Risk Sleuth

QLYS · 10-K filed 20 Feb 2026 · year to 31 Dec 2025

Qualys

25 named things its latest annual report says its results depend on, each in the company's own words. 15 of them are also named by other companies we've read.

Read the filing on SEC.gov ↗

Customers

U.S. federal government

earns fromnamed as a risk

We have obtained authorization under FedRAMP, which facilitates our entry into the U.S. federal government market.Risk factors (Item 1A)

Also named by ACN, ADSK, AKAM, AMRC, APG, CACI, CBRE, CI and 25 more

Suppliers

Third-party shared cloud platform providers

depends on · 15 shared cloud platformsnamed as a risk

We currently host substantially all of our solutions from third-party shared cloud platforms located in the United States, Canada, Switzerland, the Netherlands, United Arab Emirates, Australia, United Kingdom, Italy, the Kingdom of Saudi Arabia and India.Risk factors (Item 1A)

Third-party software and security data providers

depends onnamed as a risk

Any loss of the right to use any of this software or data could result in delays in the provisioning of our solutions until equivalent technology or data is either developed by us, or, if available, is identified, obtained and integrated, which could harm our business.Risk factors (Item 1A)

Partners and platforms

Channel partners

earns from · approximately 49%named as a risk

For the years ended December 31, 2025, 2024 and 2023, we derived approximately 49%, 46% and 43% of our revenues from sales of subscriptions for our solutions through channel partners, and the percentage of revenues derived from channel partners may increase in future periods.Risk factors (Item 1A)

Also named by CRWD, DELL, GTLB, KEYS, OKTA, P, TEAM, VRNS

Competitors

CrowdStrike

competes withnamed as a risk

We compete with large and small public companies, such as CrowdStrike, Palo Alto Networks, Rapid7, and Tenable Holdings, as well as privately held security providers including Invicti, Tanium, and Wiz (which has announced a pending acquisition by Google).Risk factors (Item 1A)

Also named by DAL, MRSH

Palo Alto Networks

competes withnamed as a risk

We compete with large and small public companies, such as CrowdStrike, Palo Alto Networks, Rapid7, and Tenable Holdings, as well as privately held security providers including Invicti, Tanium, and Wiz (which has announced a pending acquisition by Google).Risk factors (Item 1A)

Rapid7

competes withnamed as a risk

We compete with large and small public companies, such as CrowdStrike, Palo Alto Networks, Rapid7, and Tenable Holdings, as well as privately held security providers including Invicti, Tanium, and Wiz (which has announced a pending acquisition by Google).Risk factors (Item 1A)

Tenable Holdings

competes withnamed as a risk

We compete with large and small public companies, such as CrowdStrike, Palo Alto Networks, Rapid7, and Tenable Holdings, as well as privately held security providers including Invicti, Tanium, and Wiz (which has announced a pending acquisition by Google).Risk factors (Item 1A)

Wiz

competes withnamed as a risk

We compete with large and small public companies, such as CrowdStrike, Palo Alto Networks, Rapid7, and Tenable Holdings, as well as privately held security providers including Invicti, Tanium, and Wiz (which has announced a pending acquisition by Google).Risk factors (Item 1A)

Tanium

competes withnamed as a risk

We compete with large and small public companies, such as CrowdStrike, Palo Alto Networks, Rapid7, and Tenable Holdings, as well as privately held security providers including Invicti, Tanium, and Wiz (which has announced a pending acquisition by Google).Risk factors (Item 1A)

Places

India

concentrated in · 70% of our employeesnamed as a risk

In addition, as of December 31, 2025, approximately 78% of our employees were located outside of the United States, with 70% of our employees located in India.Risk factors (Item 1A)

Also named by A, AAPL, ACN, AJG, AKAM, AMZN, AOS, AVGO and 54 more

United States

earns from · 56%

In 2025, 2024 and 2023, 56%, 58% and 60%, respectively, of our revenues were derived from customers in the United States based on our customers' billing addresses.Business (Item 1)

Also named by ABBV, ADP, AJG, AMGN, APA, AXGN, AXP, BALL and 139 more

Europe

earns fromnamed as a risk

Furthermore, the continued weakness and uncertainty in worldwide credit markets, including the sovereign debt situation in certain countries in the European Union, may adversely impact our European operations, as well as our current and potential customers' available budgetary spending, which could lead to delays or reductions in planned purchases of our solutions.Risk factors (Item 1A)

Also named by ADSK, AME, AMRC, ATR, BCSF, BKNG, BMI, BMY and 60 more

San Francisco Bay Area

concentrated innamed as a risk

Our corporate headquarters and a significant portion of our operations are located in the San Francisco Bay Area, a region known for seismic activity.Risk factors (Item 1A)

Also named by ADBE, ANET, ARE, DASH, DOCU, RMNI, SIRI, ZS

Hazards

Earthquakes

operates innamed as a risk

A significant natural disaster, such as an earthquake, fire or a flood, or a significant power outage could have a material adverse impact on our business, operating results and financial condition.Risk factors (Item 1A)

Also named by AAPL, AMKR, AN, ANET, APP, BRO, CDNS, CEG and 37 more

Commodities and inputs

Euro

exposed to its price · €54.3 millionnamed as a risk

As of December 31, 2025, we had designated cash flow hedge forward contracts with notional amounts of €54.3 million, £24.1 million and Rs.5,526.0 million and non-designated forward contracts with notional amounts of €24.4 million, £6.8 million, Rs.2,723.0 million and C$2.5 million.Market risk (Item 7A)

Also named by ABBV, ABNB, ABT, ADBE, ADI, AME, AMG, AMGN and 186 more

British Pound

exposed to its price · £24.1 millionnamed as a risk

As of December 31, 2025, we had designated cash flow hedge forward contracts with notional amounts of €54.3 million, £24.1 million and Rs.5,526.0 million and non-designated forward contracts with notional amounts of €24.4 million, £6.8 million, Rs.2,723.0 million and C$2.5 million.Market risk (Item 7A)

Also named by ABBV, ADBE, AJG, AME, AMP, APA, BF/B, BRO and 39 more

Indian Rupee

exposed to its price · approximately 31% of our expenses in foreign currenciesnamed as a risk

However, for the year ended December 31, 2025, we incurred approximately 31% of our expenses in foreign currencies, primarily the Euro, British Pound, and Indian Rupee, principally with respect to salaries and related personnel expenses associated with our European and Indian operations.Risk factors (Item 1A)

Also named by ACN, ADBE, AJG, AVY, BEN, CIEN, CTSH, EEFT and 11 more

Regulators

Payment Card Industry Security Standards Council (PCI Council)

named as a risk

For example, many of our customers subscribe to our IT, security and compliance solutions to help them comply with the security standards developed and maintained by the Payment Card Industry Security Standards Council, or the PCI Council, which apply to companies that store cardholder data.Risk factors (Item 1A)

Laws and programs

General Data Protection Regulation (GDPR)

subject tonamed as a risk

For example, the European Union's General Data Protection Regulation (“GDPR”), which took effect in May of 2018, provides for substantial obligations relating to the handling, storage, and other processing of data relating to individuals and administrative fines for violations, which can be up to the greater of four percent of the previous year’s annual revenue or €20 million.Risk factors (Item 1A)

Also named by A, AB, ABNB, ADBE, ADP, AGX, AIOT, AJG and 100 more

Export Administration Regulations

subject tonamed as a risk

Our solutions are subject to U.S. export controls, specifically, the Export Administration Regulations and economic sanctions enforced by the Office of Foreign Assets Control.Risk factors (Item 1A)

Also named by ADI, ALAB, AMD, APP, ARW, AVGO, CARR, CDRE and 40 more

EU-U.S. Data Privacy Framework

subject tonamed as a risk

Both the EU-U.S. Data Privacy Framework and SCCs have, however, been subject to legal challenge.Risk factors (Item 1A)

Also named by ADBE, APP, CRM, CRWD, DDOG, DOCN, GTLB, IDXX and 12 more

Federal Risk and Authorization Management Program (FedRAMP)

subject tonamed as a risk

Such certification is subject to rigorous compliance and if we lose our certification, it could inhibit or preclude our ability to contract with certain U.S. federal government customers.Risk factors (Item 1A)

Also named by QBTS

Federal Information Security Management Act (FISMA)

subject tonamed as a risk

We have invested in the creation of a cloud offering certified under the Federal Information Security Management Act for government usage but we cannot be sure that we will continue to sustain or renew this certification, that the government will continue to mandate such certification or that other government agencies or entities will use this cloud offering.Risk factors (Item 1A)

Digital services tax

subject tonamed as a risk

Furthermore, certain jurisdictions, such as the U.K. and France, have enacted a digital services tax, which is generally a tax on gross revenue generated from users or customers located in those jurisdictions, and other jurisdictions are considering enacting similar laws.Risk factors (Item 1A)