and license fees, amortization of intangibles related to acquisitions and overhead allocations. We expect to continue to devote resources to research and development in an effort to continuously improve our existing solutions as well as develop new solutions and capabilities, which in turn, is expected to increase the research and development expenses in absolute dollars.

Sales and Marketing

Sales and marketing expenses consist primarily of personnel expenses, comprised of salaries, benefits, sales commissions, performance-based compensation and stock-based compensation for our worldwide sales and marketing teams. Other expenses include marketing and promotional events, lead-generation marketing programs, public relations, travel, software licenses and overhead allocations. Sales commissions related to new business and upsells are capitalized as an asset. We amortize the capitalized commission cost as a selling expense on a straight-line basis over a period of five years. We expense sales commissions related to contract renewals as incurred. Our new sales personnel are typically not immediately productive, and the resulting increase in sales and marketing expenses we incur when we add new personnel may not result in increased revenues if these new sales personnel fail to become productive. The timing of our hiring of sales personnel, or the participation in new marketing events or programs, and the rate at which these generate incremental revenues, may affect our future operating results. We expect to continue to invest in sales and marketing teams and also in more marketing programs to support new solutions on our platform, which in turn, is expected to increase sales and marketing expenses in absolute dollars.

43

Table of Contents

General and Administrative

General and administrative expenses consist primarily of personnel expenses, comprised of salaries, benefits, performance-based compensation and stock-based compensation for our executive, finance and accounting, IT, legal and human resources teams, as well as professional services, fees, software licenses and overhead allocations. We expect to continue to invest in our people and incur professional services to support our growth and compliance with legal and regulatory requirements, which in turn, is expected to increase general and administrative expenses in absolute dollars.

Other Income (Expense), Net

Our other income (expense), net consists primarily of interest and returns from our cash equivalent, short-term and long-term marketable securities, non-marketable securities gains and losses, and foreign exchange gains and losses.

Income Tax Provision

We are subject to federal, state and foreign income taxes for jurisdictions in which we operate, and we use estimates in determining our income tax provision and deferred tax assets. Earnings from our non-U.S. activities are subject to income taxes in the local countries at rates which are generally similar to the U.S. statutory tax rate. We regularly assess the realizability of our net deferred tax assets. As of December 31, 2024, valuation allowances remain in certain jurisdictions where we believe it is necessary to see positive evidence, such as sustained achievement of sufficient profits, to meet a more likely than not stance that the valuation allowance should be reversed. The exact timing and amount of the valuation allowance release is subject to change based on the level of profitability achieved in future periods. Release of the valuation allowance would result in the recognition of deferred tax assets and a corresponding decrease to income tax expense in the period the release is recorded.

Results of Operations

The following table sets forth selected consolidated statements of operations data for each of the periods presented as a percentage of revenues:

44

Table of Contents

Comparison of Years Ended December 31, 2024 and 2023

Revenues

Revenues increased by $53.1 million in 2024 compared to 2023, driven by increased demand for our subscription services by our end customers. Of the total increase of $53.1 million in revenues, 69% was from customers existing at or prior to December 31, 2023, and the remaining 31% was from new customers added in 2024. Of the total increase of $53.1 million, 42% was from customers in the United States and the remaining 58% was from customers in foreign countries. In 2024, 54% of total revenues were direct and 46% of total revenues were through partners. Of the total increase of $53.1 million, 20% was direct and the remaining 80% was from partners.

With our strong market position driving further demand for our solutions, we expect revenue growth from new and existing customers to continue.

Cost of Revenues

Cost of revenues increased by $4.0 million in 2024 compared to 2023, primarily due to an increase in shared cloud platform cost of $6.0 million, an increase in personnel costs, including stock-based compensation, of $4.6 million, driven by additional employees hired to support the growth of our business, an increase in license expenses and professional service expenses of $1.2 million, partially offset by a decrease in depreciation and amortization expense of $7.8 million resulting from certain of our assets becoming fully depreciated or amortized.

Research and Development Expenses

Research and development expenses increased by $1.4 million in 2024 compared to 2023, primarily due to an increase in personnel costs, including stock-based compensation, of $2.8 million, driven by increased headcount, partially offset by a decrease in depreciation and amortization expense in property and equipment of $0.8 million, and a decrease in overhead allocation of $0.6 million.

45

Table of Contents

Sales and Marketing Expenses

Sales and marketing expenses increased by $16.6 million in 2024 compared to 2023, primarily due to an increase in personnel costs, including stock-based compensation, of $12.9 million, driven by increased headcount, an increase in travel and entertainment cost of $1.8 million, an increase in marketing expenses related to trade shows of $0.7 million, an increase in overhead allocation of $0.7 million, and an increase in subscribed license and software costs of $0.5 million.

General and Administrative Expenses

General and administrative expenses increased by $7.0 million in 2024 compared to 2023, primarily due to an increase in personnel costs, including stock-based compensation, of $6.3 million, driven by increased headcount, annual merit increases and refresh grants to eligible employees and executives, and an increase in subscribed software costs and other expenses of $0.7 million.

Total other income, net

Total other income, net increased by $7.0 million in 2024 compared to 2023, primarily due to an increase in interest income of $8.9 million driven by an increase in our average daily cash and investment balance, a non-recurring unrealized loss of $0.5 million on a non-marketable equity security recognized during 2023, partially offset by an increase in foreign currency loss of $2.4 million.

46

Table of Contents

Income tax provision

Income tax provision increased by $9.1 million in 2024 compared to 2023, primarily due to the tax effect of an increase in pretax income, increase in foreign withholding taxes, decrease in excess tax benefit from stock-based compensation compared to prior year, and decrease in other discrete tax adjustments. The increase in tax expense was partially offset by an increase in foreign derived intangible income benefit, an increase in research and development tax credits, and the recognition of an income tax benefit related to uncertain tax positions due to statute lapse.

For the year ended December 31, 2024, our income tax provision included a benefit of $2.5 million related to an increase in foreign derived intangible income benefit and research and development tax credits associated with our U.S. income tax return filed during the year.

Key Operating and Non-GAAP Financial Performance Metrics

In addition to measures of financial performance presented in our consolidated financial statements, we monitor the key metrics set forth below to help us evaluate growth trends, establish budgets, measure the effectiveness of our sales and marketing efforts and assess operational efficiencies.

Net Dollar Expansion Rate

We evaluate our ability to retain and grow existing customers by assessing our net dollar expansion rate on a last twelve months, or LTM, basis. This metric is used to appropriately manage resources and customer retention and expansion. We calculate the net dollar expansion rate on a foreign exchange neutral basis by dividing a numerator by a denominator, each defined as follows:

Denominator: To calculate our net dollar expansion rate as of the end of a reporting period, we first determine the annual recurring revenue, or ARR, from all active subscriptions as of the last day of the same reporting period in the prior year. This represents recurring payments that we expect to receive in the next 12-month period from the cohort of customers that existed on the last day of the same reporting period in the prior year.

Numerator: We measure the ARR for that same cohort of customers representing all active subscriptions as of the end of the reporting period, using the same foreign exchange rate from the prior year.

Our net dollar expansion rates were 103% and 105% for the years ended December 31, 2024 and 2023, respectively.

Adjusted EBITDA

We monitor Adjusted EBITDA, a non-GAAP financial measure, to analyze our financial results and believe that it is useful to investors, as a supplement to U.S. GAAP measures, in evaluating our ongoing operational performance and enhancing an overall understanding of our past financial performance. We believe that Adjusted EBITDA helps illustrate underlying trends in our business that could otherwise be masked by the effect of the income or expenses that we exclude in Adjusted EBITDA. Furthermore, we use this measure to establish budgets and operational goals for managing our business and evaluating our performance. We also believe that Adjusted EBITDA provides an additional tool for investors to use in comparing our recurring core business operating results over multiple periods with other companies in our industry.

Adjusted EBITDA should not be considered in isolation from, or as a substitute for, financial information prepared in accordance with U.S. GAAP. We calculate Adjusted EBITDA as net income before (1) other (income) expense, net, which includes interest income, interest expense and other income and expense, (2) income tax provision (benefit), (3) depreciation and amortization of property and equipment, (4) amortization of intangible assets, (5) stock-based compensation and (6) non-recurring expenses that do not reflect ongoing costs of operating the business.

47

Table of Contents

Adjusted EBITDA has limitations as an analytical tool and should not be considered in isolation from or as a substitute for the measures presented in accordance with U.S. GAAP. Some of these limitations are:

•Adjusted EBITDA does not reflect certain cash and non-cash charges that are recurring;

•Adjusted EBITDA does not reflect income tax payments that reduce cash available to us;

•Adjusted EBITDA excludes depreciation and amortization of property and equipment and amortization of intangible assets, although these are non-cash charges, the assets being depreciated and amortized may have to be replaced in the future; and

•Other companies, including companies in our industry, may calculate Adjusted EBITDA differently or not at all, which reduces its usefulness as a comparative measure.

Because of these limitations, Adjusted EBITDA should be considered alongside other financial performance measures, including revenues, net income, cash flows from operating activities and our financial results presented in accordance with U.S. GAAP.

The following unaudited table presents the reconciliation of net income to Adjusted EBITDA for the years ended December 31, 2024 and 2023.

Liquidity and Capital Resources

As of December 31, 2024, our principal source of liquidity was cash, cash equivalents and marketable securities of $575.3 million, including $119.9 million of cash held outside of the United States. The following summary of cash flows for the periods indicated have been derived from our consolidated financial statements included elsewhere in this report:

Operating Activities

In 2024, we generated $243.9 million of cash from our net income, as adjusted for non-cash items mainly related to stock-based compensation expense, depreciation and amortization expense and deferred taxes, as compared to $226.4 million in 2023. In addition, we also generated $0.2 million of cash from working capital change in 2024, of which $11.7 million was related to the

48

Table of Contents

increases in accounts receivable and deferred revenue due to the timing of collections and growth in billings, a $3.2 million increase in payables and accrued liabilities driven by the timing of payment, partially offset by a $14.7 million increase in prepaid expenses. In 2023, we generated $226.4 million of cash from our net income, as adjusted for non-cash items mainly related to stock-based compensation expense, depreciation and amortization expense and deferred taxes. In addition, we also generated $18.2 million of cash from working capital change in 2023, of which $22.7 million was related to the net increase in deferred revenue and accounts receivable due to the growth in billing and the timing of collections, partially offset by a $1.1 million decrease in payables and accrued liabilities and a $3.4 million increase in prepaid expenses primarily driven by the timing of payments.

Investing Activities

In 2024, we used $59.1 million of cash for purchases of marketable securities net of sales and maturities, and used $12.3 million of cash in capital expenditures mainly related to computer equipment to support our growth and development and leasehold improvement for expansion of our office spaces and shared cloud platform facilities, as compared to the use of $64.4 million of cash for purchases of marketable securities net of sales and maturities, and the use of $8.8 million of cash in capital expenditures mainly related to computer equipment to support our growth and development in 2023.

Financing Activities

In 2024, we used $139.9 million of cash for share repurchases and $28.4 million of cash in payment of employee withholding taxes upon vesting of restricted stock units and $1.5 million payment of cash held in escrow as part of the Blue Hexagon acquisition on October 4, 2022, partially offset by $17.3 million of proceeds from employee exercise of stock options and $6.9 million of proceeds from issuance of common stock through our employee stock purchase plan ("ESPP"), as compared to $170.8 million of cash for share repurchase and $22.3 million of cash in payment of employee withholding taxes upon vesting of restricted stock units, partially offset by $45.6 million of proceeds from employee exercise of stock options and $6.1 million of proceeds from issuance of common stock through our ESPP in 2023.

Material Cash Requirements

We believe our existing cash and cash equivalents, marketable securities and our expected cash flow generated from operations will be sufficient to fund our operations for the next twelve months and beyond. If we repatriate funds from our foreign subsidiaries, we could be subject to foreign withholding taxes.

Our material cash requirements mainly include the following contractual and other obligations:

•Our operating lease obligations to make payments under our non-cancelable lease agreements for our facilities and shared cloud platforms. We had fixed operating lease payment obligations of $59.9 million as of December 31, 2024, with $13.5 million expected to be paid within the next 12 months.

•Cash outflow for capital expenditures in 2025 is expected to be in a range of $8.0 million to $13.0 million. Our future capital requirements will depend on many factors, including our rate of revenue growth, the expansion of our sales and marketing activities, the timing, type and extent of our spending on research and development efforts, international expansion and investment in shared cloud platforms and cloud infrastructures. We may also seek to invest in or acquire complementary businesses or technologies.

•Other non-cancelable purchase obligations related to cloud infrastructures and other service providers totaled $70.5 million, of which $39.2 million is expected to be paid within the next 12 months.

Share Repurchases

We expect to continue to use cash to repurchase shares in 2025 under our share repurchase program authorized by our board of directors on February 5, 2018. As of December 31, 2024, approximately $143.4 million remained available under our share repurchase program. Shares will be repurchased from time to time in privately negotiated transactions or on the open market in accordance with Rule 10b-18 of the Exchange Act of 1934, including pursuant to a pre-set trading plan adopted in accordance with Rule 10b5-1 under the Exchange Act. On February 6, 2025, we announced that our board of directors authorized an additional $200.0 million under the share repurchase program, increasing the total amount of authorized repurchase to $1.4 billion.

Critical Accounting Estimates

The preparation of our consolidated financial statements in accordance with U.S. GAAP requires us to make estimates and assumptions that affect the reported amounts of assets, liabilities, revenues, expenses and related disclosures. Our significant

49

Table of Contents

accounting policies are described in Note 1 - The Company and Summary of Significant Accounting Policies in the accompanying notes to the consolidated financial statements included in Part II, Item 8, "Financial Statements and Supplementary Data" of this Annual Report on Form 10-K. On an ongoing basis, we evaluate our estimates and assumptions based on historical and anticipated results and trends that we believe represent our best estimate under the circumstances. However, as accounting estimates are subject to inherent uncertainty, our actual results may differ from these estimates under different assumptions or conditions.

Income Taxes

Significant assumptions, judgments and estimates are involved in determining our provision for (benefit from) income taxes, our deferred tax assets and liabilities, and any valuation allowance to be recorded against our deferred tax assets. Our judgments, assumptions and estimates relating to the current provision for income taxes include the geographic mix and amount of income (loss), expectations of future income, our interpretation of current tax laws, our business, and possible outcomes of current and future audits conducted by foreign and domestic tax authorities. Our judgments also include anticipating the tax positions we will record in the financial statements before preparing and filing the tax returns. Our estimates and assumptions may differ from the actual results as reflected in our income tax returns and we record the required adjustments when they are identified or resolved. Changes in our business and tax laws or our interpretation of those, and developments in current and future tax audits, could significantly impact the amounts provided for income taxes in our results of operations, financial position, or cash flows.

The assessment of tax effects of our uncertain tax positions in our financial statements involves significant judgment in interpreting complex and ambiguous tax laws, regulations, and administrative practices, determining the probability of various possible settlement outcomes, evaluating the litigation process based on tax authority behaviors in similar cases, and estimating the likelihood that another taxing authority could review the respective tax position. These judgments are inherently challenging and subjective because a taxing authority may change its behavior at any time. We must also determine when it is reasonably possible that the amount of unrecognized tax benefits will significantly increase or decrease in the 12 months after each fiscal year-end. We reevaluate our income tax positions on a quarterly basis to consider factors such as changes in facts or circumstances, changes in tax laws, effectively settled issues under audit, the potential for interest and penalties, and new audit activity. Such a change in recognition or measurement would result in recognition of a tax benefit or an additional charge to the tax provision that could be material in the future.

Stock-Based Compensation

We recognize the fair value of our employee stock options and restricted stock units, including performance-based restricted stock units, over the requisite service period. The fair value of each stock option is estimated on date of grant using the Black-Scholes-Merton option pricing model. Determining the appropriate fair value model and calculating the fair value of employee stock options requires the use of subjective assumptions, including the expected life of the stock option and stock price volatility. The recognition of expenses for performance based restricted stock units requires us to estimate the probability that the performance condition will be achieved and the number of awards that will vest are adjusted accordingly at each reporting period. The assumptions used in calculating the fair value of employee stock options and estimating the probability of achievement of performance metrics represent management’s best estimates, which require significant judgment and involve inherent uncertainties. If factors change and we use different assumptions, our stock-based compensation expense could be materially different in the future.

Item 7.     Management's Discussion and Analysis of Financial Condition and Results of Operations

You should read the following discussion in conjunction with our consolidated financial statements and the related notes included elsewhere in this Annual Report on Form 10-K. You should carefully review and consider the information regarding our financial condition and results of operations set forth under Part II-Item 7 (Management’s Discussion and Analysis of Financial Condition and Results of Operations) in our Annual Report on Form 10-K for the fiscal year ended December 31, 2022, filed with the SEC on February 23, 2023, for an understanding of our results of operations and liquidity discussions and analysis comparing fiscal year 2022 to fiscal year 2021, which information is hereby incorporated by reference. In addition to historical information, this discussion contains forward-looking statements that involve risks and uncertainties that could cause our actual results to differ materially from our expectations, as discussed in "Forward-Looking Statements" in Part I of this Annual Report on Form 10-K. Factors that could cause such differences include, but are not limited to, those described in the section titled "Risk Factors" and elsewhere in this Annual Report on Form 10-K.

Overview

We are a pioneer and leading provider of a cloud-based platform delivering information technology (IT), security and compliance solutions that enable organizations to identify security risks to their IT infrastructures, help protect their IT systems and applications from ever-evolving cyber-attacks and achieve compliance with internal policies and external regulations. Our cloud platform address the growing security and compliance complexities and risks that are amplified by the dissolving boundaries between IT infrastructures and web environments, the rapid adoption of cloud computing, containers and serverless IT models, and the proliferation of geographically dispersed IT assets. Our integrated suite of IT, security and compliance solutions delivered on Qualys' Enterprise TruRisk Platform enables our customers to identify and manage their IT and operational technology (OT) assets, collect and analyze large amounts of IT security data, discover and prioritize vulnerabilities, quantify cyber risk exposure, recommend and implement remediation actions and verify the implementation of such actions. Organizations use our integrated suite of solutions to cost-effectively obtain a unified view of their internal and external IT and OT asset inventory as well as security and compliance posture across globally-distributed IT infrastructures as our solution offers a single platform for information technology, information security, application security, endpoint, developer security and cloud teams.

We were founded and incorporated in December 1999 with a vision of transforming the way organizations secure and protect their IT infrastructure and applications and initially launched our first cloud solution, Vulnerability Management (VM), in 2000. As VM gained acceptance, we introduced additional solutions to help customers manage increasing IT, security and compliance requirements. Today, the suite of solutions that we offer on our cloud platform and refer to as the Qualys Cloud Apps help our customers detect, measure, prioritize and remediate cyber risk spanning a range of assets across on-premises, endpoints, cloud, containers, and mobile environments.

We provide our solutions through a software-as-a-service model, primarily with renewable annual subscriptions. These subscriptions require customers to pay a fee in order to access each of our cloud solutions. We generally invoice our customers for the entire subscription amount at the start of the subscription term, and the invoiced amounts are treated as deferred revenues and are recognized ratably over the term of each subscription. We continue to experience revenue growth from our existing customers as they renew and purchase additional subscriptions, as well as from the addition of new customers to our cloud platform.

We market and sell our solutions to enterprises, government entities and small and medium-sized businesses across a broad range of industries, including education, financial services, government, healthcare, insurance, manufacturing, media, retail, technology and utilities. In 2023, 2022 and 2021, 60%, 60% and 61%, respectively, of our revenues were derived from customers in the United States based on our customers' billing addresses. We sell our solutions to enterprises and government entities primarily through our field sales force and to small and medium-sized businesses through our inside sales force. We generate a significant portion of sales through our channel partners, including managed security service providers, leading cloud providers, value-added resellers and consulting firms in the United States and internationally.

Impacts of Current Macroeconomic Environment

The uncertainty surrounding macroeconomic factors in the U.S. and globally characterized by the supply chain environment, inflationary pressure, rising interest rates, financial institution failures and associated uncertainty, labor shortages, significant volatility of global markets, reduced spending and extended sales cycles, and geopolitical conflicts could have a material adverse effect on our long-term business and could lead to further economic disruption and expose us to greater risk as our current and potential customers may reduce or eliminate their overall spending on IT security. We will continue to evaluate the nature and extent of the impact to our business, financial position, results of operations and cash flows.

43

Table of Contents

Key Components of Results of Operations

Revenues

We derive revenues from the sale of subscriptions to our IT, security and compliance solutions, which are delivered on our cloud platform. Subscriptions to our solutions allow customers to access our cloud-based IT, security and compliance solutions through a unified, web-based interface. Customers generally enter into one-year renewable subscriptions. The subscription fee entitles the customer to an unlimited number of scans for a specified number of devices or web applications and, if requested by a customer as part of their subscription, a specified number of physical or virtual scanner appliances. Our physical and virtual scanner appliances are requested by certain customers as part of their subscriptions in order to scan IT infrastructures within their firewalls and do not function without, and are not sold separately from, subscriptions for our solutions. In some cases, we also provide certain computer equipment used to extend our cloud platform into our customers' private cloud environment. Customers are required to return physical scanner appliances and computer equipment if they do not renew their subscriptions.

We typically invoice our customers for the entire subscription amount at the start of the subscription term. Invoiced amounts are reflected on our consolidated balance sheets as accounts receivable or as cash when collected, and as deferred revenues until earned and recognized ratably over the subscription period. Accordingly, deferred revenues represent the amount billed to customers that has not yet been earned or recognized as revenues, pursuant to subscriptions entered into in current and prior periods.

Cost of Revenues

Cost of revenues consists primarily of personnel expenses, comprised of salaries, benefits, performance-based compensation and stock-based compensation, for employees who operate our shared cloud platforms and provide support services to our customers. Other expenses include depreciation of shared cloud platform equipment, physical scanner appliances and computer hardware provided to certain customers as part of their subscriptions, expenses related to the use of shared cloud platforms, amortization of software and license fees, amortization of intangibles related to acquisitions, maintenance support, fees paid to contractors who supplement or support our operations center personnel and overhead allocations. We expect to continue to expand our shared cloud platform infrastructures and hire additional employees to support our operations, which will increase the cost of revenues in absolute dollars.

Operating Expenses

Research and Development

Research and development expenses consist primarily of personnel expenses, comprised of salaries, benefits, performance-based compensation and stock-based compensation, for our research and development teams. Other expenses include third-party contractor fees, software and license fees, amortization of intangibles related to acquisitions and overhead allocations. We expect to continue to devote resources to research and development in an effort to continuously improve our existing solutions as well as develop new solutions and capabilities and expect that research and development expenses will increase in absolute dollars.

Sales and Marketing

Sales and marketing expenses consist primarily of personnel expenses, comprised of salaries, benefits, sales commissions, performance-based compensation and stock-based compensation for our worldwide sales and marketing teams. Other expenses include marketing and promotional events, lead-generation marketing programs, public relations, travel, software licenses and overhead allocations. Sales commissions related to new business and upsells are capitalized as an asset. We amortize the capitalized commission cost as a selling expense on a straight-line basis over a period of five years. We expense sales commissions related to contract renewals as incurred. Our new sales personnel are typically not immediately productive, and the resulting increase in sales and marketing expenses we incur when we add new personnel may not result in increased revenues if these new sales personnel fail to become productive. The timing of our hiring of sales personnel, or the participation in new marketing events or programs, and the rate at which these generate incremental revenues, may affect our future operating results. We expect to continue to invest in additional sales personnel worldwide and also in more marketing programs to support new solutions on our platform, which will increase sales and marketing expenses in absolute dollars.

44

Table of Contents

General and Administrative

General and administrative expenses consist primarily of personnel expenses, comprised of salaries, benefits, performance-based compensation and stock-based compensation for our executive, finance and accounting, IT, legal and human resources teams, as well as professional services, fees, software licenses and overhead allocations. We expect that general and administrative expenses will increase in absolute dollars, as we continue to add personnel and incur professional services to support our growth and compliance with legal requirements.

Other Income (Expense), Net

Our other income (expense), net consists primarily of interest and returns from our short-term and long-term marketable securities, non-marketable securities gains and losses, and foreign exchange gains and losses.

Income Tax Provision

We are subject to federal, state and foreign income taxes for jurisdictions in which we operate, and we use estimates in determining our income tax provision and deferred tax assets. Earnings from our non-U.S. activities are subject to income taxes in the local countries at rates which are generally similar to the U.S. statutory tax rate. We regularly assess the realizability of our net deferred tax assets. As of December 31, 2023, valuation allowances remain in certain jurisdictions where we believe it is necessary to see further positive evidence, such as sustained achievement of sufficient profits to meet a more likely than not stance that the valuation allowance should be reversed. If additional positive evidence becomes available in the foreseeable future, we may release all or a portion of the valuation allowance. The exact timing and amount of the valuation allowance release is subject to change based on the level of profitability achieved in future periods. Release of the valuation allowance would result in the recognition of deferred tax assets and a corresponding decrease to income tax expense in the period the release is recorded.

Results of Operations

The following table sets forth selected consolidated statements of operations data for each of the periods presented as a percentage of revenues:

45

Table of Contents

Comparison of Years Ended December 31, 2023 and 2022

Revenues

Revenues increased by $64.7 million in 2023 compared to 2022, driven by increased demand for our subscription services by our end customers. Of the total increase of $64.7 million in revenues, 80% was from customers existing at or prior to December 31, 2022, and the remaining 20% was from new customers added in 2023. Of the total increase of $64.7 million, 62% was from customers in the United States and the remaining 38% was from customers in foreign countries. In 2023, 57% of total revenues were direct and 43% of total revenues were through partners. Of the total increase of $64.7 million, 46% was direct and the remaining 54% was from partners. With our strong market position driving further demand for our solutions, we expect revenue growth from new and existing customers to continue.

Cost of Revenues

Cost of revenues increased by $4.7 million in 2023 compared to 2022, due to an increase in personnel costs, including stock-based compensation, of $5.1 million, driven by additional employees hired to support the growth of our business, an increase in shared cloud platform cost of $4.8 million, and an increase in subscribed license and software costs of $1.5 million, partially offset by a decrease in depreciation and amortization expense of $6.7 million resulting from our assets becoming fully depreciated or amortized.

Research and Development Expenses

Research and development expenses increased by $9.3 million in 2023 compared to 2022, due to an increase in personnel costs, including stock-based compensation, of $11.4 million, driven by increased headcount, annual merit increases for eligible employees and refresh grants to eligible employees, partially offset by a decrease in professional service expense of $1.2 million, and a decrease in depreciation and amortization expense in property and equipment of $0.9 million.

46

Table of Contents

Sales and Marketing Expenses

Sales and marketing expenses increased by $14.5 million in 2023 compared to 2022, due to an increase in personnel costs, including stock-based compensation, of $13.6 million, driven by increased headcount, an increase in travel and entertainment cost of $1.5 million associated with increased in-person sales meetings and marketing events, and an increase in subscribed license and software costs of $0.7 million, partially offset by a decrease in professional service expense of $1.3 million.

General and Administrative Expenses

General and administrative expenses increased by $3.8 million in 2023 compared to 2022, due to an increase in personnel costs, including stock-based compensation of $5.7 million, driven by increased headcount, annual merit increases for eligible employees and refresh grants to eligible employees and executives, and an increase in subscribed license and software cost of $0.8 million, partially offset by a decrease in professional service expense of $1.4 million, and a decrease in legal expense of $1.3 million.

Total other income, net

Total other income, net increased by $12.4 million in 2023 compared to 2022, due to an increase in interest income of $11.7 million driven by an increase of market interest rates, in addition to a $1.2 million decrease in foreign currency loss, partially offset by an unrealized loss of $0.5 million on a non-marketable equity security.

47

Table of Contents

Income tax provision

On July 21, 2023, the IRS issued a rule change allowing taxpayers to temporarily apply the regulations in effect prior to 2022 related to U.S. federal foreign tax credits to foreign taxes paid or accrued in years 2022 and 2023. Additionally, on September 8, 2023, the IRS issued interim guidance on the capitalization and amortization of research and development expenses. A cumulative tax benefit applicable to prior periods for the rule change and the guidance was recorded in 2023, which reduced the effective tax rate in 2023 compared to 2022. On December 11, 2023, the IRS extended the temporary relief for U.S. Federal foreign tax credit until further guidance, which is expected to provide similar tax benefits in future tax years.

Income tax provision increased by $1.3 million in 2023 compared to 2022, primarily due to an increase in pretax income and a decrease in excess tax benefits arising from stock-based compensation compared to the same period in 2022. The increase was partially offset by higher foreign tax credits and lower net capitalization of research and development expenses for tax purposes than previously estimated, reflecting the rule change and the guidance.

Key Operating and Non-GAAP Financial Performance Metrics

In addition to measures of financial performance presented in our consolidated financial statements, we monitor the key metrics set forth below to help us evaluate growth trends, establish budgets, measure the effectiveness of our sales and marketing efforts and assess operational efficiencies.

Net Dollar Expansion Rate

We evaluate our ability to retain and grow existing customers by assessing our net dollar expansion rate on a last twelve months, or LTM, basis. This metric is used to appropriately manage resources and customer retention and expansion. We calculate the net dollar expansion rate on a foreign exchange neutral basis by dividing a numerator by a denominator, each defined as follows:

Denominator: To calculate our net dollar expansion rate as of the end of a reporting period, we first determine the annual recurring revenue, or ARR, from all active subscriptions as of the last day of the same reporting period in the prior year. This represents recurring payments that we expect to receive in the next 12-month period from the cohort of customers that existed on the last day of the same reporting period in the prior year.

Numerator: We measure the ARR for that same cohort of customers representing all active subscriptions as of the end of the reporting period, using the same foreign exchange rate from the prior year.

Our net dollar expansion rates were 105% and 109% for the years ended December 31, 2023 and 2022, respectively.

Adjusted EBITDA

We monitor Adjusted EBITDA, a non-GAAP financial measure, to analyze our financial results and believe that it is useful to investors, as a supplement to U.S. GAAP measures, in evaluating our ongoing operational performance and enhancing an overall understanding of our past financial performance. We believe that Adjusted EBITDA helps illustrate underlying trends in our business that could otherwise be masked by the effect of the income or expenses that we exclude in Adjusted EBITDA. Furthermore, we use this measure to establish budgets and operational goals for managing our business and evaluating our performance. We also believe that Adjusted EBITDA provides an additional tool for investors to use in comparing our recurring core business operating results over multiple periods with other companies in our industry.

48

Table of Contents

Adjusted EBITDA should not be considered in isolation from, or as a substitute for, financial information prepared in accordance with U.S. GAAP. We calculate Adjusted EBITDA as net income before (1) other (income) expense, net, which includes interest income, interest expense and other income and expense, (2) income tax provision (benefit), (3) depreciation and amortization of property and equipment, (4) amortization of intangible assets, (5) stock-based compensation and (6) non-recurring expenses that do not reflect ongoing costs of operating the business.

Adjusted EBITDA has limitations as an analytical tool and should not be considered in isolation from or as a substitute for the measures presented in accordance with U.S. GAAP. Some of these limitations are:

•Adjusted EBITDA does not reflect certain cash and non-cash charges that are recurring;

•Adjusted EBITDA does not reflect income tax payments that reduce cash available to us;

•Adjusted EBITDA excludes depreciation and amortization of property and equipment and amortization of intangible assets, although these are non-cash charges, the assets being depreciated and amortized may have to be replaced in the future; and

•Other companies, including companies in our industry, may calculate Adjusted EBITDA differently or not at all, which reduces its usefulness as a comparative measure.

Because of these limitations, Adjusted EBITDA should be considered alongside other financial performance measures, including revenues, net income, cash flows from operating activities and our financial results presented in accordance with U.S. GAAP.

The following unaudited table presents the reconciliation of net income to Adjusted EBITDA for the years ended December 31, 2023 and 2022.

Liquidity and Capital Resources

As of December 31, 2023, our principal source of liquidity was cash, cash equivalents and marketable securities of $482.2 million, including $94.8 million of cash held outside of the United States. The following summary of cash flows for the periods indicated have been derived from our consolidated financial statements included elsewhere in this report:

49

Table of Contents

Operating Activities

In 2023, we generated $226.4 million of cash from our net income, as adjusted for non-cash items mainly related to stock-based compensation expense, depreciation and amortization expense and deferred taxes, as compared to $177.2 million in 2022. In addition, we also generated $18.2 million of cash from working capital change in 2023, of which $22.7 million was related to a net increase in deferred revenue and accounts receivable due to the growth in billing and the timing of collections, partially offset by a $1.1 million decrease in payables and accrued liabilities and a $3.4 million increase in prepaid expenses primarily driven by the timing of payments. In 2022, we generated $177.2 million of cash from our net income, as adjusted for non-cash items mainly related to stock-based compensation expense, depreciation and amortization expense and deferred taxes, as compared to $169.6 million in 2021. In addition, we also generated $21.7 million of cash from working capital change in 2022, of which $11.8 million was related to a net increase in deferred revenue and accounts receivable as a result of our continued growth in billing and the timing of collections, and $9.9 million was due to lower prepaid expenses and an increase in payables and accrued liabilities primarily due to timing of payments.

Investing Activities

In 2023, we used $64.4 million of cash for purchases of marketable securities net of sales and maturities, and used $8.8 million of cash in capital expenditures mainly related to computer equipment to support our growth and development, as compared to $169.0 million of cash generated from net sales and maturities of our marketable securities, $15.4 million of cash used in capital expenditures mainly related to computer equipment to support our growth and development and $8.6 million of cash used to acquire certain technology assets in 2022.

Financing Activities

In 2023, we used $170.8 million of cash for share repurchase and $22.3 million of cash in payment of employee withholding taxes upon vesting of restricted stock units, partially offset by $45.6 million of proceeds from employee exercise of stock options and $6.1 million of proceeds from issuance of common stock through our employee stock purchase plan ("ESPP"), as compared to $317.3 million of cash used for share repurchase and $17.6 million of cash in payment of employee withholding taxes upon vesting of restricted stock units, partially offset by $24.5 million of proceeds from employee exercise of stock options and $4.4 million of proceeds from issuance of common stock through our ESPP in 2022.

Material Cash Requirements

We believe our existing cash and cash equivalents, marketable securities and our expected cash flow generated from operations will be sufficient to fund our operations for the next twelve months and beyond. If we repatriate funds from our foreign subsidiaries, we could be subject to foreign withholding taxes.

Our material cash requirements mainly include the following contractual and other obligations:

•Our operating lease obligations to make payments under our non-cancelable lease agreements for our facilities and shared cloud platforms. We had fixed operating lease payment obligations of $31.1 million as of December 31, 2023, with $13.1 million expected to be paid within the next 12 months.

•Cash outflow for capital expenditures in 2024 is expected to be in a range of $15.0 million to $20.0 million. Our future capital requirements will depend on many factors, including our rate of revenue growth, the expansion of our sales and marketing activities, the timing, type and extent of our spending on research and development efforts, international expansion and investment in shared cloud platforms and cloud infrastructures. We may also seek to invest in or acquire complementary businesses or technologies.

•Other non-cancelable purchase obligations related to cloud infrastructures and other service providers totaled $70.6 million, of which $29.7 million is expected to be paid within the next 12 months.

Share Repurchases

We expect to continue to use cash to repurchase shares in 2024 under our share repurchase program authorized by our board of directors on February 5, 2018. As of December 31, 2023, our board of directors had authorized an aggregate amount of $1.0 billion for repurchases under our share repurchase program, of which approximately $83.7 million remained available. Shares will be repurchased from time to time in the open market in accordance with Rule 10b-18 of the Exchange Act of 1934, including pursuant to a pre-set trading plan adopted in accordance with Rule 10b5-1 under the Exchange Act.

50

Table of Contents

On February 7, 2024, we announced that our Board of Directors authorized an additional $200.0 million under the share repurchase program, increasing the total amount of authorized repurchase to $1.2 billion.

Critical Accounting Estimates

The preparation of our consolidated financial statements in accordance with U.S. GAAP requires us to make estimates and assumptions that affect the reported amounts of assets, liabilities, revenues, expenses and related disclosures. Our significant accounting policies are described in Note 1 - The Company and Summary of Significant Accounting Policies in the accompanying notes to the consolidated financial statements included in Part II, Item 8, "Financial Statements and Supplementary Data" of this Annual Report on Form 10-K. On an ongoing basis, we evaluate our estimates and assumptions based on historical and anticipated results and trends that we believe represent our best estimate under the circumstances. However, as accounting estimates are subject to inherent uncertainty, our actual results may differ from these estimates under different assumptions or conditions.

Income Taxes

Significant assumptions, judgments and estimates are involved in determining our provision for (benefit from) income taxes, our deferred tax assets and liabilities, and any valuation allowance to be recorded against our deferred tax assets. Our judgments, assumptions and estimates relating to the current provision for income taxes include the geographic mix and amount of income (loss), expectations of future income, our interpretation of current tax laws, our business, and possible outcomes of current and future audits conducted by foreign and domestic tax authorities. Our judgments also include anticipating the tax positions we will record in the financial statements before preparing and filing the tax returns. Our estimates and assumptions may differ from the actual results as reflected in our income tax returns and we record the required adjustments when they are identified or resolved. Changes in our business and tax laws or our interpretation of those, and developments in current and future tax audits, could significantly impact the amounts provided for income taxes in our results of operations, financial position, or cash flows.

The assessment of tax effects of our uncertain tax positions in our financial statements involves significant judgment in interpreting complex and ambiguous tax laws, regulations, and administrative practices, determining the probability of various possible settlement outcomes, evaluating the litigation process based on tax authority behaviors in similar cases, and estimating the likelihood that another taxing authority could review the respective tax position. These judgments are inherently challenging and subjective because a taxing authority may change its behavior at any time. We must also determine when it is reasonably possible that the amount of unrecognized tax benefits will significantly increase or decrease in the 12 months after each fiscal year-end. We reevaluate our income tax positions on a quarterly basis to consider factors such as changes in facts or circumstances, changes in tax laws, effectively settled issues under audit, the potential for interest and penalties, and new audit activity. Such a change in recognition or measurement would result in recognition of a tax benefit or an additional charge to the tax provision that could be material in the future.

Stock-Based Compensation

We recognize the fair value of our employee stock options and restricted stock units, including performance-based restricted stock units, over the requisite service period. The fair value of each stock option is estimated on date of grant using the Black-Scholes-Merton option pricing model. Determining the appropriate fair value model and calculating the fair value of employee stock options requires the use of subjective assumptions, including the expected life of the stock option and stock price volatility. The recognition of expenses for performance based restricted stock units requires us to estimate the probability that the performance condition will be achieved and the number of awards that will vest are adjusted accordingly at each reporting period. The assumptions used in calculating the fair value of employee stock options and estimating the probability of achievement of performance metrics represent management’s best estimates, which require significant judgment and involve inherent uncertainties. If factors change and we use different assumptions, our stock-based compensation expense could be materially different in the future.

Item 7. Management's Discussion and Analysis of Financial Condition and Results of Operations

You should read the following discussion in conjunction with our consolidated financial statements and the related notes included elsewhere in this Annual Report on Form 10-K. You should carefully review and consider the information regarding our financial condition and results of operations set forth under Part I-Item 7 (Management’s Discussion and Analysis of Financial Condition and Results of Operations) in our Annual Report on Form 10-K for the fiscal year ended December 31, 2021, filed with the SEC on February 22, 2022, for an understanding of our results of operations and liquidity discussions and analysis comparing fiscal year 2021 to fiscal year 2020, which information is hereby incorporated by reference. In addition to historical information, this discussion contains forward-looking statements that involve risks and uncertainties that could cause our actual results to differ materially from our expectations, as discussed in "Forward-Looking Statements" in Part I of this Annual Report on Form 10-K. Factors that could cause such differences include, but are not limited to, those described in the section titled "Risk Factors" and elsewhere in this Annual Report on Form 10-K.

Overview

We are a pioneer and leading provider of a cloud-based platform delivering IT, security and compliance solutions that enable organizations to identify security risks to their IT infrastructures, help protect their IT systems and applications from ever-evolving cyber-attacks and achieve compliance with internal policies and external regulations. Our cloud solutions address the growing security and compliance complexities and risks that are amplified by the dissolving boundaries between internal and external IT infrastructures and web environments, the rapid adoption of cloud computing, containers and serverless IT models, and the proliferation of geographically dispersed IT assets. Our integrated suite of IT, security and compliance solutions delivered on our Qualys Cloud Platform enables our customers to identify and manage their IT assets, collect and analyze large amounts of IT security data, discover and prioritize vulnerabilities, recommend and implement remediation actions and verify the implementation of such actions. Organizations use our integrated suite of solutions to cost-effectively obtain a unified view of their IT asset inventory as well as security and compliance posture across globally-distributed IT infrastructures as our solution offers a single platform for information technology, information security, application security, endpoint, developer security and cloud teams.

We were founded and incorporated in December 1999 with a vision of transforming the way organizations secure and protect their IT infrastructure and applications and initially launched our first cloud solution, Vulnerability Management (VM), in 2000. As VM gained acceptance, we introduced additional solutions to help customers manage increasing IT, security and compliance requirements. Today, the suite of solutions that we offer on our cloud platform and refer to as the Qualys Cloud Apps helps our customers protect a range of assets across on-premises, endpoints, cloud, containers, and mobile environments. These Cloud Apps address and include:

We provide our solutions through a software-as-a-service model, primarily with renewable annual subscriptions. These subscriptions require customers to pay a fee in order to access each of our cloud solutions. We generally invoice our customers for the entire subscription amount at the start of the subscription term, and the invoiced amounts are treated as deferred revenues and are recognized ratably over the term of each subscription. We continue to experience revenue growth from our existing customers as they renew and purchase additional subscriptions, as well as from the addition of new customers to our cloud platform.

We market and sell our solutions to enterprises, government entities and small and medium-sized businesses across a broad range of industries, including education, financial services, government, healthcare, insurance, manufacturing, media, retail, technology and utilities. In 2022, 2021 and 2020, 60%, 61% and 63%, respectively, of our revenues were derived from customers in the United States based on our customers' billing addresses. We sell our solutions to enterprises and government entities primarily through our field sales force and to small and medium-sized businesses through our inside sales force. We generate a significant portion of sales through our channel partners, including managed security service providers, value-added resellers and consulting firms in the United States and internationally.

40

Table of Contents

Impacts of Current Macroeconomic Environment

The uncertainty surrounding macroeconomic factors in the U.S. and globally characterized by COVID-19, the supply chain environment, inflationary pressure, rising interest rates, labor shortages, significant volatility of global markets and geopolitical conflicts have had and could in the future have a material adverse effect on our long-term business and could lead to further economic disruption and expose us to greater risk as our current and potential customers may reduce or eliminate their overall spending on IT security. We will continue to evaluate the nature and extent of the impact to our business, financial position, results of operations and cash flows.

Key Components of Results of Operations

Revenues

We derive revenues from the sale of subscriptions to our IT, security and compliance solutions, which are delivered on our cloud platform. Subscriptions to our solutions allow customers to access our cloud-based IT, security and compliance solutions through a unified, web-based interface. Customers generally enter into one-year renewable subscriptions. The subscription fee entitles the customer to an unlimited number of scans for a specified number of devices or web applications and, if requested by a customer as part of their subscription, a specified number of physical or virtual scanner appliances. Our physical and virtual scanner appliances are requested by certain customers as part of their subscriptions in order to scan IT infrastructures within their firewalls and do not function without, and are not sold separately from, subscriptions for our solutions. In some cases, we also provide certain computer equipment used to extend our Qualys Cloud Platform into our customers' private cloud environment. Customers are required to return physical scanner appliances and computer equipment if they do not renew their subscriptions.

We typically invoice our customers for the entire subscription amount at the start of the subscription term. Invoiced amounts are reflected on our consolidated balance sheets as accounts receivable or as cash when collected, and as deferred revenues until earned and recognized ratably over the subscription period. Accordingly, deferred revenues represent the amount billed to customers that has not yet been earned or recognized as revenues, pursuant to subscriptions entered into in current and prior periods.

Cost of Revenues

Cost of revenues consists primarily of personnel expenses, comprised of salaries, benefits, performance-based compensation and stock-based compensation, for employees who operate our shared cloud platforms and provide support services to our customers. Other expenses include depreciation of shared cloud platform equipment, physical scanner appliances and computer hardware provided to certain customers as part of their subscriptions, expenses related to the use of third-party shared cloud platforms and cloud infrastructures, amortization of software and license fees, amortization of intangibles related to acquisitions, maintenance support, fees paid to contractors who supplement or support our operations center personnel and overhead allocations. We expect to continue to make capital investments to expand and support our shared cloud platform and cloud infrastructure operations, which will increase the cost of revenues in absolute dollars.

Operating Expenses

Research and Development

Research and development expenses consist primarily of personnel expenses, comprised of salaries, benefits, performance-based compensation and stock-based compensation, for our research and development teams. Other expenses include third-party contractor fees, software and license fees, amortization of intangibles related to acquisitions and overhead allocations. We expect to continue to devote resources to research and development in an effort to continuously improve our existing solutions as well as develop new solutions and capabilities and expect that research and development expenses will increase in absolute dollars.

41

Table of Contents

Sales and Marketing

Sales and marketing expenses consist primarily of personnel expenses, comprised of salaries, benefits, sales commissions, performance-based compensation and stock-based compensation for our worldwide sales and marketing teams. Other expenses include marketing and promotional events, lead-generation marketing programs, public relations, travel, software licenses and overhead allocations. Sales commissions related to new business and upsells are capitalized as an asset. We amortize the capitalized commission cost as a selling expense on a straight-line basis over a period of five years. We expense sales commissions related to contract renewals as incurred. Our new sales personnel are typically not immediately productive, and the resulting increase in sales and marketing expenses we incur when we add new personnel may not result in increased revenues if these new sales personnel fail to become productive. The timing of our hiring of sales personnel, or the participation in new marketing events or programs, and the rate at which these generate incremental revenues, may affect our future operating results. We expect to continue to invest in additional sales personnel worldwide and also in more marketing programs to support new solutions on our platform, which will increase sales and marketing expenses in absolute dollars.

General and Administrative

General and administrative expenses consist primarily of personnel expenses, comprised of salaries, benefits, performance-based compensation and stock-based compensation for our executive, finance and accounting, IT, legal and human resources teams, as well as professional services, fees, software licenses and overhead allocations. We expect that general and administrative expenses will increase in absolute dollars, as we continue to add personnel and incur professional services to support our growth and compliance with legal requirements.

Other Income (Expense), Net

Our other income (expense), net consists primarily of interest and investment income from our short-term and long-term marketable securities and foreign exchange gains and losses, the majority of which result from fluctuations between the U.S. Dollar and the Euro, British Pound ("GBP") and Indian Rupee ("INR").

Income Tax Provision

We are subject to federal, state and foreign income taxes for jurisdictions in which we operate, and we use estimates in determining our income tax provision and deferred tax assets. Earnings from our non-U.S. activities are subject to income taxes in the local countries at rates which were generally similar to the U.S. statutory tax rate.

42

Table of Contents

Results of Operations

The following table sets forth selected consolidated statements of operations data for each of the periods presented as a percentage of revenues:

Comparison of Years Ended December 31, 2022 and 2021

Revenues

Revenues increased by $78.6 million in 2022 compared to 2021, driven by increased demand for our subscription services by our end customers. Of the total increase of $78.6 million in revenue from 2021 to 2022, 80% was from revenues from customers existing at or prior to December 31, 2021, and the remaining 20% was from new customers added in 2022. Of the total increase of $78.6 million, 51% was from customers in the United States and the remaining 49% was from customers in foreign countries. In 2022, 58% of total revenue was direct and 42% of total revenue was through partners. Of the total increase of $78.6 million, 53% was direct and the remaining 47% was from partners. With our strong market position driving further demand for our solutions, we expect revenue growth from new and existing customers to continue.

43

Table of Contents

Cost of Revenues

Cost of revenues increased by $13.3 million in 2022 compared to 2021, due to an increase in personnel costs of $9.5 million driven by additional employees hired to support the growth of our business, an increase in shared cloud platform and cloud costs of $2.0 million to meet growing demand and an increase in software license cost of $1.8 million.

Research and Development Expenses

Research and development expenses increased by $19.9 million in 2022 compared to 2021, due to an increase in personnel costs of $18.3 million primarily driven by additional employees hired to support the growth of our business, an increase in software license cost of $1.0 million and an increase in travel and entertainment expense of $0.6 million due to easing of COVID-19 related travel restrictions.

Sales and Marketing Expenses

Sales and marketing expenses increased by $20.7 million in 2022 compared to 2021, due to an increase in personnel costs of $9.9 million driven by additional employees hired to support the growth of our business, an increase in trade show and other advertising related costs of $5.7 million, an increase of consulting expense of $2.3 million, an increase of travel and entertainment expense of $1.8 million associated with the easing of COVID-19 related travel restrictions and an increase in software license cost of $1.0 million.

44

Table of Contents

General and Administrative Expenses

General and administrative expenses decreased by $18.3 million in 2022 compared to 2021, due to a decrease in stock-based compensation expense of $27.3 million related to accelerated vesting of our former chief executive officer's grants upon termination due to disability in 2021, offset by an increase in personnel costs of $3.8 million driven by additional employees hired to support the growth of our business, an increase in software license cost of $1.0 million, an increase in consulting expense of $1.9 million, an increase in legal accrual of $1.5 million and an increase of travel and entertainment expense of $0.8 million associated with the easing of COVID-19 related travel restrictions.

Total other income, net

Total other income, net increased by $1.4 million in 2022 compared to 2021, due to an increase in interest income of $2.9 million driven by continued interest rate increase in 2022, offset by an increase in foreign exchange loss of $1.5 million.

Income tax provision

Income tax provision increased by $7.3 million in 2022 compared to 2021, primarily due to an increase in pre-tax income and the effects of a tax law change related to mandatory capitalization of research and development expenses starting January 1, 2022, offset by an increase in excess tax benefits arising from stock-based compensation.

45

Table of Contents

Key Operating and Non-GAAP Financial Performance Metrics

In addition to measures of financial performance presented in our consolidated financial statements, we monitor the key metrics set forth below to help us evaluate growth trends, establish budgets, measure the effectiveness of our sales and marketing efforts and assess operational efficiencies.

Net Dollar Expansion Rate

We evaluate our ability to retain and grow existing customers by assessing our net dollar expansion rate on a last twelve months, or LTM, basis. This metric is used to appropriately manage resources and customer retention and expansion. We calculate the net dollar expansion rate on a foreign exchange neutral basis by dividing a numerator by a denominator, each defined as follows:

Denominator: To calculate our net dollar expansion rate as of the end of a reporting period, we first determine the annual recurring revenue, or ARR, from all active subscriptions as of the last day of the same reporting period in the prior year. This represents recurring payments that we expect to receive in the next 12-month period from the cohort of customers that existed on the last day of the same reporting period in the prior year.

Numerator: We measure the ARR for that same cohort of customers representing all active subscriptions as of the end of the reporting period, using the same foreign exchange rate from the prior year.

Our net dollar expansion rates were 109% and 108% for the years ended December 31, 2022 and 2021, respectively.

Adjusted EBITDA

We monitor Adjusted EBITDA, a non-GAAP financial measure, to analyze our financial results and believe that it is useful to investors, as a supplement to U.S. GAAP measures, in evaluating our ongoing operational performance and enhancing an overall understanding of our past financial performance. We believe that Adjusted EBITDA helps illustrate underlying trends in our business that could otherwise be masked by the effect of the income or expenses that we exclude in Adjusted EBITDA. Furthermore, we use this measure to establish budgets and operational goals for managing our business and evaluating our performance. We also believe that Adjusted EBITDA provides an additional tool for investors to use in comparing our recurring core business operating results over multiple periods with other companies in our industry.

Adjusted EBITDA should not be considered in isolation from, or as a substitute for, financial information prepared in accordance with U.S. GAAP. We calculate Adjusted EBITDA as net income before (1) other (income) expense, net, which includes interest income, interest expense and other income and expense, (2) income tax provision (benefit), (3) depreciation and amortization of property and equipment, (4) amortization of intangible assets, (5) stock-based compensation and (6) non-recurring expenses that do not reflect ongoing costs of operating the business.

Adjusted EBITDA has limitations as an analytical tool and should not be considered in isolation from or as a substitute for the measures presented in accordance with U.S. GAAP. Some of these limitations are:

Because of these limitations, Adjusted EBITDA should be considered alongside other financial performance measures, including revenues, net income, cash flows from operating activities and our financial results presented in accordance with U.S. GAAP.

The following unaudited table presents the reconciliation of net income to Adjusted EBITDA for the years ended December 31, 2022 and 2021.

46

Table of Contents

Liquidity and Capital Resources

As of December 31, 2022, our principal source of liquidity was cash, cash equivalents and marketable securities of $380.5 million, including $52.7 million of cash held outside of the United States. The following summary of cash flows for the periods indicated has been derived from our consolidated financial statements included elsewhere in this report:

Operating Activities

In 2022, we generated $177.2 million of cash from our net income, as adjusted for non-cash items mainly related to stock-based compensation expense, depreciation and amortization expense and deferred taxes, as compared to $169.6 million in 2021. In addition, we also generated $21.7 million of cash from working capital change in 2022, of which $11.8 million was related to net increase in deferred revenue and accounts receivable as a result of our continued growth in billing and collection, and $9.9 million was due to lower prepaid expenses and an increase in payables and accrued liabilities in line with our business. In 2021, we generated $31.0 million of cash from working capital change, of which $37.4 million was related to net increase in deferred revenue and accounts receivable as a result of our continued growth in billing and collection, partially offset by higher prepaid income taxes of $6.9 million.

Net cash taxes paid, excluding prepaid income taxes, during 2022 were approximately $20.0 million higher compared to 2021, primarily due to the new tax law requiring mandatory capitalization and amortization of research and development expenses effective January 1, 2022. Previously, these expenses could be deducted in the year incurred. The near term increase in cash tax will be offset by a decrease in cash taxes in future years when the capitalized expenses are amortized for tax purposes.

Investing Activities

In 2022, we generated $169.0 million of cash in marketable securities investment, used $15.4 million of cash in capital expenditures mainly related to computer equipment to support our growth and development and $8.6 million of cash to acquire certain technology assets, as compared to $4.5 million of cash used in marketable securities investment, $24.4 million of cash used in capital expenditures and $1.1 million of cash used for acquisition of technology assets in 2021.

Financing Activities

In 2022, we used $317.3 million of cash for share repurchase and $17.6 million of cash in payment of employee withholding taxes upon vesting of restricted stock units and received $24.5 million of proceeds from employee exercise of stock options, as compared to $130.0 million of cash used for share repurchase, $27.8 million of cash used in payment of employee withholding taxes upon vesting of restricted stock units and $50.0 million of cash received from employee exercise of stock options in 2021. Net cash used in financing activities are expected to be lower in 2023 due to expected lower volume of share repurchase.

We believe our existing cash and cash equivalents, marketable securities and our expected cash flow generated from operations will be sufficient to fund our operations for the next twelve months and beyond. We do not anticipate that we will need funds generated from foreign operations to fund our domestic operations. However, if we repatriate these funds, we could be subject to foreign withholding taxes.

Our material cash requirements mainly include the following contractual and other obligations:

We expect to continue to use cash to repurchase shares in 2023 under our share repurchase program authorized by our board of directors on February 5, 2018. As of December 31, 2022, our board of directors had authorized an aggregate amount of $900.0 million for repurchases under our share repurchase program, of which approximately $154.5 million remained available. Shares will be repurchased from time to time on the open market in accordance with Rule 10b-18 of the Exchange Act of 1934, including pursuant to a pre-set trading plan adopted in accordance with Rule 10b5-1 under the Exchange Act.

On February 9, 2023, we announced that its Board of Directors authorized the repurchase of an additional $100.0 million under our share repurchase program, increasing the total amount of authorized repurchase to $1.0 billion.

47

Table of Contents

Critical Accounting Estimates

The preparation of our consolidated financial statements in accordance with U.S. GAAP requires us to make estimates and assumptions that affect the reported amounts of assets, liabilities, revenues, expenses and related disclosures. Our significant accounting policies are described in Note 1 - The Company and Summary of Significant Accounting Policies in the accompanying notes to the consolidated financial statements included in Part II, Item 8, "Financial Statements and Supplementary Data" of this Annual Report on Form 10-K. On an ongoing basis, we evaluate our estimates and assumptions based on historical and anticipated results and trends that we believe represent our best estimate under the circumstances. However, as accounting estimates are subject to inherent uncertainty, our actual results may differ from these estimates under different assumptions or conditions.

Income Taxes

Significant assumptions, judgments and estimates are involved in determining our provision for (benefit from) income taxes, our deferred tax assets and liabilities, and any valuation allowance to be recorded against our deferred tax assets. Our judgments, assumptions and estimates relating to the current provision for income taxes include the geographic mix and amount of income (loss), expectations of future income, our interpretation of current tax laws, our business, and possible outcomes of current and future audits conducted by foreign and domestic tax authorities. Our judgments also include anticipating the tax positions we will record in the financial statements before preparing and filing the tax returns. Our estimates and assumptions may differ from the actual results as reflected in our income tax returns and we record the required adjustments when they are identified or resolved. Changes in our business and tax laws or our interpretation of those, and developments in current and future tax audits, could significantly impact the amounts provided for income taxes in our results of operations, financial position, or cash flows.

The assessment of tax effects of our uncertain tax positions in our financial statements involves significant judgment in interpreting complex and ambiguous tax laws, regulations, and administrative practices, determining the probability of various possible settlement outcomes, evaluating the litigation process based on tax authority behaviors in similar cases, and estimating the likelihood that another taxing authority could review the respective tax position. These judgments are inherently challenging and subjective because a taxing authority may change its behavior at any time. We must also determine when it is reasonably possible that the amount of unrecognized tax benefits will significantly increase or decrease in the 12 months after each fiscal year-end. We reevaluate our income tax positions on a quarterly basis to consider factors such as changes in facts or circumstances, changes in tax laws, effectively settled issues under audit, the potential for interest and penalties, and new audit activity. Such a change in recognition or measurement would result in recognition of a tax benefit or an additional charge to the tax provision that could be material in the future.

Stock-Based Compensation

We recognize the fair value of our employee stock options and restricted stock units, including performance-based restricted stock units, over the requisite service period. The fair value of each stock option is estimated on date of grant using the Black-Scholes-Merton option pricing model. Determining the appropriate fair value model and calculating the fair value of employee stock options requires the use of subjective assumptions, including the expected life of the stock option and stock price volatility. The recognition of expenses for performance based restricted stock units requires us to estimate the probability that the performance condition will be achieved and the number of awards that will vest are adjusted accordingly at each reporting period. The assumptions used in calculating the fair value of employee stock options and estimating the probability of achievement of performance metrics represent management’s best estimates, which require significant judgment and involve inherent uncertainties. If factors change and we use different assumptions, our stock-based compensation expense could be materially different in the future.

Item 7. Management's Discussion and Analysis of Financial Condition and Results of Operations

You should read the following discussion in conjunction with our consolidated financial statements and the related notes included elsewhere in this Annual Report on Form 10-K. You should carefully review and consider the information regarding our financial condition and results of operations set forth under Part I-Item 7 (Management’s Discussion and Analysis of Financial Condition and Results of Operations) in our Annual Report on Form 10-K for the fiscal year ended December 31, 2020, filed with the SEC on February 22, 2021, for an understanding of our results of operations and liquidity discussions and analysis comparing fiscal year 2020 to fiscal year 2019. In addition to historical information, this discussion contains forward-looking statements that involve risks and uncertainties that could cause our actual results to differ materially from our expectations, as discussed in "Forward-Looking Statements" in Part I of this Annual Report on Form 10-K. Factors that could cause such differences include, but are not limited to, those described in the section titled "Risk Factors" and elsewhere in this Annual Report on Form 10-K.

Overview

We are a pioneer and leading provider of a cloud-based platform delivering IT, security and compliance solutions that enable organizations to identify security risks to their IT infrastructures, help protect their IT systems and applications from ever-evolving cyber-attacks and achieve compliance with internal policies and external regulations. Our cloud solutions address the growing security and compliance complexities and risks that are amplified by the dissolving boundaries between internal and external IT infrastructures and web environments, the rapid adoption of cloud computing, containers and serverless IT models, and the proliferation of geographically dispersed IT assets. Our integrated suite of IT, security and compliance solutions delivered on our Qualys Cloud Platform enables our customers to identify and manage their IT assets, collect and analyze large amounts of IT security data, discover and prioritize vulnerabilities, recommend and implement remediation actions and verify the implementation of such actions. Organizations use our integrated suite of solutions to cost-effectively obtain a unified view of their IT asset inventory as well as security and compliance posture across globally-distributed IT infrastructures as our solution offers a single platform for information technology, information security, application security, endpoint, developer security and cloud teams.

We were founded and incorporated in December 1999 with a vision of transforming the way organizations secure and protect their IT infrastructure and applications and initially launched our first cloud solution, Vulnerability Management (VM), in 2000. As VM gained acceptance, we introduced additional solutions to help customers manage increasing IT, security and compliance requirements. Today, the suite of solutions that we offer on our cloud platform and refer to as the Qualys Cloud Apps helps our customers protect a range of assets across on-premises, endpoints, cloud, containers, and mobile environments. These Cloud Apps address and include:

We provide our solutions through a software-as-a-service model, primarily with renewable annual subscriptions. These subscriptions require customers to pay a fee in order to access each of our cloud solutions. We generally invoice our customers for the entire subscription amount at the start of the subscription term, and the invoiced amounts are treated as deferred revenues and are recognized ratably over the term of each subscription. We continue to experience revenue growth from our existing customers as they renew and purchase additional subscriptions, as well as from the addition of new customers to our cloud platform.

We market and sell our solutions to enterprises, government entities and small and medium-sized businesses across a broad range of industries, including education, financial services, government, healthcare, insurance, manufacturing, media, retail, technology and utilities. In 2021, 2020 and 2019, 61%, 63% and 64%, respectively, of our revenues were derived from customers in the United States based on our customers' billing addresses. We sell our solutions to enterprises and government entities primarily through our field sales force and to small and medium-sized businesses through our inside sales force. We generate a significant portion of sales through our channel partners, including managed security service providers, value-added resellers and consulting firms in the United States and internationally.

39

Table of Contents

Impacts of COVID-19

In March 2020, the World Health Organization declared the outbreak of COVID-19 as a pandemic. As a result of COVID-19, we have modified certain aspects of our business, including restricting employee travel, requiring employees to work from home, and canceling certain events and meetings, among other modifications. We will continue to actively monitor the situation and may take further actions that alter our business operations as may be required by federal, state or local authorities or that we determine are in the best interests of our employees, customers, partners, suppliers and stockholders. While we have not incurred significant disruptions from the COVID-19 pandemic, we are unable to accurately predict the full impact that the pandemic will have due to numerous uncertainties, including the availability and acceptance of COVID-19 vaccines as well as the effectiveness of the vaccines to new variants of the disease, future actions that may be taken by governmental authorities and the impact of the pandemic on the businesses of our customers and partners. We will continue to evaluate the nature and extent of the impact to our business, financial position, results of operations and cash flows.

Key Components of Results of Operations

Revenues

We derive revenues from the sale of subscriptions to our IT, security and compliance solutions, which are delivered on our cloud platform. Subscriptions to our solutions allow customers to access our cloud-based IT, security and compliance solutions through a unified, web-based interface. Customers generally enter into one-year renewable subscriptions. The subscription fee entitles the customer to an unlimited number of scans for a specified number of devices or web applications and, if requested by a customer as part of their subscription, a specified number of physical or virtual scanner appliances. Our physical and virtual scanner appliances are requested by certain customers as part of their subscriptions in order to scan IT infrastructures within their firewalls and do not function without, and are not sold separately from, subscriptions for our solutions. In some cases, we also provide certain computer equipment used to extend our Qualys Cloud Platform into our customers' private cloud environment. Customers are required to return physical scanner appliances and computer equipment if they do not renew their subscriptions.

We typically invoice our customers for the entire subscription amount at the start of the subscription term. Invoiced amounts are reflected on our consolidated balance sheets as accounts receivable or as cash when collected, and as deferred revenues until earned and recognized ratably over the subscription period. Accordingly, deferred revenues represent the amount billed to customers that has not yet been earned or recognized as revenues, pursuant to subscriptions entered into in current and prior periods.

Cost of Revenues

Cost of revenues consists primarily of personnel expenses, comprised of salaries, benefits, performance-based compensation and stock-based compensation, for employees who operate our data centers and provide support services to our customers. Other expenses include depreciation of data center equipment, physical scanner appliances and computer hardware provided to certain customers as part of their subscriptions, expenses related to the use of third-party data centers and cloud infrastructures, amortization of software and license fees, amortization of intangibles related to acquisitions, maintenance support, fees paid to contractors who supplement or support our operations center personnel and overhead allocations. We expect to continue to make capital investments to expand and support our data center and cloud infrastructure operations, which will increase the cost of revenues in absolute dollars.

Operating Expenses

Research and Development

Research and development expenses consist primarily of personnel expenses, comprised of salaries, benefits, performance-based compensation and stock-based compensation, for our research and development teams. Other expenses include third-party contractor fees, software and license fees, amortization of intangibles related to acquisitions and overhead allocations.

40

Table of Contents

Sales and Marketing

Sales and marketing expenses consist primarily of personnel expenses, comprised of salaries, benefits, sales commissions, performance-based compensation and stock-based compensation for our worldwide sales and marketing teams. Other expenses include marketing and promotional events, lead-generation marketing programs, public relations, travel, software licenses and overhead allocations. Sales commissions related to new business and upsells are capitalized as an asset. We amortize the capitalized commission cost as a selling expense on a straight-line basis over a period of five years. We expense sales commissions related to contract renewals as incurred. Our new sales personnel are typically not immediately productive, and the resulting increase in sales and marketing expenses we incur when we add new personnel may not result in increased revenues if these new sales personnel fail to become productive. The timing of our hiring of sales personnel, or the participation in new marketing events or programs, and the rate at which these generate incremental revenues, may affect our future operating results. We expect to continue to significantly invest in additional sales personnel worldwide and also in more marketing programs to support new solutions on our platform, which will increase sales and marketing expenses in absolute dollars.

General and Administrative

General and administrative expenses consist primarily of personnel expenses, comprised of salaries, benefits, performance-based compensation and stock-based compensation for our executive, finance and accounting, IT, legal and human resources teams, as well as professional services, fees, software licenses and overhead allocations. We expect that general and administrative expenses will increase in absolute dollars, as we continue to add personnel and incur professional services to support our growth and compliance with legal requirements.

Other Income (Expense), Net

Our other income (expense), net consists primarily of interest and investment income from our short-term and long-term marketable securities and foreign exchange gains and losses, the majority of which result from fluctuations between the U.S. Dollar and the Euro, British Pound ("GBP") and Indian Rupee ("INR").

Income Tax Provision

We are subject to federal, state and foreign income taxes for jurisdictions in which we operate, and we use estimates in determining our income tax provision and deferred tax assets. Earnings from our non-U.S. activities are subject to income taxes in the local countries at rates which were generally similar to the U.S. statutory tax rate.

41

Table of Contents

Results of Operations

The following table sets forth selected consolidated statements of operations data for each of the periods presented as a percentage of revenues:

Comparison of Years Ended December 31, 2021 and 2020

Revenues

Revenues increased by $48.2 million in 2021 compared to 2020, due to an increase in IT Security, Compliance, Web Application Security, Asset Management and Cloud and Container Security subscriptions. The revenue growth was primarily from an increase in renewal and expansion business in 2021 compared to 2020. Of the total increase of $48.2 million, $20.3 million was from customers in the United States and the remaining $27.9 million was from customers in foreign countries. In 2021, 59% of total revenue was direct and 41% of total revenue was through partners. Of the total increase of $48.2 million, $30.4 million was direct and $17.8 million was from partners. With our strong market position driving further demand for our solutions, we expect revenue growth from new and existing customers to continue.

42

Table of Contents

Cost of Revenues

Cost of revenues increased by $10.2 million in 2021 compared to 2020, due to an increase in personnel costs of $6.3 million driven by additional employees hired to support the growth of our business, an increase in data center and cloud costs of $2.0 million to meet growing demand and an increase in depreciation and amortization expense of $1.5 million as more computer equipment was placed in service.

Research and Development Expenses

Research and development expenses increased by $8.7 million in 2021 compared to 2020, due to an increase in personnel costs of $5.5 million primarily driven by additional employees hired to support the growth of our business, an increase in software costs of $1.0 million, an increase in professional services fees of $0.9 million, an increase in data center and cloud costs of $0.8 million for our ongoing research and development efforts and an increase in depreciation and amortization expense of $0.7 million as more computer equipment was placed in service.

Sales and Marketing Expenses

Sales and marketing expenses increased by $8.5 million in 2021 compared to 2020, due to an increase in commissions of $3.4 million driven by higher revenues, an increase in personnel costs of $2.8 million driven by additional employees hired to support the growth of our business, an increase in travel and trade show related costs of $1.1 million associated with the easing of COVID-19 related travel restrictions and an increase in license and subscription costs of $0.8 million.

43

Table of Contents

General and Administrative Expenses

General and administrative expenses increased by $29.7 million in 2021 compared to 2020, due to an increase in stock-based compensation expense of $28.7 million primarily driven by accelerated vesting relating to the resignation of our former chief executive officer and an increase in personnel costs of $1.6 million driven by additional employees hired to support the growth of our business.

Total other income, net

Total other income, net decreased by $3.7 million in 2021 compared to 2020, due to a decrease in interest income of $3.1 million driven by lower yield and an increase in foreign exchange loss of $0.6 million.

Income tax provision

Income tax provision increased by $8.0 million in 2021 compared to 2020, due to a reduction in excess tax benefits from stock-based compensation and an increase in income after permanent tax adjustments related to the former CEO’s accelerated stock-based compensation.

44

Table of Contents

Key Non-GAAP Metric

In addition to measures of financial performance presented in our consolidated financial statements, we monitor the non-GAAP key metric set forth below to help us evaluate growth trends, establish budgets, measure the effectiveness of our sales and marketing efforts and assess operational efficiencies.

Adjusted EBITDA

We monitor Adjusted EBITDA, a non-GAAP financial measure, to analyze our financial results and believe that it is useful to investors, as a supplement to U.S. GAAP measures, in evaluating our ongoing operational performance and enhancing an overall understanding of our past financial performance. We believe that Adjusted EBITDA helps illustrate underlying trends in our business that could otherwise be masked by the effect of the income or expenses that we exclude in Adjusted EBITDA. Furthermore, we use this measure to establish budgets and operational goals for managing our business and evaluating our performance. We also believe that Adjusted EBITDA provides an additional tool for investors to use in comparing our recurring core business operating results over multiple periods with other companies in our industry.

Adjusted EBITDA should not be considered in isolation from, or as a substitute for, financial information prepared in accordance with U.S. GAAP. We calculate Adjusted EBITDA as net income before (1) other (income) expense, net, which includes interest income, interest expense and other income and expense, (2) income tax provision (benefit), (3) depreciation and amortization of property and equipment, (4) amortization of intangible assets, (5) stock-based compensation and (6) non-recurring expenses that do not reflect ongoing costs of operating the business.

Adjusted EBITDA has limitations as an analytical tool and should not be considered in isolation from or as a substitute for the measures presented in accordance with U.S. GAAP. Some of these limitations are:

Because of these limitations, Adjusted EBITDA should be considered alongside other financial performance measures, including revenues, net income, cash flows from operating activities and our financial results presented in accordance with U.S. GAAP.

The following unaudited table presents the reconciliation of net income to Adjusted EBITDA for the years ended December 31, 2021 and 2020.

45

Table of Contents

Liquidity and Capital Resources

As of December 31, 2021, our principal source of liquidity was cash, cash equivalents and marketable securities of $516.5 million, including $57.0 million of cash held outside of the United States. The following summary of cash flows for the periods indicated has been derived from our consolidated financial statements included elsewhere in this report:

Operating Activities

In 2021, we generated $169.6 million of cash from our net income, as adjusted for non-cash items mainly related to stock-based compensation expense, depreciation and amortization expense and deferred taxes, as compared to $169.4 million in 2020. In addition, we also generated $31.0 million of cash from working capital change in 2021, of which $37.4 million was related to net increase in deferred revenue and accounts receivable as a result of our continued growth in billing and collection, partially offset by higher prepaid income taxes of $6.9 million. In 2020, we generated $10.7 million of cash from working capital change, which was also mainly related to deferred revenue and accounts receivable due to continued growth in billing and collection.

Investing Activities

In 2021, we used $4.5 million of cash in marketable securities investment, $24.4 million of cash in capital expenditures mainly related to computer equipment to support our growth and development and $1.1 million of cash to acquire certain technology assets, as compared to $49.8 million of cash used in marketable securities investment, $29.6 million of cash used in capital expenditures and $1.5 million of cash used for acquisition of technology assets in 2020.

Financing Activities

In 2021, we used $130.0 million of cash for share repurchase and $27.8 million of cash in payment of employee withholding taxes upon vesting of restricted stock units and received $50.0 million of proceeds from employee exercise of stock options, as compared to $126.7 million of cash used for share repurchase, $20.2 million of cash used in payment of employee withholding taxes upon vesting of restricted stock units and $34.5 million of cash received from employee exercise of stock options in 2020. Net cash used in financing activities are expected to be higher in 2022 due to expected higher volume of share repurchase and lower cash receipt from stock option exercise, mainly due to the resignation of our former CEO.

We believe our existing cash and cash equivalents, marketable securities and our expected cash flow generated from operations will be sufficient to fund our operations for the next twelve months and beyond. We do not anticipate that we will need funds generated from foreign operations to fund our domestic operations. However, if we repatriate these funds, we could be subject to foreign withholding taxes.

Our material cash requirements mainly include the following contractual and other obligations:

We expect to continue to use cash to repurchase shares in 2022 under our share repurchase program authorized by our board of directors on February 5, 2018. As of December 31, 2021, our board of directors had authorized an aggregate amount of $700.0 million for repurchases under our share repurchase program, of which approximately $271.8 million remained available. Shares will be repurchased from time to time on the open market in accordance with Rule 10b-18 of the Exchange Act of 1934, including pursuant to a pre-set trading plan adopted in accordance with Rule 10b5-1 under the Exchange Act.

46

Table of Contents

Critical Accounting Estimates

The preparation of our consolidated financial statements in accordance with U.S. GAAP requires us to make estimates and assumptions that affect the reported amounts of assets, liabilities, revenues, expenses and related disclosures. Our significant accounting policies are described in Note 1 - The Company and Summary of Significant Accounting Policies in the accompanying notes to the consolidated financial statements included in Part II, Item 8, "Financial Statements and Supplementary Data" of this Annual Report on Form 10-K. On an ongoing basis, we evaluate our estimates and assumptions based on historical and anticipated results and trends that we believe represent our best estimate under the circumstances. However, as accounting estimates are subject to inherent uncertainty, our actual results may differ from these estimates under different assumptions or conditions.

Income Taxes

Significant assumptions, judgments and estimates are involved in determining our provision for (benefit from) income taxes, our deferred tax assets and liabilities, and any valuation allowance to be recorded against our deferred tax assets. Our judgments, assumptions and estimates relating to the current provision for income taxes include the geographic mix and amount of income (loss), our interpretation of current tax laws, and possible outcomes of current and future audits conducted by foreign and domestic tax authorities. Our judgments also include anticipating the tax positions we will record in the financial statements before preparing and filing the tax returns. Our estimates and assumptions may differ from the actual results as reflected in our income tax returns and we record the required adjustments when they are identified or resolved. Changes in our business and tax laws or our interpretation of those, and developments in current and future tax audits, could significantly impact the amounts provided for income taxes in our results of operations, financial position, or cash flows.

The assessment of tax effects of our uncertain tax positions in our financial statements involves significant judgment in interpreting complex and ambiguous tax laws, regulations, and administrative practices, determining the probability of various possible settlement outcomes, evaluating the litigation process based on tax authority behaviors in similar cases, and estimating the likelihood that another taxing authority could review the respective tax position. These judgments are inherently challenging and subjective because a taxing authority may change its behavior at any time. We must also determine when it is reasonably possible that the amount of unrecognized tax benefits will significantly increase or decrease in the 12 months after each fiscal year-end. We reevaluate our income tax positions on a quarterly basis to consider factors such as changes in facts or circumstances, changes in tax laws, effectively settled issues under audit, the potential for interest and penalties, and new audit activity. Such a change in recognition or measurement would result in recognition of a tax benefit or an additional charge to the tax provision.

Stock-Based Compensation

We recognize the fair value of our employee stock options and restricted stock units, including performance-based restricted stock units, over the requisite service period. The fair value of each stock option is estimated on date of grant using the Black-Scholes-Merton option pricing model. Determining the appropriate fair value model and calculating the fair value of employee stock options requires the use of subjective assumptions, including the expected life of the stock option and stock price volatility. The recognition of expenses for performance based restricted stock units requires us to estimate the probability that the performance condition will be achieved and the number of awards that will vest are adjusted accordingly at each reporting period. The assumptions used in calculating the fair value of employee stock options and estimating the probability of achievement of performance metrics represent management’s best estimates, which require significant judgment and involve inherent uncertainties. While not material to the current year, if factors change and we use different assumptions, our stock-based compensation expense could be materially different in the future.