How Qualys Makes Money

Qualys operates a pure-play multi-tenant cloud Software-as-a-Service (SaaS) subscription business model characterized by exceptional software gross margins, high operating profitability, and predictable annual recurring revenue: (1) Qualys Cloud Platform Subscriptions (~95% of revenue), billed annually in advance based on the number of monitored IT assets, IP addresses, web applications, and cloud workloads. Customers purchase access to modular cloud applications—including VMDR (Vulnerability Management, Detection, and Response), Policy Compliance, Cloud Security Assessment (CSAM), and File Integrity Monitoring; (2) Automated Patch Management Add-On (~5% of revenue), which monetizes native automated patch deployment directly from the Qualys Cloud Agent, allowing customers to remediate vulnerabilities without switching to separate endpoint management tools. Qualys generates stellar GAAP gross profit margins exceeding 80% and an extraordinary net profit margin of 27.1%, supported by an ultra-efficient multi-tenant server infrastructure.

Under CEO Sumedh Thakar, Qualys is pursuing four clear corporate growth pillars: (1) Scaling Qualys TruRisk Risk Quantification: Expanding TruRisk adoption to translate technical vulnerabilities into quantified monetary risk scores that corporate boards and CISOs can understand and prioritize; (2) Expanding Cloud-Native Patch Management: Driving adoption of integrated automated patch deployment, eliminating the traditional friction between security teams and IT operations; (3) Cybersecurity Asset Management (CSAM) Expansion: Enabling global enterprises to continuously discover unmanaged external-facing assets, IoT devices, and shadow cloud instances across complex hybrid environments; and (4) Strategic Global Alliances & MSSP Scaling: Deepening strategic relationships with Managed Security Service Providers (MSSPs) such as Infosys, HCL, and Accenture, who utilize Qualys as the underlying scanning engine for their global security practices.