QUALYS, INC. (QLYS) FY 2023 MD&A

Item 7.     Management's Discussion and Analysis of Financial Condition and Results of Operations

You should read the following discussion in conjunction with our consolidated financial statements and the related notes included elsewhere in this Annual Report on Form 10-K. You should carefully review and consider the information regarding our financial condition and results of operations set forth under Part II-Item 7 (Management’s Discussion and Analysis of Financial Condition and Results of Operations) in our Annual Report on Form 10-K for the fiscal year ended December 31, 2022, filed with the SEC on February 23, 2023, for an understanding of our results of operations and liquidity discussions and analysis comparing fiscal year 2022 to fiscal year 2021, which information is hereby incorporated by reference. In addition to historical information, this discussion contains forward-looking statements that involve risks and uncertainties that could cause our actual results to differ materially from our expectations, as discussed in "Forward-Looking Statements" in Part I of this Annual Report on Form 10-K. Factors that could cause such differences include, but are not limited to, those described in the section titled "Risk Factors" and elsewhere in this Annual Report on Form 10-K.

Overview

We are a pioneer and leading provider of a cloud-based platform delivering information technology (IT), security and compliance solutions that enable organizations to identify security risks to their IT infrastructures, help protect their IT systems and applications from ever-evolving cyber-attacks and achieve compliance with internal policies and external regulations. Our cloud platform address the growing security and compliance complexities and risks that are amplified by the dissolving boundaries between IT infrastructures and web environments, the rapid adoption of cloud computing, containers and serverless IT models, and the proliferation of geographically dispersed IT assets. Our integrated suite of IT, security and compliance solutions delivered on Qualys' Enterprise TruRisk Platform enables our customers to identify and manage their IT and operational technology (OT) assets, collect and analyze large amounts of IT security data, discover and prioritize vulnerabilities, quantify cyber risk exposure, recommend and implement remediation actions and verify the implementation of such actions. Organizations use our integrated suite of solutions to cost-effectively obtain a unified view of their internal and external IT and OT asset inventory as well as security and compliance posture across globally-distributed IT infrastructures as our solution offers a single platform for information technology, information security, application security, endpoint, developer security and cloud teams.

We were founded and incorporated in December 1999 with a vision of transforming the way organizations secure and protect their IT infrastructure and applications and initially launched our first cloud solution, Vulnerability Management (VM), in 2000. As VM gained acceptance, we introduced additional solutions to help customers manage increasing IT, security and compliance requirements. Today, the suite of solutions that we offer on our cloud platform and refer to as the Qualys Cloud Apps help our customers detect, measure, prioritize and remediate cyber risk spanning a range of assets across on-premises, endpoints, cloud, containers, and mobile environments.

We provide our solutions through a software-as-a-service model, primarily with renewable annual subscriptions. These subscriptions require customers to pay a fee in order to access each of our cloud solutions. We generally invoice our customers for the entire subscription amount at the start of the subscription term, and the invoiced amounts are treated as deferred revenues and are recognized ratably over the term of each subscription. We continue to experience revenue growth from our existing customers as they renew and purchase additional subscriptions, as well as from the addition of new customers to our cloud platform.

We market and sell our solutions to enterprises, government entities and small and medium-sized businesses across a broad range of industries, including education, financial services, government, healthcare, insurance, manufacturing, media, retail, technology and utilities. In 2023, 2022 and 2021, 60%, 60% and 61%, respectively, of our revenues were derived from customers in the United States based on our customers' billing addresses. We sell our solutions to enterprises and government entities primarily through our field sales force and to small and medium-sized businesses through our inside sales force. We generate a significant portion of sales through our channel partners, including managed security service providers, leading cloud providers, value-added resellers and consulting firms in the United States and internationally.

Impacts of Current Macroeconomic Environment

The uncertainty surrounding macroeconomic factors in the U.S. and globally characterized by the supply chain environment, inflationary pressure, rising interest rates, financial institution failures and associated uncertainty, labor shortages, significant volatility of global markets, reduced spending and extended sales cycles, and geopolitical conflicts could have a material adverse effect on our long-term business and could lead to further economic disruption and expose us to greater risk as our current and potential customers may reduce or eliminate their overall spending on IT security. We will continue to evaluate the nature and extent of the impact to our business, financial position, results of operations and cash flows.

43

Table of Contents

Key Components of Results of Operations

Revenues

We derive revenues from the sale of subscriptions to our IT, security and compliance solutions, which are delivered on our cloud platform. Subscriptions to our solutions allow customers to access our cloud-based IT, security and compliance solutions through a unified, web-based interface. Customers generally enter into one-year renewable subscriptions. The subscription fee entitles the customer to an unlimited number of scans for a specified number of devices or web applications and, if requested by a customer as part of their subscription, a specified number of physical or virtual scanner appliances. Our physical and virtual scanner appliances are requested by certain customers as part of their subscriptions in order to scan IT infrastructures within their firewalls and do not function without, and are not sold separately from, subscriptions for our solutions. In some cases, we also provide certain computer equipment used to extend our cloud platform into our customers' private cloud environment. Customers are required to return physical scanner appliances and computer equipment if they do not renew their subscriptions.

We typically invoice our customers for the entire subscription amount at the start of the subscription term. Invoiced amounts are reflected on our consolidated balance sheets as accounts receivable or as cash when collected, and as deferred revenues until earned and recognized ratably over the subscription period. Accordingly, deferred revenues represent the amount billed to customers that has not yet been earned or recognized as revenues, pursuant to subscriptions entered into in current and prior periods.

Cost of Revenues

Cost of revenues consists primarily of personnel expenses, comprised of salaries, benefits, performance-based compensation and stock-based compensation, for employees who operate our shared cloud platforms and provide support services to our customers. Other expenses include depreciation of shared cloud platform equipment, physical scanner appliances and computer hardware provided to certain customers as part of their subscriptions, expenses related to the use of shared cloud platforms, amortization of software and license fees, amortization of intangibles related to acquisitions, maintenance support, fees paid to contractors who supplement or support our operations center personnel and overhead allocations. We expect to continue to expand our shared cloud platform infrastructures and hire additional employees to support our operations, which will increase the cost of revenues in absolute dollars.

Operating Expenses

Research and Development

Research and development expenses consist primarily of personnel expenses, comprised of salaries, benefits, performance-based compensation and stock-based compensation, for our research and development teams. Other expenses include third-party contractor fees, software and license fees, amortization of intangibles related to acquisitions and overhead allocations. We expect to continue to devote resources to research and development in an effort to continuously improve our existing solutions as well as develop new solutions and capabilities and expect that research and development expenses will increase in absolute dollars.

Sales and Marketing

Sales and marketing expenses consist primarily of personnel expenses, comprised of salaries, benefits, sales commissions, performance-based compensation and stock-based compensation for our worldwide sales and marketing teams. Other expenses include marketing and promotional events, lead-generation marketing programs, public relations, travel, software licenses and overhead allocations. Sales commissions related to new business and upsells are capitalized as an asset. We amortize the capitalized commission cost as a selling expense on a straight-line basis over a period of five years. We expense sales commissions related to contract renewals as incurred. Our new sales personnel are typically not immediately productive, and the resulting increase in sales and marketing expenses we incur when we add new personnel may not result in increased revenues if these new sales personnel fail to become productive. The timing of our hiring of sales personnel, or the participation in new marketing events or programs, and the rate at which these generate incremental revenues, may affect our future operating results. We expect to continue to invest in additional sales personnel worldwide and also in more marketing programs to support new solutions on our platform, which will increase sales and marketing expenses in absolute dollars.

44

Table of Contents

General and Administrative

General and administrative expenses consist primarily of personnel expenses, comprised of salaries, benefits, performance-based compensation and stock-based compensation for our executive, finance and accounting, IT, legal and human resources teams, as well as professional services, fees, software licenses and overhead allocations. We expect that general and administrative expenses will increase in absolute dollars, as we continue to add personnel and incur professional services to support our growth and compliance with legal requirements.

Other Income (Expense), Net

Our other income (expense), net consists primarily of interest and returns from our short-term and long-term marketable securities, non-marketable securities gains and losses, and foreign exchange gains and losses.

Income Tax Provision

We are subject to federal, state and foreign income taxes for jurisdictions in which we operate, and we use estimates in determining our income tax provision and deferred tax assets. Earnings from our non-U.S. activities are subject to income taxes in the local countries at rates which are generally similar to the U.S. statutory tax rate. We regularly assess the realizability of our net deferred tax assets. As of December 31, 2023, valuation allowances remain in certain jurisdictions where we believe it is necessary to see further positive evidence, such as sustained achievement of sufficient profits to meet a more likely than not stance that the valuation allowance should be reversed. If additional positive evidence becomes available in the foreseeable future, we may release all or a portion of the valuation allowance. The exact timing and amount of the valuation allowance release is subject to change based on the level of profitability achieved in future periods. Release of the valuation allowance would result in the recognition of deferred tax assets and a corresponding decrease to income tax expense in the period the release is recorded.

Results of Operations

The following table sets forth selected consolidated statements of operations data for each of the periods presented as a percentage of revenues:

45

Table of Contents

Comparison of Years Ended December 31, 2023 and 2022

Revenues

Revenues increased by $64.7 million in 2023 compared to 2022, driven by increased demand for our subscription services by our end customers. Of the total increase of $64.7 million in revenues, 80% was from customers existing at or prior to December 31, 2022, and the remaining 20% was from new customers added in 2023. Of the total increase of $64.7 million, 62% was from customers in the United States and the remaining 38% was from customers in foreign countries. In 2023, 57% of total revenues were direct and 43% of total revenues were through partners. Of the total increase of $64.7 million, 46% was direct and the remaining 54% was from partners. With our strong market position driving further demand for our solutions, we expect revenue growth from new and existing customers to continue.

Cost of Revenues

Cost of revenues increased by $4.7 million in 2023 compared to 2022, due to an increase in personnel costs, including stock-based compensation, of $5.1 million, driven by additional employees hired to support the growth of our business, an increase in shared cloud platform cost of $4.8 million, and an increase in subscribed license and software costs of $1.5 million, partially offset by a decrease in depreciation and amortization expense of $6.7 million resulting from our assets becoming fully depreciated or amortized.

Research and Development Expenses

Research and development expenses increased by $9.3 million in 2023 compared to 2022, due to an increase in personnel costs, including stock-based compensation, of $11.4 million, driven by increased headcount, annual merit increases for eligible employees and refresh grants to eligible employees, partially offset by a decrease in professional service expense of $1.2 million, and a decrease in depreciation and amortization expense in property and equipment of $0.9 million.

46

Table of Contents

Sales and Marketing Expenses

Sales and marketing expenses increased by $14.5 million in 2023 compared to 2022, due to an increase in personnel costs, including stock-based compensation, of $13.6 million, driven by increased headcount, an increase in travel and entertainment cost of $1.5 million associated with increased in-person sales meetings and marketing events, and an increase in subscribed license and software costs of $0.7 million, partially offset by a decrease in professional service expense of $1.3 million.

General and Administrative Expenses

General and administrative expenses increased by $3.8 million in 2023 compared to 2022, due to an increase in personnel costs, including stock-based compensation of $5.7 million, driven by increased headcount, annual merit increases for eligible employees and refresh grants to eligible employees and executives, and an increase in subscribed license and software cost of $0.8 million, partially offset by a decrease in professional service expense of $1.4 million, and a decrease in legal expense of $1.3 million.

Total other income, net

Total other income, net increased by $12.4 million in 2023 compared to 2022, due to an increase in interest income of $11.7 million driven by an increase of market interest rates, in addition to a $1.2 million decrease in foreign currency loss, partially offset by an unrealized loss of $0.5 million on a non-marketable equity security.

47

Table of Contents

Income tax provision

On July 21, 2023, the IRS issued a rule change allowing taxpayers to temporarily apply the regulations in effect prior to 2022 related to U.S. federal foreign tax credits to foreign taxes paid or accrued in years 2022 and 2023. Additionally, on September 8, 2023, the IRS issued interim guidance on the capitalization and amortization of research and development expenses. A cumulative tax benefit applicable to prior periods for the rule change and the guidance was recorded in 2023, which reduced the effective tax rate in 2023 compared to 2022. On December 11, 2023, the IRS extended the temporary relief for U.S. Federal foreign tax credit until further guidance, which is expected to provide similar tax benefits in future tax years.

Income tax provision increased by $1.3 million in 2023 compared to 2022, primarily due to an increase in pretax income and a decrease in excess tax benefits arising from stock-based compensation compared to the same period in 2022. The increase was partially offset by higher foreign tax credits and lower net capitalization of research and development expenses for tax purposes than previously estimated, reflecting the rule change and the guidance.

Key Operating and Non-GAAP Financial Performance Metrics

In addition to measures of financial performance presented in our consolidated financial statements, we monitor the key metrics set forth below to help us evaluate growth trends, establish budgets, measure the effectiveness of our sales and marketing efforts and assess operational efficiencies.

Net Dollar Expansion Rate

We evaluate our ability to retain and grow existing customers by assessing our net dollar expansion rate on a last twelve months, or LTM, basis. This metric is used to appropriately manage resources and customer retention and expansion. We calculate the net dollar expansion rate on a foreign exchange neutral basis by dividing a numerator by a denominator, each defined as follows:

Denominator: To calculate our net dollar expansion rate as of the end of a reporting period, we first determine the annual recurring revenue, or ARR, from all active subscriptions as of the last day of the same reporting period in the prior year. This represents recurring payments that we expect to receive in the next 12-month period from the cohort of customers that existed on the last day of the same reporting period in the prior year.

Numerator: We measure the ARR for that same cohort of customers representing all active subscriptions as of the end of the reporting period, using the same foreign exchange rate from the prior year.

Our net dollar expansion rates were 105% and 109% for the years ended December 31, 2023 and 2022, respectively.

Adjusted EBITDA

We monitor Adjusted EBITDA, a non-GAAP financial measure, to analyze our financial results and believe that it is useful to investors, as a supplement to U.S. GAAP measures, in evaluating our ongoing operational performance and enhancing an overall understanding of our past financial performance. We believe that Adjusted EBITDA helps illustrate underlying trends in our business that could otherwise be masked by the effect of the income or expenses that we exclude in Adjusted EBITDA. Furthermore, we use this measure to establish budgets and operational goals for managing our business and evaluating our performance. We also believe that Adjusted EBITDA provides an additional tool for investors to use in comparing our recurring core business operating results over multiple periods with other companies in our industry.

48

Table of Contents

Adjusted EBITDA should not be considered in isolation from, or as a substitute for, financial information prepared in accordance with U.S. GAAP. We calculate Adjusted EBITDA as net income before (1) other (income) expense, net, which includes interest income, interest expense and other income and expense, (2) income tax provision (benefit), (3) depreciation and amortization of property and equipment, (4) amortization of intangible assets, (5) stock-based compensation and (6) non-recurring expenses that do not reflect ongoing costs of operating the business.

Adjusted EBITDA has limitations as an analytical tool and should not be considered in isolation from or as a substitute for the measures presented in accordance with U.S. GAAP. Some of these limitations are:

•Adjusted EBITDA does not reflect certain cash and non-cash charges that are recurring;

•Adjusted EBITDA does not reflect income tax payments that reduce cash available to us;

•Adjusted EBITDA excludes depreciation and amortization of property and equipment and amortization of intangible assets, although these are non-cash charges, the assets being depreciated and amortized may have to be replaced in the future; and

•Other companies, including companies in our industry, may calculate Adjusted EBITDA differently or not at all, which reduces its usefulness as a comparative measure.

Because of these limitations, Adjusted EBITDA should be considered alongside other financial performance measures, including revenues, net income, cash flows from operating activities and our financial results presented in accordance with U.S. GAAP.

The following unaudited table presents the reconciliation of net income to Adjusted EBITDA for the years ended December 31, 2023 and 2022.

Liquidity and Capital Resources

As of December 31, 2023, our principal source of liquidity was cash, cash equivalents and marketable securities of $482.2 million, including $94.8 million of cash held outside of the United States. The following summary of cash flows for the periods indicated have been derived from our consolidated financial statements included elsewhere in this report:

49

Table of Contents

Operating Activities

In 2023, we generated $226.4 million of cash from our net income, as adjusted for non-cash items mainly related to stock-based compensation expense, depreciation and amortization expense and deferred taxes, as compared to $177.2 million in 2022. In addition, we also generated $18.2 million of cash from working capital change in 2023, of which $22.7 million was related to a net increase in deferred revenue and accounts receivable due to the growth in billing and the timing of collections, partially offset by a $1.1 million decrease in payables and accrued liabilities and a $3.4 million increase in prepaid expenses primarily driven by the timing of payments. In 2022, we generated $177.2 million of cash from our net income, as adjusted for non-cash items mainly related to stock-based compensation expense, depreciation and amortization expense and deferred taxes, as compared to $169.6 million in 2021. In addition, we also generated $21.7 million of cash from working capital change in 2022, of which $11.8 million was related to a net increase in deferred revenue and accounts receivable as a result of our continued growth in billing and the timing of collections, and $9.9 million was due to lower prepaid expenses and an increase in payables and accrued liabilities primarily due to timing of payments.

Investing Activities

In 2023, we used $64.4 million of cash for purchases of marketable securities net of sales and maturities, and used $8.8 million of cash in capital expenditures mainly related to computer equipment to support our growth and development, as compared to $169.0 million of cash generated from net sales and maturities of our marketable securities, $15.4 million of cash used in capital expenditures mainly related to computer equipment to support our growth and development and $8.6 million of cash used to acquire certain technology assets in 2022.

Financing Activities

In 2023, we used $170.8 million of cash for share repurchase and $22.3 million of cash in payment of employee withholding taxes upon vesting of restricted stock units, partially offset by $45.6 million of proceeds from employee exercise of stock options and $6.1 million of proceeds from issuance of common stock through our employee stock purchase plan ("ESPP"), as compared to $317.3 million of cash used for share repurchase and $17.6 million of cash in payment of employee withholding taxes upon vesting of restricted stock units, partially offset by $24.5 million of proceeds from employee exercise of stock options and $4.4 million of proceeds from issuance of common stock through our ESPP in 2022.

Material Cash Requirements

We believe our existing cash and cash equivalents, marketable securities and our expected cash flow generated from operations will be sufficient to fund our operations for the next twelve months and beyond. If we repatriate funds from our foreign subsidiaries, we could be subject to foreign withholding taxes.

Our material cash requirements mainly include the following contractual and other obligations:

•Our operating lease obligations to make payments under our non-cancelable lease agreements for our facilities and shared cloud platforms. We had fixed operating lease payment obligations of $31.1 million as of December 31, 2023, with $13.1 million expected to be paid within the next 12 months.

•Cash outflow for capital expenditures in 2024 is expected to be in a range of $15.0 million to $20.0 million. Our future capital requirements will depend on many factors, including our rate of revenue growth, the expansion of our sales and marketing activities, the timing, type and extent of our spending on research and development efforts, international expansion and investment in shared cloud platforms and cloud infrastructures. We may also seek to invest in or acquire complementary businesses or technologies.

•Other non-cancelable purchase obligations related to cloud infrastructures and other service providers totaled $70.6 million, of which $29.7 million is expected to be paid within the next 12 months.

Share Repurchases

We expect to continue to use cash to repurchase shares in 2024 under our share repurchase program authorized by our board of directors on February 5, 2018. As of December 31, 2023, our board of directors had authorized an aggregate amount of $1.0 billion for repurchases under our share repurchase program, of which approximately $83.7 million remained available. Shares will be repurchased from time to time in the open market in accordance with Rule 10b-18 of the Exchange Act of 1934, including pursuant to a pre-set trading plan adopted in accordance with Rule 10b5-1 under the Exchange Act.

50

Table of Contents

On February 7, 2024, we announced that our Board of Directors authorized an additional $200.0 million under the share repurchase program, increasing the total amount of authorized repurchase to $1.2 billion.

Critical Accounting Estimates

The preparation of our consolidated financial statements in accordance with U.S. GAAP requires us to make estimates and assumptions that affect the reported amounts of assets, liabilities, revenues, expenses and related disclosures. Our significant accounting policies are described in Note 1 - The Company and Summary of Significant Accounting Policies in the accompanying notes to the consolidated financial statements included in Part II, Item 8, "Financial Statements and Supplementary Data" of this Annual Report on Form 10-K. On an ongoing basis, we evaluate our estimates and assumptions based on historical and anticipated results and trends that we believe represent our best estimate under the circumstances. However, as accounting estimates are subject to inherent uncertainty, our actual results may differ from these estimates under different assumptions or conditions.

Income Taxes

Significant assumptions, judgments and estimates are involved in determining our provision for (benefit from) income taxes, our deferred tax assets and liabilities, and any valuation allowance to be recorded against our deferred tax assets. Our judgments, assumptions and estimates relating to the current provision for income taxes include the geographic mix and amount of income (loss), expectations of future income, our interpretation of current tax laws, our business, and possible outcomes of current and future audits conducted by foreign and domestic tax authorities. Our judgments also include anticipating the tax positions we will record in the financial statements before preparing and filing the tax returns. Our estimates and assumptions may differ from the actual results as reflected in our income tax returns and we record the required adjustments when they are identified or resolved. Changes in our business and tax laws or our interpretation of those, and developments in current and future tax audits, could significantly impact the amounts provided for income taxes in our results of operations, financial position, or cash flows.

The assessment of tax effects of our uncertain tax positions in our financial statements involves significant judgment in interpreting complex and ambiguous tax laws, regulations, and administrative practices, determining the probability of various possible settlement outcomes, evaluating the litigation process based on tax authority behaviors in similar cases, and estimating the likelihood that another taxing authority could review the respective tax position. These judgments are inherently challenging and subjective because a taxing authority may change its behavior at any time. We must also determine when it is reasonably possible that the amount of unrecognized tax benefits will significantly increase or decrease in the 12 months after each fiscal year-end. We reevaluate our income tax positions on a quarterly basis to consider factors such as changes in facts or circumstances, changes in tax laws, effectively settled issues under audit, the potential for interest and penalties, and new audit activity. Such a change in recognition or measurement would result in recognition of a tax benefit or an additional charge to the tax provision that could be material in the future.

Stock-Based Compensation

We recognize the fair value of our employee stock options and restricted stock units, including performance-based restricted stock units, over the requisite service period. The fair value of each stock option is estimated on date of grant using the Black-Scholes-Merton option pricing model. Determining the appropriate fair value model and calculating the fair value of employee stock options requires the use of subjective assumptions, including the expected life of the stock option and stock price volatility. The recognition of expenses for performance based restricted stock units requires us to estimate the probability that the performance condition will be achieved and the number of awards that will vest are adjusted accordingly at each reporting period. The assumptions used in calculating the fair value of employee stock options and estimating the probability of achievement of performance metrics represent management’s best estimates, which require significant judgment and involve inherent uncertainties. If factors change and we use different assumptions, our stock-based compensation expense could be materially different in the future.