Qualys Inc. Shareholders: Ownership Structure, Brands, and Acquisition History
Last updated: Oct-2026Ownership Structure
Ownership Analysis
Nobody controls Qualys, and we have no quarrel with the plain "Public" label. No filing we reviewed shows a founder or family block. Our estimate is that any stake still held by the late chairman's family is too small to move a vote.The most useful insider number is Thakar's own. He held 196,686 shares after selling 30,000 on June 30, 2026 at $130, $135 and $140 under a plan adopted on February 27. We calculate that those shares would be worth about $5.9 million at $196.52, roughly $1.85 million more than the $4.05 million he received. His remaining shares are 0.56% of the company and worth about $38.7 million.His 2025 grant of 161,786 units works out to $133.70 a unit. We calculate the unvested package at about $31.8 million at the current price, so each $10 move in the stock changes its value by about $1.6 million. That ties him to the share price more tightly than his open market holding does, and we side with the board on that pay design. The 3.1% share request is a closer call, but we are comfortable with it while the burn rate stays at the 2.5% the proxy reports.We question how independent a chair can remain after sixteen years on one board. Hank joined in January 2010, and the staggered terms mean only three of seven seats face a vote each year. Because three of seven seats face election each year, a challenger would need two annual meetings to win four seats, and we think that delay protects the incumbent board more than the current holder list does. We expect little friction anyway, because the largest holders are index funds that seldom oppose directors, and the next elections will not bring a contest.
Direct Owners
Institutional Shareholders
Shareholder Analysis
Index managers dominate the shareholder list, and the two Vanguard units are one owner for practical purposes. Added together, Vanguard Portfolio Management and Vanguard Capital Management hold 12.17%, and BlackRock lifts the group to 27.3%. We calculate that a 10% trim by those three would release about 0.96 million shares, worth close to $189 million at $196.52. That equals almost exactly a full year of company buybacks, so the repurchase program could absorb one such sale but not two.The company returned $183.4 million in 2025 against free cash flow of $304.4 million, or 60%. After subtracting $77.0 million of stock compensation, free cash flow falls to $227.4 million and the payout becomes 81%. Through June 2026 repurchases took 88% of the $149.5 million generated. We part ways with those who count the full dollar amount as shrinkage, because new equity awards refill part of it. The diluted count actually fell 4.1% in a year.We back the buyback, and our reason is price. The stock traded at $143.44 at the end of June and has a 52 week low of $74.51, so shares bought before the summer rally are already up at least 37%. The $200 million increase would retire about 1.02 million shares today, or 2.9% of the 34.6 million outstanding. With the $696.9 million of liquid investments held on December 31 netted off, the market value of $6.80 billion is about 19 times trailing free cash flow of $313.9 million. Our trust in the buyback fades above $200, where the 52 week high of $204.41 sits and where 22 analysts, on average, rate the stock Hold with a target of $179.36, which sits 8.7% below the October 6 price.
Brands, Subsidiaries & Companies Owned
| Name | Type | Description |
|---|---|---|
| Qualys Cloud Platform | Brand | Subscription platform that delivers every Qualys app through lightweight agents and scanners |
| VMDR | Brand | Vulnerability Management Detection and Response app that anchors the product line |
| TotalCloud | Brand | Cloud security app built on the 2021 TotalCloud acquisition and later given FedRAMP High authorization |
| TotalAppSec | Brand | Web application and API security testing app |
| Enterprise TruRisk Management | Brand | Risk scoring and prioritization software released in November 2023 |
| Cybersecurity Asset Management | Brand | Asset inventory app that feeds the other modules |
| Patch Management | Brand | Automated patch deployment tied to vulnerability findings |
| Multi-Vector EDR | Brand | Endpoint detection and response app that sits beside VMDR |
| Policy Audit | Brand | Configuration compliance scanning for regulated customers |
| File Integrity Monitoring | Brand | Change monitoring for files and systems used in compliance audits |
| Qualys GovCloud Platform | Brand | Isolated federal edition that received FedRAMP High authorization in 2025 |
| Agent Val | Brand | Agentic AI tool debuted in March 2026 |
Portfolio Analysis
Qualys reports a single segment, so the economics sit in the mix of customers, channels and staff. The company says it has over 10,000 customers, which caps revenue per customer at about $66,900 on $669.1 million of 2025 sales. That is low for a platform the 10-K says is used by most of the Forbes Global 100, and it points to a long tail of smaller accounts.Geography is balanced. The United States supplied 56% of 2025 revenue and other countries 44%. The cost base is not balanced: 78% of the 2,625 employees work outside the United States, 70% in India, and research and development alone has 1,262 people, or 48% of headcount. We calculate revenue per employee at about $255,000. We attribute much of the 45.5% free cash flow margin to that staffing mix.Guidance shows the product cycle. Management raised 2026 revenue in August to $732 million to $738 million from $717 million to $725 million. We expect the new midpoint of $735 million to need about $377 million in the second half, 9.3% above the $345.1 million of the same half in 2025, which looks reachable at the 11% growth of the latest quarter.Current deferred revenue was $388.1 million on June 30, down 3.2% from $401.1 million at year end. We are comfortable with that dip because the guidance midpoint rose by $14 million over the same months.FedRAMP High status for GovCloud and TotalCloud opens federal buying, but without a government revenue figure we add nothing to our forecast for it. VMDR, Enterprise TruRisk Management, released in November 2023, and Agent Val, the agentic AI tool launched in March 2026, are the products asked to carry growth.
Market Share & Competitors
| Company | Market Share | Revenue | Key Strength |
|---|---|---|---|
| Qualys ★ | N/A | $669.1M FY2025 | Cloud agent platform with a free cash flow margin of about 45% |
| Tenable | N/A | $999.4M FY2025 | Exposure management rival with the closest product overlap |
| Rapid7 | N/A | $859.8M FY2025 | Detection and response vendor with slow 2025 growth |
| CrowdStrike | N/A | $4.81B FY2026 | Endpoint security platform with a large installed base |
| Palo Alto Networks | N/A | $11.48B FY2026 | Network and cloud security platform with broad bundling power |
Competitive Analysis
Tenable is the comparison that matters. Its 2025 revenue of $999.4 million was 11.0% above 2024's $900.0 million, almost the pace of Qualys at 10.1%, and Qualys is about 67% of its size. Rapid7 grew just 1.9% to $859.8 million and carries $961.65 million of debt against $702.58 million in cash and investments, while Qualys held $696.9 million of liquid investments at the end of 2025. We side with Qualys on balance sheet quality, though we did not verify its debt position.Profit is where the gap opens. Qualys earned a profit of $198.3 million, a 29.6% margin, while Rapid7 made $23.4 million, or 2.7%, and CrowdStrike lost $162.5 million on $4.81 billion of fiscal 2026 revenue. Free cash flow margins tell the same story: 45.5% for Qualys, 35.8% for Palo Alto Networks, 29.8% for CrowdStrike and 16.9% for Rapid7. We part ways with the idea that scale alone wins here, because the smallest listed rival is also the most profitable.Palo Alto Networks, with $11.48 billion of fiscal 2026 revenue and $4.11 billion of free cash flow, is the real threat to Qualys by bundling. Its free cash flow alone is 6.1 times Qualys's revenue, and it can give away vulnerability features inside a larger contract. The 10-K also names Invicti, Tanium and Wiz as private rivals.We expect the largest platforms to keep taking cloud workload spending from the small ones, and our estimate is that the Qualys agent base will protect most of its core vulnerability revenue. The fiscal years differ: CrowdStrike ends in January and Palo Alto Networks in July, so its latest year closed two months after the Qualys half year ended.
Acquisitions
| Company Acquired | Deal Value | Year | Description |
|---|---|---|---|
| Layered Insight Inc | $20.0M | 2018 | Container security company bought for a $12M base price plus a $4M earn-out and $4M of retention pay |
| Blue Hexagon Inc | $10.0M | 2022 | AI and machine learning threat detection assets with $8.5M paid at closing and $1.5M held in escrow |
| TotalCloud | undisclosed | 2021 | Cloud workflow and no code automation platform |
| Adya Inc | undisclosed | 2019 | SaaS application management software assets |
| 1Mobility | undisclosed | 2018 | Singapore based mobile device management and compliance software assets |
| Nevis Networks | undisclosed | 2017 | Network traffic analysis assets bought for cash |
| NetWatcher | undisclosed | 2017 | Network detection technology bought the same year as Nevis |
Acquisitions Analysis
Qualys has bought small and cheaply. Only two of the seven deals have a price on record: Layered Insight in October 2018 at $20.0 million in total and Blue Hexagon in October 2022 at $10.0 million. We calculate those disclosed prices at $30.0 million, which is 9.9% of the free cash flow earned in 2025 alone ($304.4 million) and 0.44% of today's market value. The five undisclosed purchases were Nevis Networks, NetWatcher, 1Mobility, Adya and TotalCloud. The first four were bought as assets or software and technology rather than whole companies. We side with this approach and question only the silence on price. TotalCloud, bought in August 2021 when the stock closed at $105.11, is the clearest payoff, since it now carries FedRAMP High authorization. The three 2017 and 2018 purchases of network and mobile software have no visible product of their own in today's 10-K list of cloud apps, which implies the technology was folded into the platform rather than sold separately. Blue Hexagon's price bought machine learning staff, and Nayeem Islam stayed on as vice president of product management.No deal has been reported since October 2022, nearly four years, while buybacks of $183.4 million in 2025 alone were more than eighteen times the Blue Hexagon price. Our estimate is that management sees its own stock as the better use of cash. Nothing stops it from changing course, and the August 2026 earnings release mentions no pending purchase. We calculate that even a $100 million deal would cost about four months of free cash flow at the 2026 pace. We back that discipline as long as the platform keeps growing at about 10% without outside technology.
Acquisition Timeline
Merger & Spin-off History
Merger & Spin-off Analysis
No merger, spin-off or takeover approach appears in the filings and articles we reviewed. The record is one equity event, the September 28, 2012 listing on Nasdaq, plus a run of asset purchases. We trust the structure of those purchases more than their size. Asif Awan of Layered Insight became chief technology officer of Qualys Container Security after that deal.Terms were built to keep risk with the sellers. Layered Insight carried $20.0 million in total: a $12 million base, a $4 million earn-out and $4 million of retention pay, so 40% of the price depended on staying and performing. Blue Hexagon was paid mostly in cash with part in stock subject to vesting, and $1.5 million of the $10.0 million, or 15%, went into escrow for 18 months, which ran to about April 2024. We are comfortable with this design because it limits cash at risk and issues few shares. The other deals disclosed no price at all.The missing piece is Qualys as a target. Marketscreener puts the free float at 99.55%, so a bidder would have to buy from index funds and asset managers rather than negotiate with a founder block. We calculate that each 10% takeover premium on the $6.80 billion market value costs a buyer about $680 million, which would put a 30% premium near $8.8 billion. We expect that price to deter most security vendors, and we have seen no report of any offer, which fits the share register. Cash funded the deals. When TotalCloud was bought in August 2021 Qualys held $356.7 million in cash, so a large price would have taken a visible share of it. Our estimate is that each undisclosed price was small, in the single digits or low tens of millions of dollars, given the cash on hand and the size of the two disclosed prices.
Ownership History
Ownership History Analysis
Qualys began in 1999 with Courtot among its first investors, and it launched its QualysGuard scanning service in 2000. Courtot took over as chief executive and chairman in 2001, so the founders credited in secondary sources, Langlois and Samoun, were gone from the top job by then. We question the habit of calling Courtot the founder, since he was an early investor who became the chief executive.The listing in 2012 turned a privately funded company into a widely held one, and the first decade as a public company brought the cloud platform and agent in 2015. Revenue reached $554.5 million in 2023, $607.6 million in 2024 and $669.1 million in 2025, growth of 9.6% and then 10.1%. We calculate that growth has been within a point of 10% for two years running, an unusually steady rate for a company this size.The 2021 changeover was the sharpest break. Courtot resigned in March, Thakar became chief executive in April, and Courtot died in June. The shares stood at $105.11 when TotalCloud was bought that August. At $196.52 now it is 87% higher, and it has traded as low as $74.51 within the last year, so a holder who bought at the low is up 164%.Trailing twelve month revenue is now $702.98 million, 5.1% above calendar 2025, and the second quarter grew 11% to $182.2 million. We are comfortable with a board that kept growth intact through the death of its former chairman. We expect the holder list to stay concentrated in index managers. We back the board's choice of an internal successor, because revenue growth held at 10.1% in 2025 after Courtot's departure, and cash generation rose 27% that year.
Ownership Explained
Qualys Inc. sells vulnerability and compliance software by subscription from Foster City, California, and its shares trade on Nasdaq under the symbol QLYS. On October 6, 2026 the stock was quoted at $196.52, which put the market value at $6.80 billion. The proxy record date of April 14, 2026 showed 35,289,949 shares outstanding, down from 35,675,926 on February 11.A single class of common stock exists, each share carries one vote, and the proxy shows no voting agreement among holders. MarketScreener lists BlackRock with 15.1%, or 5,317,913 shares, followed by Vanguard Portfolio Management at 7.66%, Vanguard Capital Management at 4.52%, State Street at 4.14% and Legal and General Investment Management at 4.08%. Together the five hold about 35.5%.The company dates to 1999. Wikipedia names Philippe Langlois and Gilles Samoun as its founders. Philippe Courtot, who had started the email software maker cc:Mail in 1988, invested in 1999 and became chief executive and board chairman in 2001. He resigned in March 2021 for health reasons and died in June 2021 at age 76. None of the filings and articles reviewed names a stake held by his family or estate.Sumedh Thakar has been President and Chief Executive Officer since April 2021. Jeffrey Hank, an independent director since January 2010, has chaired the seven member board since January 2023. Qualys went public on Nasdaq on September 28, 2012.The business employed 2,625 full time people at the end of 2025 and reported revenue of $669.1 million for the year, up from $607.6 million in 2024. Revenue for the six months to June 30, 2026 was $357.8 million, and profit was $103.0 million against $94.8 million a year earlier. Grant Thornton LLP audits the accounts, and the company's 10-K counts over 10,000 customers.
Repurchases are how owners are paid. Qualys spent $183.4 million on its own stock during 2025 and a further $131.4 million over the first six months of 2026, and its February 2026 results announcement added $200 million to the program. Weighted diluted shares were 36.5 million in the second quarter of 2025 and 35.0 million a year later.New shares flow the other way through pay. Thakar's 2025 equity grant was valued at $21,632,551 for 161,786 restricted and performance units, and stock compensation across the company was $77.0 million, or 11.5% of revenue. The proxy for the June 10, 2026 meeting asked holders to add 1,089,000 shares to the 2012 Equity Incentive Plan, equal to 3.1% of the shares outstanding. The plan still had 1,487,107 shares available on March 31, 2026, and the proxy puts its annual burn rate at 2.5%.Federal customers reach Qualys through certification rather than a disclosed contract. The Qualys GovCloud Platform received FedRAMP High authorization in 2025, and TotalCloud later won the same level with the Drug Enforcement Administration as sponsor. The annual report gives no revenue figure for government buyers.Board turnover is staggered. At the June 10, 2026 meeting holders voted on three Class II directors, Bradford Brooks, Wendy Pfeiffer and John Zangardi, for terms ending in 2029, so only three of the seven seats were contested. The audit fee paid to Grant Thornton was $1,842,510 for 2025. Non-employee directors held unvested awards of 1,879 to 3,198 shares at December 31, 2025, and under guidelines amended in October 2024 each must own stock worth six times the annual retainer within five years of joining.Resellers and service partners are the other group tied to shareholder returns, because they brought in 49% of 2025 revenue, up from 46% in 2024 and 43% in 2023. Direct sellers handled the remainder.