Qualys, Inc. QLYS

The business

Qualys sells a cloud-native vulnerability-management and exposure-management platform to enterprises and governments. The core product scans IT assets (endpoints, servers, containers, cloud workloads, web apps) for known vulnerabilities, prioritizes them by real-world exploit risk (its "TruRisk" scoring), and drives remediation workflows. Customers pay recurring subscription fees, mostly annual, priced by asset count and modules consumed. The engine is Vulnerability Management, Detection and Response (VMDR), which anchors the platform; adjacent modules (Patch Management, Cloud Security, Endpoint Detection and Response, Web App Scanning) attach onto the same agent and dashboard. VMDR plus the closely tied compliance and policy scanning modules generate the majority of revenue, at 83% gross margins and 39% EBITDA margins on the whole book. Distribution is roughly half direct enterprise sales, half channel (MSSPs, security consultancies, resellers).

The qualitative thing the P&L does not show: Qualys sits in a competitive pond that got much more crowded in the last three years. Tenable is the legacy peer, Rapid7 is discounting hard, CrowdStrike has bolted exposure management onto Falcon, and Wiz (now Google) is the fast-growing cloud-native entrant. Qualys's answer has been Enterprise TruRisk Management, a platform bundle that aggregates its own scan data plus third-party feeds into one risk register. Adoption of that layer is the swing factor for whether growth reaccelerates from the current 10-11% or bleeds toward mid-single digits as the standalone vuln-scanner category commoditizes.