Qualys : Q4 FY 2021 Prepared Remarks

Qualys Q4 FY2021 Earnings Prepared Remarks

Foster City, Calif., - February 10, 2022 -Qualys, Inc.(NASDAQ: QLYS), a pioneer and leading provider of disruptive cloud-based IT, security and compliance solutions, today announced financial results for the fourth quarter ended December 31, 2021.

Blair King, Investor Relations

Good afternoon and welcome to Qualys' fourth quarter 2021 earnings call.

Joining me today to discuss our results are Sumedh Thakar, our president and CEO, and Joo Mi Kim, our CFO. Before we get started, I would like to remind you that our remarks today will include forward-looking statements that generally relate to future events or our future financial or operating performance. Actual results may differ materially from these statements. Factors that could cause results to differ materially are set forth in today's press release and our filings with the SEC, including our latest Form 10-Q and 10-K. Any forward-looking statements that we make on this call are based on assumptions as of today, and we undertake no obligation to update these statements as a result of new information or future events.

During this call, we will present both GAAP and non-GAAP financial measures. A reconciliation of GAAP to non-GAAP measures is included in today's earnings press release. As a reminder, the press release, prepared remarks and investor presentation are available on the Investor Relations section of our website. With that, I'd like to turn the call over to Sumedh.

Sumedh Thakar, president and CEO

Thanks, Blair, and welcome, everyone, to our fourth quarter earnings call. We are very pleased to report another quarter of strong financial performance, reflecting a year of progress in our efforts of advancing our go-to-market initiatives, significant platform innovation, and strong momentum heading into 2022.

Q4 Financial & Business Update

In Q4, Cloud Agent subscriptions grew 34% year-over-year to 75 million purchased over the last twelve months. There was also a steady adoption of our Vulnerability Management, Detection and Response, or VMDR, solution, which is now deployed by 36% of customers worldwide. These results continue to validate our security consolidation approach and the power of a single agent as customers increasingly transition to VMDR.

Our go-to-market enhancements are starting to yield results as we're executing well to seize on heightened demand trends and opportunities we see in the market. The customer stories I will share with you today not only highlight our growing leadership among large enterprise customers, but also the growing desire among CIOs and CISOs to consolidate their security stack and leverage automation in their security and compliance operations to achieve expedient remediation

1

of risk their organizations face.

Recent high profile ransomware attacks and critical vulnerabilities like Log4Shell and PwnKit have highlighted organizations need for a scalable vulnerability management solution like Qualys' VMDR, that not only accurately detects these vulnerabilities but also helps reduce exposure time with integrated asset discovery and remediation capabilities. Within days of Apache announcing Log4Shell vulnerability, the Qualys vulnerability research, engineering and product teams released a free 30-day Log4Shell detection and remediation service leveraging multiple Qualys capabilities like CyberSecurity Asset Management, VMDR, Patch Management and Web Application Scanning. Since the Log4Shell announcement in early December of last year, the Qualys Cloud Platform has detected millions of unique Log4J vulnerabilities, underscoring the strategic relevance of our platform in customer environments. Additionally, given the extensive impact of Log4Shell to global organizations, our research team released multiple open-source tools to help discover and remediate this vulnerability for the global community, further demonstrating both our leadership and commitment to the industry.

A few illustrative wins in the quarter include an existing Global Fortune 200 customer in the EMEA region, which standardized on Qualys' VMDR, Policy Compliance, Patch Management and Asset Inventory capabilities to cost effectively consolidate its stack of legacy enterprise security and compliance solutions onto a natively integrated platform linking multiple data center and endpoint environments.

In addition, a new Fortune 600 customer selected VMDR and Cybersecurity Asset Management over several competing solutions. The ability to uniquely provide comprehensive asset discovery for security centric visibility, CMDB sync integration, alerting and accurate response capabilities once again stood out among vulnerability detection only solutions in the market and was a key differentiator in our win.

We believe these new wins and the early success we're experiencing with our newer applications characterize that when customers are ready to rearchitect and consolidate their security stack, Qualys is the best cloud-native,multi-solution platform to meet their needs.

2021 Year in Review and Looking Ahead to 2022

Looking back at 2021, I believe the Qualys team has responded incredibly well to unexpected challenges and opportunities, demonstrating the transformative value of our newer solutions, the depth of our customer relationships, and the extraordinary capabilities of our global and diverse team.

We continued to broaden our platform and grow our business, building a strong team with addition of new executives, including a new CRO, CMO, CPO, and CIO. More recently, Bill Berutti joined our Board in December. Bill has extensive go-to-market experience in enterprise software Sales and Marketing, and we believe he will be a great asset to the team as we build out our go-to- market motion in 2022.

With this foundation in place, over the next several quarters, we plan to increase our Sales and Marketing investment with a focus on digital marketing programs to drive pipeline and customer reach, grow our sales team to further leverage our opportunity in the market, and expand our channel by recruiting and enabling partners.

2

With respect to platform innovation, our goal is to remove friction for customers by making product expansion simple and hassle-free. A customer who may currently only use VMDR should be able to adopt all of our other applications at the click of a button.

In 2021, we executed well against this objective while changing the game in security as we brought together asset inventory, risk mitigation and threat detection and response into a natively integrated cloud-based platform. We believe these platform innovations have helped customers remediate vulnerabilities much faster than alternative siloed solutions.

Further advancing our platform innovation agenda, I'm pleased to announce our Context Extended Detection and Response, or XDR, solution is now in GA. As many of you know, this is a natural extension to the Qualys Cloud Platform and our next generation security analytics and incident response application. Our Context XDR application natively integrates and correlates asset and risk-based context vulnerability management, patching, EDR and File Integrity Monitoring, or FIM, security telemetry with additional third-party data integration to provide high-fidelity detection and response. Customers are telling us they want a simplified solution to security analytics and response. This solution satisfies that demand as it leverages our scalable backend and its array of sensors, which already collect, enrich, normalize and correlate trillions of data points across all environments on a single agent for Qualys customers. While the overall market for this solution is still in the early innings, we are excited about this product and its potential, especially in light of the positive feedback we're receiving from customers who have been early adopters of our XDR capabilities.

Looking ahead to 2022, we plan to maintain a dual innovation strategy. Primarily, we will continue to invest in internal R&D and scale our organization to further differentiate our automation, detection and response capabilities. And, we'll further expand our product portfolio into EDR, cloud, container security and industrial controls systems and operational technology security. Secondarily, making highly targeted and opportunistic acquisitions to enhance our platform and accelerate our time to market. As a reminder, in 2021, we completed the acquisition of TotalCloud to bring visual cloud remediation workflow technology to the Qualys Cloud platform.

To further support our growth agenda, we plan to invest more broadly in the business to expand our cloud platform presence; and, to enhance our business processes, tools and systems to help drive better operational efficiency and business outcomes.

In summary we believe the Qualys Cloud Platform is the go-to solution for agent consolidation, cost savings, increased user productivity and better cyber protection. We believe we're well positioned to continue our market momentum and expand our leadership as we build on our success, enhance our platform capabilities, and further extend our reach into new and adjacent markets.

With that, I'll turn the call over to Joo Mi to further discuss our fourth quarter results and outlook for the first quarter and full year 2022.

Joo Mi Kim, Chief Financial Officer

Thanks, Sumedh, and good afternoon. Before I start, I'd like to note that, except for revenue, all financial figures are non-GAAP and growth rates are based on comparisons to the prior year period, unless stated otherwise.

We're pleased to report continued growth acceleration and strong profitability as reflected in the

3

following financial and operational highlights:

• Revenues for the fourth quarter of 2021 grew 16% to $109.8 million, up from 13% growth in Q3. While the majority of the beat was due to outperformance in renewal and upsell with our net dollar expansion rate increasing to 108%, up from 103% last year, a higher-than-expected growth in new business also contributed to the revenue acceleration. With our Q4 LTM calculated current billings growth at 18.5%, up from 16% in Q3, and 13% in Q2, we are entering the year with strong momentum and increased confidence in our ability to drive shareholder value;
• We believe the investments we've made in platform innovation and our single agent approach have enhanced our value proposition with customers and helped win new business opportunities throughout the year. This quarter was no different, and we're excited by the continued adoption of VMDR with total customer penetration now at 36%, up from 32% in Q3 and 19% a year ago; and
• Continued adoption of Qualys solutions increased large customer spend with now over 125 customers spending $500,000 or more with us. This represents 17% growth from 2020. We attribute this success to our position as a leading security and compliance cloud-based platform that is centrally managed and self-updating, allowing our customers to consolidate their stack while helping to build security and compliance into their digital transformation initiatives.

Our scalable platform model continues to drive superior margins and significant cash flow:

• Adjusted EBITDA for the fourth quarter of 2021 was $49.6 million, representing a 45% margin;
• EPS for the fourth quarter of 2021 was $0.84; and
• Our free cash flow for the fourth quarter of 2021 was $35.5 million, representing a 32% margin.

In Q4, we continued to invest the cash we generated from operations back into Qualys including:

• $4.3 million on capital expenditures; and
• $35.1 million to repurchase 273 thousand of our outstanding shares.

Looking back on the year, we are proud to have continued our product leadership while growing revenue, earnings, and cash flow for shareholders. In 2021:

• With focused execution, we finally crossed the growth inflection point and started on our journey of revenue acceleration. We operated effectively through the pandemic and management changes in the company to reverse course in delivering better than expected results on both new and existing customer expands.
• Cloud Agent adoption grew over 34%, from 56 million Cloud Agent subscriptions a year ago, and VMDR now accounts for 46% of total bookings. This is a testament to our success in continuing to build relationships with customers and opportunities ahead to seamlessly cross sell other Qualys solutions such as Patch Management, Cybersecurity Asset Management, Multi-Vector EDR, and recently launched XDR.
• Notably this was achieved even before a meaningful increase in investment with EBITDA margin of 46%. The leverage we generate demonstrates the efficiency of our

4

model and gives us confidence in stepping-up ongoing investments in the business. With the new executive team, we plan to significantly increase investments across business functions to maximize return and also to enable us to remain highly competitive in the talent market.

• Last year, we grew EPS by 12% and generated strong free cash flow, ending the year with a 43% margin and over $500 million of cash, cash equivalents, and marketable securities on our balance sheet. This is after returning $130 million of cash to shareholders by repurchasing approximately 1.1 million of shares. Given our highly scalable business model, even with incremental additional investments in 2022, we believe that we will continue to deliver industry-leading margins relative to peers.

Shifting now to guidance for 2022, our success validates our thesis that organizations of all sizes are increasingly looking to consolidate their security stack onto a single agent with our solutions. With an executive leadership team in place, armed with powerful new Cloud Platform capabilities, we believe the time is right for us to flex the power of our platform in the market and invest more in the business. Given this, we anticipate operating expenses to increase as we expand our sales organization and our channel efforts as well as focus on digital marketing and demand generation initiatives. Additionally, as a leading vendor of security and compliance solutions, innovation remains a top priority. So, incremental investment in our platform is anticipated to enhance automation and cloud security capabilities for our customers. And, to support our growth expectations, we expect to make investments in our infrastructure and our people throughout the year. We believe these planned investments will position us to further accelerate our growth and maximize shareholder value.

• With that framework in mind, for 2022, we expect full year revenues to be in the range of $482 million to $485 million, which represents a range of 17% to 18% growth.
• In terms of profitability, we expect full year EPS to be in the range of $2.87 to $2.92. This implies EBITDA margin in the high 30s with higher incremental increase in expense in the second half of the year.
• For the first quarter, we expect revenues to be in the range of $112.5 million to $113.1 million, which represents a range of 16% to 17% growth. We expect EPS to be in the range of $0.80 to $0.82.
• Our planned capital expenditures in Q1 is approximately $6 million to $7 million and for the full year 2022, we expect to invest in the range of $25 million to $30 million.

In conclusion, as we enter 2022, we remain excited about our opportunity to drive durable top- line growth while leveraging our highly scalable model to maintain industry-leading profitability and margin expansion in the future.

With that, Sumedh and I are happy to answer any of your questions.

Closing Remarks

Thank you all for joining us today. I want to briefly reiterate that we believe the future of Cybersecurity resides on a single unified platform driven by solutions designed to solve key IT and security and compliance challenges. We're entering 2022 with strong momentum to accelerate growth along with a balanced approach to profitability. We look forward to sharing continued progress in coming quarters.

5