Slides
Page 1
Investor Presentation Security and Compliance for the Digital Transformation Sumedh Thakar , President and CEO Joo Mi Kim , CFO August 4 , 2026 Qualys .
Page 2
2 Safe harbor This presentation includes forward-looking statements within the meaning of the federal securities laws. Forward-looking statements generally relate to future events or our future financial or operating performance. Forward-looking statements in this presentation include, but are not limited to, the following list: - our business and financial performance and expectations for future periods, including the rate of growth of our business and market share gains; - our expectations regarding our Qualys Enterprise TruRisk Platform and the benefits and capabilities of our platform; - our expectations regarding the growth, benefits, and market acceptance of the Qualys Enterprise TruRisk Platform; - our total addressable market; - our expectations regarding the timing of future products and features; - the benefits of our new and upcoming products, features, integrations, collaborations and joint solutions; - our strategy and our business model and our ability to execute such strategy; - our guidance for revenues, adjusted EBITDA margin, capital expenditure, GAAP EPS, and non-GAAP EPS for the third quarter and full year 2026; and - our expectations for the number of weighted average diluted shares outstanding and the GAAP and non-GAAP effective income tax rate for the third quarter and full year 2026. Our expectations and beliefs regarding these matters may not materialize, and actual results in future periods are subject to risks and uncertainties that could cause actual results to differ materially from those projected. These risks include: - our ability to continue to develop platform capabilities and solutions; - the ability of our platform and solutions to perform as intended; - customer acceptance and purchase of our existing solutions and new solutions; - real or perceived defects, errors, or vulnerabilities in our products or services; - our ability to retain existing customers and generate new customers; - the budgeting cycles and seasonal buying patterns of our customers, and the length of our sales cycle; - our ability to maintain government authorizations applicable to our platform; - the general market, political, economic, and business conditions in the United States as well as globally; - our ability to manage costs as we increase our customer base and the number of our platform solutions; - the cloud solutions market for IT security and compliance not increasing at the rate we expect; - competition from other products and services; - fluctuations in currency exchange rates; - unexpected fluctuations in our effective income tax rate on a GAAP and non-GAAP basis; - our ability to effectively manage our rapid growth and our ability to anticipate future market needs and opportunities; and - any unanticipated accounting charges. These additional risks include those set forth in our filings with the Securities and Exchange Commission, including our latest Form 10-Q and 10-K. The forward-looking statements in this presentation are based on information available to us as of today, and we disclaim any obligation to update any forward-looking statements, except as required by law. We also remind you that this presentation will include a discussion of GAAP and non-GAAP financial measures. The non-GAAP financial measures are not intended to be considered in isolation or as a substitute for results prepared in accordance with GAAP. The GAAP financial measures, and a reconciliation of the non-GAAP financial measures discussed in this presentation to the most directly comparable GAAP financial measures are included in the appendix of this presentation.
Page 3
Investment highlights Industry-leading cloud security and compliance platform for comprehensive risk management Multiple levers of recurring revenue growth Scalable business model and industry- leading profitability Uniquely positioned to capitalize on stack consolidation and cloud transformation 3
Page 4
4 Legacy Qualys Cloud Platform Control Center • SecOps • ITOps • Devops • Risk • Compliance • C-suite Virtual Scanners APIs Cloud Connector SaaS Connector Internet Scanners Network Scanner Passive Sensor Sensors SINGLECLOUDAGENT Asset Management Vulnerability Management Response & Remediation Compliance Threat Detection API & Integrations Unified Data Platform Data Normalization • Indexing • Categorization • Enrichment Platform Services RBAC • ML/AI • Scalability • Alerts/Notifications • Workflow • Scripting • Dashboards & Reporting Qualys Threat Research & Intelligence Unit 100+ world-leading experts enabling rapid protection across all threat vectors Qualys Cloud Platform IT Environment Workstations Servers Virtual Machines Cloud Mobile Containers IOT/OT/ICS Transforming from focus on providing visibility, vulnerability management, and data analytics to…
Page 5
5 Introducing Qualys Enterprise TruRisk Platform … leveraging risk analytics to deliver desired business outcomes
Page 6
6 Asset Management Asset Management Threat Detection TotalCloudRemediation Vulnerability Vulnerability Asset Management Asset Management Discover All Assets Get inside-out and outside-in visibility of all assets with an attackers view of the network Get Complete Asset Context & Visibility Add business context, tags, enhance visibility by seamlessly integrating with CMDB’s, Third Party & ITSM solutions, bring business context into asset criticality for managing risk Identify Security Gaps Detect EOL/EOS software, unmanaged assets, unauthorized software, missing business critical software, evaluate cyber risk per subsidiary, inventory open-source software, packages & libraries Qualys Enterprise TruRisk Platform CyberSecurity Asset Management
Page 7
7 Asset Management Asset Management Threat Detection TotalCloudRemediation Vulnerability Vulnerability Vulnerability Vulnerability Qualys Enterprise TruRisk Platform VMDR Measure Cyber Risk Quantify risk across vulnerabilities, assets, and groups of assets helping organizations proactively reduce risk exposure and track risk reduction over time with Qualys TruRisk Communicate Cyber Risk Communicate risk across different teams, business units and geographic locations by leveraging dashboards, reports and ITSM tools Reduce Risk Faster Unify security and IT threat response paths for faster remediation with seamless integration between ITSM tools and path management solutions. Automate and orchestrate operational tasks with Qualys Qflow
Page 8
8 Asset Management Asset Management Threat Detection TotalCloudRemediation Vulnerability Vulnerability Remediation Remediation Qualys Enterprise TruRisk Platform Comprehensive Risk Reduction Eliminate Cyber Risk Deploy the right remediation, mitigations or isolation strategies to balance risk reduction with business impact Save time and reduce MTTR Leverage smart automation to ensure software is up to date, risky vulnerabilities are patched or mitigated, and misconfigurations are fixed across hybrid environments Consolidate IT-Security Stack Orchestrate risk reduction by seamlessly integrating with your SCCM, ITOps, and developer tools
Page 9
9 Asset Management Asset Management Threat Detection TotalCloudRemediation Vulnerability Vulnerability Threat Detection Threat Detection Qualys Enterprise TruRisk Platform Threat Detection and Response Protect Against Zero-day threats Leverage behavior & AI/ML-based antivirus to thwart exploits, ransomware, phishing attacks, and zero-days Unify VM, Patching, and Endpoint Security Correlate endpoint threats to identify vulnerabilities actively exploited in your environment with integrated patch management Automate & Orchestrate Comprehensive endpoint (EDR) and Cloud Detection and Response with enterprise integrations (i.e., SIEM, ITSM, CMDB)
Page 10
10 Asset Management Asset Management Threat Detection TotalCloudRemediation Vulnerability Vulnerability Unified Multi-Cloud Security Unified vulnerability, threat and posture management from development through runtime in cloud and container environments Extended TruRisk Insights TruRisk insights for cloud and multi-cloud assets, unifying risk posture and remediation actions between on-prem, hybrid, and cloud workloads Comprehensive Security across IaaS and SaaS Orchestrate security between multi-cloud environments, asset inventories, and users leveraging a single agent, sensors, snapshots, and APIs or all four methods with Qualys FlexScan Qualys Enterprise TruRisk Platform TotalCloud (CNAPP)
Page 11
11 Qualys Enterprise TruRisk Platform Enterprise TruRisk Management Centralized Risk Aggregation Visualize the entire attack surface with unified asset inventory, integrate data from Qualys and third-party sources, consolidate risk finding across all asset types and environments Risk Quantification with Business Context Enrich risk data with Qualys curated feeds from over 25 threat intelligence sources, add business and financial context to quantify and prioritize cyber risk by evaluating loss attributes based on severity, exploitability, asset criticality and business impact Risk Response Orchestration Orchestrate precise risk response using AI-driven workflows for integrated patching and other mitigating controls with Qualys TruRisk Eliminate, automated tickets, and real-time alerts Asset Management Asset Management Threat Detection TotalCloudRemediation Vulnerability Vulnerability
Page 12
12 Qualys Enterprise TruRisk Platform Advantages One view across the entire global hybrid-IT environment, allowing customers to consolidate their stack for better security outcomes Nothing to install or manage, and all services are accessible via web interface. No hardware to buy or manage With everything in the cloud there is no capex and no extra human resources needed. Lower operating costs Easily perform assessments across global hybrid-IT environment. Easy to deploy and maintain Seamlessly add new coverage, users, and services as you need them. Unprecedented scaling Largest knowledge base of vulnerability signatures. Real time security updates. Always Up-to-date Data stored and processed in a n-tiered architecture of load- balanced servers. Data stored securely Available as a Public or on-premises Private Cloud Full server rack For governments, enterprises, and MSSPs Virtual rack For governments, enterprises, and MSSPs Standalone appliance For small businesses FedRAMP authorized
Page 13
13 Source: IDC, Qualys estimates CY2026E CY2029E $8.2B $12.3B $4.6B $6.0B$6.7B $8.9B$8.2B $14.7B$19.0B $25.0B $6.7B $8.6B$53B $75B Large expanding market opportunity Qualys’ Current Total Addressable Market 1.41x Expand VM Assessment & Mngt. Compliance Asset Management Cloud Security Threat Detection & Response Risk Remediation
Page 14
14 Blue chip global customer base Note: A customer is defined as any customer with subscription revenue at the measurement date 10,000+ Subscription customers 74% of the Forbes Global 50 57% of the Forbes Global 500 35% of the Forbes Global 2000
Page 15
15 Scalable go-to-market model Mark et segmentation & k ey strategic partners 2025 REVENUES Large enterprise (Over 5,000 employees) New customers Existing customers Small / medium business (Up to 5,000 employees) New customers Existing customers MID - MARKET ENTERPRISE 51% 49% Direct Indirect CHANNEL
Page 16
16 Attractive value proposition for partners High-margin recurring revenue with no capex / maintenance costs Value Added Resellers ConsultantsOutsourcing Providers MSSPs Cloud Provider Partners
Page 17
17 Balanced revenue growth and profitability ($ in millions) $554 $608 $669 $324 $358 13% 10% 10% 10% 10% 2023 2024 2025 Q2 2025 YTD Q2 2026 YTD Y/Y growth $259 $283 $313 $148 $167 47% 47% 47% 46% 47% 2023 2024 2025 Q2 2025 YTD Q2 2026 YTD Adj EBITDA % Adjusted EBITDARevenues Adjusted EBITDARevenues Note: Adjusted EBITDA is a non-GAAP measure. See the appendix for a reconciliation of non -GAAP financial measures to the most d irectly comparable GAAP financial measures. 10% CAGR 10% CAGR
Page 18
18 $209 $247 $268 $307 LTM Q2 2023 LTM Q2 2024 LTM Q2 2025 LTM Q2 2026 Platform adoption driving higher customer spend($ in millions) Note: Customer count is defined as customers with $500K or more in annual revenue Aggregate Revenues 14% Growth 168 199 212 229Number of customers
Page 19
19 Differentiated new products continue to increase contribution to bookings 57% 54% 49% 7% 9% 12% 6% 7% 9% 4% 5% 5% 9% 9% 9% 8% 8% 8% 9% 9% 8% LTM Q2 2024 LTM Q2 2025 LTM Q2 2026 Vulnerability Mgmt ETM/CSAM Patch Mgmt TotalCloud TotalAppSec Policy Audit Other Last twelve month total bookings mix Net Dollar Expansion Rate 102% 104% 105% Note: Net Dollar Expansion Rate is calculated on a foreign exchange neutral basis by comparing the Annual Recurring Revenue (ARR) generated from the cohort of customers at the end of the year ago reporting period to the ARR from that same cohort of customers in the current reporting period. See our Forms 10-K and 10-Q for additional detail. Sums may not total due to rounding.
Page 20
20 Opportunity to increase market share and maximize share of wallet Note: Illustrative potential increase in spend per customer assuming $1.00 for VMDR $0.50 $0.50 $1.00 $0.00 $0.50 $1.00 $1.50 $2.00 $2.50 $3.00 $3.50 VMDR CSAM ETM VMDR & ETM PM VMDR & ETM & PM $2.00 $1.00 $3.00 (upgrade from CSAM) 1 2 3
Page 21
21 From VMDR to ETM Unlocking the next dollar of spend, moving from visibility to measurable cyber risk management VMDR Exposure Detection $1 Detect/Assess Exposures Finds vulnerabilities, misconfigurations, and attack surface across your environment CHALLENGES POST EXPOSURE VISIBILITY • Do I have risk from unknown assets? • I have 20+ tools and millions of exposures, which ones are riskiest per threats and business impact? • Are there any confirmed risks beyond theoretical risk prioritization? • 80% of my efforts go into getting insights and driving operations. How can Agentic AI be helpful? VMDR delivers visibility, not risk decisions $1 VMDR Exposure visibility +$1 ETM Agentic AI + Cyber Risk Management ETM (includes CSAM) Cyber Risk Prioritization & Management +$1 Prioritize and Manage Cyber Risk Turns exposures into prioritized, business-relevant risk decisions with AI automation ETM = CTEM + Cyber Risk Quantification (CRQ) ✓ Unified inventory & Attack Surface Management with integrated CSAM/ESAM ✓ Aggregate and prioritize exposures with threat and business context using TruRisk ✓ Communicate cyber risk in quantifiable terms specific to an organization’s risk tolerance ✓ Confirm exploitation of risky exposures with TruConfirm ✓ Manage the risk of trending threats in an industry with TruLense ETM is the risk engine of the Qualys Enterprise TruRisk Platform Agentic AI Marketplace of specialized cyber risk agents and cyber risk assistant Drive every step in cyber risk management autonomously to reduce the cost of risk operations Note: Dollar values are illustrative and reflect normalized, weighted pricing assumptions, excluding the impact of discounti ng 1
Page 22
22 From ETM to PM (TruRisk Eliminate) PM eliminates cyber risk to reduce the window of exploitation, unlocking an additional dollar VMDR & ETM (includes CSAM) Cyber Risk Prioritization & Management $2 (VMDR $1 + ETM $1) ETM tells you WHAT to fix, PM shows you HOW and DOES it PM (TruRisk Eliminate) Reducing Average Window of Exploitation (AWE) +$1 Reduce Cyber Risk Remediate risk across asset and exposure classes in an adaptive, automated manner ELIMINATE CAPABILITIES ✓ Patch + Mitigate + Isolate Multi-strategy approach to risk reduction What ETM delivers ✓ Prioritized risk intelligence with business context ✓ Complete CTEM framework (5 phases) ✓ AI-powered cyber risk assistant IT’S NOT ABOUT MEASURING CYBER RISK, IT’S ABOUT REDUCING IT How to reduce the average window of exploitation for risky exposures How to reduce risk without patching and balancing business impact $1 VMDR Exposure visibility +$1 ETM Agentic AI + Cyber Risk Management +$1 PM Agentic AI + Risk Reduction RemOps = CTEM Mobilization Complete the CTEM framework by executing remediation plans ✓ 100% Ransomware Vulnerability Coverage Mitigate all known ransomware attack vectors ✓ Multi-vendor Remediation Zscaler, SCC/Intune, CrowdStrike, ServiceNow, etc. Total value: $3 – from detection (VMDR) to quantification (ETM) to elimination (PM) Note: Dollar values are illustrative and reflect normalized, weighted pricing assumptions, excluding the impact of discounti ng 2
Page 23
23 Strong cash flow generation ($ in millions) $236 $232 $304 $140 $150 43% 38% 45% 43% 42% 2023 2024 2025 Q2 2025 YTD Q2 2026 YTD FCF Margin % $171 $140 $183 $89 $131 37.6 37.4 36.5 36.7 35.4 2023 2024 2025 Q2 2025 YTD Q2 2026 YTD Diluted WASO Share repurchase amountFree Cash Flow Share repurchase amountFree Cash Flow (FCF) Note: Free Cash Flow is a non -GAAP measure. See the appendix for a reconciliation of non -GAAP financial measures to the most dir ectly comparable GAAP financial measures. Returning capital to shareholders 14% CAGR
Page 24
24 Peer Median: 26% Relative margin outperformance to peers 2025 Adjusted EBITDA margin vs. select Security and SaaS peers Security SaaS QLYS 47% Source: FactSet Note: Adjusted EBITDA is a non-GAAP measure. See the appendix for a reconciliation of non -GAAP financial measures to the most di rectly comparable GAAP financial measures.
Page 25
25 Rule of 40 QLYS 57% 2025 Rule of 40 vs. select Security and SaaS peers Security SaaS Achieving rule of 50+: growth + profitability Source: FactSet Note: 2025 Revenue Growth % + Adj EBITDA Margin %
Page 26
Appendix
Page 27
27 Reconciliation of Adjusted EBITDA ($ in millions) Note: Amounts may not sum due to rounding. 2022 2023 2024 2025 Q2 2025 YTD Q2 2026 YTD Net income $108.0 $151.6 $173.7 $198.3 $94.8 $103.0 Net income margin 22% 27% 29% 30% 29% 29% Depreciation and amortization of property and equipment 28.9 23.9 15.6 11.9 6.9 4.8 Amortization of intangible assets 5.7 3.1 2.9 2.6 1.3 1.3 Income tax provision 25.7 27.1 36.1 48.5 22.3 29.0 Stock-based compensation 53.4 69.1 77.1 77.0 36.9 38.2 Total other income, net (3.2) (15.6) (22.6) (24.9) (14.0) (9.3) Adjusted EBITDA $218.6 $259.1 $282.8 $313.4 $148.2 $167.0 Adjusted EBITDA margin 45% 47% 47% 47% 46% 47%
Page 28
28 Reconciliation of Non-GAAP Free Cash Flows ($ in millions) Note: Amounts may not sum due to rounding. 2022 2023 2024 2025 Q2 2025 YTD Q2 2026 YTD GAAP Cash flows provided by operating activities $198.9 $244.6 $244.1 $309.4 $143.4 $154.9 GAAP Cash flows provided by operating activities margin 41% 44% 40% 46% 44% 43% Less: Purchases of property and equipment, net of proceeds from disposal (15.4) (8.8) (12.3) (5.0) (3.4) (5.4) Non-GAAP Free cash flow $183.5 $235.8 $231.8 $304.4 $140.0 $149.5 NON-GAAP Free cash flow margin 37% 43% 38% 45% 43% 42%
Page 29
29 Revenue mix 60% 58% 56% 57% 55% 40% 42% 44% 43% 45% 2023 2024 2025 Q2 2025 YTD Q2 2026 YTD Geographic US Foreign 57% 54% 51% 51% 47% 43% 46% 49% 49% 53% 2023 2024 2025 Q2 2025 YTD Q2 2026 YTD Direct vs. Partner Direct Partner