Qualys
25 named things its latest annual report says its results depend on, each in the company's own words. 15 of them are also named by other companies we've read.
Customers
Suppliers
Third-party shared cloud platform providers
depends on · 15 shared cloud platformsnamed as a riskWe currently host substantially all of our solutions from third-party shared cloud platforms located in the United States, Canada, Switzerland, the Netherlands, United Arab Emirates, Australia, United Kingdom, Italy, the Kingdom of Saudi Arabia and India.Risk factors (Item 1A)
Third-party software and security data providers
depends onnamed as a riskAny loss of the right to use any of this software or data could result in delays in the provisioning of our solutions until equivalent technology or data is either developed by us, or, if available, is identified, obtained and integrated, which could harm our business.Risk factors (Item 1A)
Partners and platforms
Channel partners
earns from · approximately 49%named as a riskFor the years ended December 31, 2025, 2024 and 2023, we derived approximately 49%, 46% and 43% of our revenues from sales of subscriptions for our solutions through channel partners, and the percentage of revenues derived from channel partners may increase in future periods.Risk factors (Item 1A)
Competitors
CrowdStrike
competes withnamed as a riskWe compete with large and small public companies, such as CrowdStrike, Palo Alto Networks, Rapid7, and Tenable Holdings, as well as privately held security providers including Invicti, Tanium, and Wiz (which has announced a pending acquisition by Google).Risk factors (Item 1A)
Palo Alto Networks
competes withnamed as a riskWe compete with large and small public companies, such as CrowdStrike, Palo Alto Networks, Rapid7, and Tenable Holdings, as well as privately held security providers including Invicti, Tanium, and Wiz (which has announced a pending acquisition by Google).Risk factors (Item 1A)
Rapid7
competes withnamed as a riskWe compete with large and small public companies, such as CrowdStrike, Palo Alto Networks, Rapid7, and Tenable Holdings, as well as privately held security providers including Invicti, Tanium, and Wiz (which has announced a pending acquisition by Google).Risk factors (Item 1A)
Tenable Holdings
competes withnamed as a riskWe compete with large and small public companies, such as CrowdStrike, Palo Alto Networks, Rapid7, and Tenable Holdings, as well as privately held security providers including Invicti, Tanium, and Wiz (which has announced a pending acquisition by Google).Risk factors (Item 1A)
Wiz
competes withnamed as a riskWe compete with large and small public companies, such as CrowdStrike, Palo Alto Networks, Rapid7, and Tenable Holdings, as well as privately held security providers including Invicti, Tanium, and Wiz (which has announced a pending acquisition by Google).Risk factors (Item 1A)
Tanium
competes withnamed as a riskWe compete with large and small public companies, such as CrowdStrike, Palo Alto Networks, Rapid7, and Tenable Holdings, as well as privately held security providers including Invicti, Tanium, and Wiz (which has announced a pending acquisition by Google).Risk factors (Item 1A)
Places
India
concentrated in · 70% of our employeesnamed as a riskIn addition, as of December 31, 2025, approximately 78% of our employees were located outside of the United States, with 70% of our employees located in India.Risk factors (Item 1A)
Also named by A, AAPL, ACN, AJG, AKAM, AMZN, AOS, AVGO and 54 more
United States
earns from · 56%In 2025, 2024 and 2023, 56%, 58% and 60%, respectively, of our revenues were derived from customers in the United States based on our customers' billing addresses.Business (Item 1)
Also named by ABBV, ADP, AJG, AMGN, APA, AXGN, AXP, BALL and 139 more
Europe
earns fromnamed as a riskFurthermore, the continued weakness and uncertainty in worldwide credit markets, including the sovereign debt situation in certain countries in the European Union, may adversely impact our European operations, as well as our current and potential customers' available budgetary spending, which could lead to delays or reductions in planned purchases of our solutions.Risk factors (Item 1A)
Also named by ADSK, AME, AMRC, ATR, BCSF, BKNG, BMI, BMY and 60 more
Hazards
Earthquakes
operates innamed as a riskA significant natural disaster, such as an earthquake, fire or a flood, or a significant power outage could have a material adverse impact on our business, operating results and financial condition.Risk factors (Item 1A)
Also named by AAPL, AMKR, AN, ANET, APP, BRO, CDNS, CEG and 37 more
Commodities and inputs
Euro
exposed to its price · €54.3 millionnamed as a riskAs of December 31, 2025, we had designated cash flow hedge forward contracts with notional amounts of €54.3 million, £24.1 million and Rs.5,526.0 million and non-designated forward contracts with notional amounts of €24.4 million, £6.8 million, Rs.2,723.0 million and C$2.5 million.Market risk (Item 7A)
Also named by ABBV, ABNB, ABT, ADBE, ADI, AME, AMG, AMGN and 186 more
British Pound
exposed to its price · £24.1 millionnamed as a riskAs of December 31, 2025, we had designated cash flow hedge forward contracts with notional amounts of €54.3 million, £24.1 million and Rs.5,526.0 million and non-designated forward contracts with notional amounts of €24.4 million, £6.8 million, Rs.2,723.0 million and C$2.5 million.Market risk (Item 7A)
Also named by ABBV, ADBE, AJG, AME, AMP, APA, BF/B, BRO and 39 more
Indian Rupee
exposed to its price · approximately 31% of our expenses in foreign currenciesnamed as a riskHowever, for the year ended December 31, 2025, we incurred approximately 31% of our expenses in foreign currencies, primarily the Euro, British Pound, and Indian Rupee, principally with respect to salaries and related personnel expenses associated with our European and Indian operations.Risk factors (Item 1A)
Also named by ACN, ADBE, AJG, AVY, BEN, CIEN, CTSH, EEFT and 11 more
Regulators
Payment Card Industry Security Standards Council (PCI Council)
named as a riskFor example, many of our customers subscribe to our IT, security and compliance solutions to help them comply with the security standards developed and maintained by the Payment Card Industry Security Standards Council, or the PCI Council, which apply to companies that store cardholder data.Risk factors (Item 1A)
Laws and programs
General Data Protection Regulation (GDPR)
subject tonamed as a riskFor example, the European Union's General Data Protection Regulation (“GDPR”), which took effect in May of 2018, provides for substantial obligations relating to the handling, storage, and other processing of data relating to individuals and administrative fines for violations, which can be up to the greater of four percent of the previous year’s annual revenue or €20 million.Risk factors (Item 1A)
Also named by A, AB, ABNB, ADBE, ADP, AGX, AIOT, AJG and 100 more
Export Administration Regulations
subject tonamed as a riskOur solutions are subject to U.S. export controls, specifically, the Export Administration Regulations and economic sanctions enforced by the Office of Foreign Assets Control.Risk factors (Item 1A)
Also named by ADI, ALAB, AMD, APP, ARW, AVGO, CARR, CDRE and 40 more
EU-U.S. Data Privacy Framework
subject tonamed as a riskBoth the EU-U.S. Data Privacy Framework and SCCs have, however, been subject to legal challenge.Risk factors (Item 1A)
Also named by ADBE, APP, CRM, CRWD, DDOG, DOCN, GTLB, IDXX and 12 more
Federal Risk and Authorization Management Program (FedRAMP)
subject tonamed as a riskSuch certification is subject to rigorous compliance and if we lose our certification, it could inhibit or preclude our ability to contract with certain U.S. federal government customers.Risk factors (Item 1A)
Also named by QBTS
Federal Information Security Management Act (FISMA)
subject tonamed as a riskWe have invested in the creation of a cloud offering certified under the Federal Information Security Management Act for government usage but we cannot be sure that we will continue to sustain or renew this certification, that the government will continue to mandate such certification or that other government agencies or entities will use this cloud offering.Risk factors (Item 1A)
Digital services tax
subject tonamed as a riskFurthermore, certain jurisdictions, such as the U.K. and France, have enacted a digital services tax, which is generally a tax on gross revenue generated from users or customers located in those jurisdictions, and other jurisdictions are considering enacting similar laws.Risk factors (Item 1A)