UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

FORM 8-K

CURRENT REPORT

Pursuant to Section 13 or 15(d)

of The Securities Exchange Act of 1934

Date of Report (Date of earliest event reported)

October 25, 2018

Qualys, Inc.

(Exact name of registrant as specified in its charter)

919 East Hillsdale Boulevard

Foster City, California 94404

(Address of principal executive offices, including zip code)

(650) 801-6100

(Registrant’s telephone number, including area code)

(Former name or former address, if changed since last report)

Check the appropriate box below if the Form 8-K filing is intended to simultaneously satisfy the filing obligation of the registrant under any of the following provisions (see General Instruction A.2):

Indicate by check mark whether the registrant is an emerging growth company as defined in Rule 405 of the Securities Act of 1933 (17 CFR §230.405) or Rule 12b-2 of the Securities Exchange Act of 1934 (17 CFR §240.12b-2).

Emerging growth company  ☐

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act.  ☐

On October 30, 2018, Qualys, Inc. (“Qualys” or the “Company”) issued a press release announcing its financial results for the quarter ended September 30, 2018. In the press release, Qualys also announced that it will hold a conference call on October 30, 2018, to discuss its financial results for the quarter ended September 30, 2018. The full text of the press release is attached hereto as Exhibit 99.1 and is incorporated herein by reference.

This information is intended to be furnished under Item 2.02 of Form 8-K, “Results of Operations and Financial Condition” and shall not be deemed “filed” for purposes of Section 18 of the Securities Exchange Act of 1934, as amended (the “Exchange Act”), or incorporated by reference in any filing under the Securities Act of 1933, as amended, or the Exchange Act, except as shall be expressly set forth by specific reference in such a filing.

Appointment of Director

On October 25, 2018, the Board of Directors of the Company (the “Board”) appointed Patricia Hatter to serve on the Board as a Class II director. Ms. Hatter will serve on the Board until the Company’s 2020 annual meeting of stockholders or until her successor is duly elected and qualified. In addition, Ms. Hatter was appointed as a member of the compensation committee of the Board and as a member of the nominating and governance committee of the Board, effective immediately.

Ms. Hatter, age 56, has served as a strategic advisor to various private companies since July 2017. Previously, Ms. Hatter served as the General Manager and Senior Vice President – Services, and Interim Chief Information Officer of McAfee, LLC, a global computer security software company, from January 2016 to July 2017. Ms. Hatter also served as Chief Information Officer – Intel Security and General Manager – Security & Software, of Intel Corporation, a leader in the semiconductor industry, from June 2015 to January 2016, and as Chief Information Officer and Senior Vice President – Operations, of McAfee, LLC from October 2010 to June 2015. Ms. Hatter also currently serves as a member of the Board of Directors of Barrick Gold Corporation, the largest gold mining company in the world. Ms. Hatter holds a B.S. and a M.S. in mechanical engineering from Carnegie Mellon University.

Ms. Hatter will be compensated for her service on the Board in accordance with the Company’s standard compensation policy for non-employee directors, the terms of which were described in the Company’s proxy statement for its 2018 annual meeting of stockholders.

In addition, Ms. Hatter will enter into the Company’s standard form of indemnification agreement, a copy of which was previously filed on August 10, 2012 as Exhibit 10.10 to the Company’s Registration Statement on Form S-1 (File No. 333-182027).

There is no arrangement or understanding between Ms. Hatter and any other persons pursuant to which Ms. Hatter was elected as a director. In addition, Ms. Hatter is not a party to any transaction, or series of transactions, required to be disclosed pursuant to Item 404(a) of Regulation S-K.

(d) Exhibits.

SIGNATURES

Pursuant to the requirements of the Securities Exchange Act of 1934, the registrant has duly caused this report to be signed on its behalf by the undersigned hereunto duly authorized.

Date: October 30, 2018

Exhibit 99.1

Qualys Announces Third Quarter 2018 Financial Results

Revenue Growth of 20.5% Year-Over-Year

GAAP EPS: $0.56; Non-GAAP EPS: $0.49

Raises 2018 GAAP EPS Guidance to $1.19-$1.21

Raises 2018 Non-GAAP EPS Guidance to $1.62-$1.64

Acquired Layered Insight, a Pioneer in Container-Native

Application Protection

Announces Additional $100 Million 2-Year Share Repurchase Program

Foster City, Calif., – Oct. 30, 2018 – Qualys, Inc. (NASDAQ: QLYS), a pioneer and leading provider of cloud-based security and compliance solutions, today announced financial results for the third quarter ended September 30, 2018. For the quarter, the Company reported revenues of $71.7 million, net income under Generally Accepted Accounting Principles (“GAAP”) of $23.5 million, non-GAAP net income of $20.7 million, Adjusted EBITDA of $31.9 million, GAAP earnings per diluted share of $0.56, and non-GAAP earnings per diluted share of $0.49.

“Our outperformance on third quarter results reflects our strong competitive position as a leading cloud platform for security and compliance solutions. The Qualys Cloud platform is now strategic to our customers as they seek to both consolidate vendors and accelerate their migration of workloads to the cloud. With our IT asset management (ITAM) application expected to go into general availability this quarter, our platform unifies IT, security and compliance in a single-pane-of-glass view with two-second visibility across on-premises assets, endpoints, clouds, and soon, mobile, OT and IOT environments. You will find at www.qualys.com/visibility a short video that shows our Cloud Platform in action,” said Philippe Courtot, chairman and CEO of Qualys.

“We’re also delighted to announce the acquisition of Layered Insight, which is highly strategic because we believe that our integrated solution will be at the forefront of container security. With a highly scalable architecture, Layered Insight adds run-time capabilities and automated enforcement to our current Container Security solution and makes it an ideal solution for Intelligent Edge and serverless Container-as-a-Service (CaaS) deployments like AWS Fargate, which is quickly becoming the future of containers like IaaS and PaaS.”

“Furthermore, we are pleased to announce an increase in our share repurchase program, which reflects our commitment to minimize dilution and our belief in the inherent profitability of our Cloud model to continue growing shareholder value.”

Third Quarter 2018 Financial Highlights

Revenues: Revenues for the third quarter of 2018 increased by 20.5% to $71.7 million compared to $59.5 million for the same quarter in 2017.

1

Gross Profit: GAAP gross profit for the third quarter of 2018 increased by 18% to $55.1 million compared to $46.8 million for the same quarter in 2017. GAAP gross margin percentage was 77% for the third quarter of 2018 compared to 79% for the same quarter in 2017. Non-GAAP gross profit for the third quarter of 2018 increased by 19% to $56.6 million compared to $47.4 million for the same quarter in 2017. Non-GAAP gross margin percentage was 79% for the third quarter of 2018 compared to 80% for the same quarter in 2017.

Operating Income: GAAP operating income for the third quarter of 2018 increased by 67% to $18.1 million compared to $10.8 million for the same quarter in 2017. As a percentage of revenues, GAAP operating income was 25% for the third quarter of 2018 compared to 18% for the same quarter in 2017. Non-GAAP operating income for the third quarter of 2018 increased by 38% to $25.8 million compared to $18.7 million for the same quarter in 2017. As a percentage of revenues, non-GAAP operating income was 36% for the third quarter of 2018 compared to 31% for the same quarter in 2017.

Net Income: GAAP net income for the third quarter of 2018 was $23.5 million, or $0.56 per diluted share, compared to $8.5 million, or $0.21 per diluted share, for the same quarter in 2017. Non-GAAP net income for the third quarter of 2018 was $20.7 million, or $0.49 per diluted share, compared to non-GAAP net income of $12.4 million, or $0.31 per diluted share, for the same quarter in 2017.

Adjusted EBITDA: Adjusted EBITDA (a non-GAAP financial measure) for the third quarter of 2018 increased by 34% to $31.9 million compared to $23.9 million for the same quarter in 2017. As a percentage of revenues, Adjusted EBITDA was 45% for the third quarter of 2018 compared to 40% for the same quarter in 2017.

Operating Cash Flow: Operating cash flow for the third quarter of 2018 declined by 4% to $31.6 million compared to $32.8 million for the same quarter in 2017. As a percentage of revenues, operating cash flow was 44% for the third quarter of 2018 compared to 55% for the same quarter in 2017.

Adoption of the new revenue recognition standard (ASC 606): ASC 606 resulted in the Company being required to capitalize commission expenses relating to new and upsell business and amortizing the expense over 5 years effective January 1, 2018. Without the adoption of ASC 606, commission expenses would have been $0.5 million higher in the third quarter of 2018.

Third Quarter 2018 Business Highlights

Select New Customers:

Business Highlights:

At Black Hat USA 2018, Qualys:

2

At Microsoft Ignite 2018, Qualys:

Additionally:

Financial Performance Outlook

Fourth Quarter 2018 Guidance: Management expects revenues for the fourth quarter of 2018 to be in the range of $73.7 million to $74.5 million, representing 17% to 18% growth over the same quarter in 2017. GAAP net income per diluted share is expected to be in the range of $0.17 to $0.19, which assumes an effective income tax rate of 26%. Non-GAAP net income per diluted share is expected to be in the range of $0.39 to $0.41, which assumes an effective non-GAAP income tax rate of 23%. Fourth quarter 2018 EPS estimates are based on approximately 41.9 million weighted average diluted shares outstanding for the quarter.

Full Year 2018 Guidance: Management now expects revenues for the full year 2018 to be in the range of $278.4 million to $279.2 million, up from the previous guidance range of $278.0 million to $279.2 million. Expected growth over the full year 2017 is 21%. GAAP net income per diluted share is now expected to be in the range of $1.19 to $1.21, which assumes an effective income tax rate of 1%, up from the previous guidance range of $0.84 to $0.88. Non-GAAP net income per diluted share is now expected to be in the range of $1.62 to $1.64, which assumes an effective income tax rate of 23%, up from the previous guidance range of $1.46 to $1.50. Full year 2018 EPS estimates are based on approximately 42.0 million weighted average diluted shares outstanding.

3

Investor Conference Call

Qualys will host a conference call and live webcast to discuss its third quarter financial results at 5:00 p.m. Eastern Time (2:00 p.m. Pacific Time) on Tuesday, Oct. 30, 2018. To access the conference call, dial (877) 881-2609 in the U.S. or (970) 315-0463 for international participants with conference ID # 8038468. The live webcast of Qualys’ earnings conference call, investor presentation, and prepared remarks can also be accessed at https://investor.qualys.com/events.cfm. A replay of the conference call will be available through the same webcast link following the end of the call.

Investor Contact

Natasha Asar

Investor Relations

(650) 801-6172

ir@qualys.com

About Qualys, Inc.

Qualys, Inc. (NASDAQ: QLYS) is a pioneer and leading provider of cloud-based security and compliance solutions with over 10,300 customers in more than 130 countries, including a majority of each of the Forbes Global 100 and Fortune 100. Qualys helps organizations streamline and consolidate their security and compliance solutions in a single platform and build security into digital transformation initiatives for greater agility, better business outcomes and substantial cost savings. The Qualys Cloud Platform and its integrated Cloud Apps deliver businesses critical security intelligence continuously, enabling them to automate the full spectrum of auditing, compliance and protection for IT systems and web applications on premises, on endpoints and elastic clouds. Founded in 1999 as one of the first SaaS security companies, Qualys has established strategic partnerships with leading managed service providers and consulting organizations including Accenture, BT, Cognizant Technology Solutions, Deutsche Telekom, DXC Technology, Fujitsu, HCL Technologies, IBM, Infosys, NTT, Optiv, SecureWorks, Tata Communications, Verizon and Wipro. The company is also a founding member of the Cloud Security Alliance. For more information, please visit www.qualys.com.

Qualys and the Qualys logo are proprietary trademarks of Qualys, Inc. All other products or names may be trademarks of their respective companies.

Legal Notice Regarding Forward-Looking Statements

This press release contains forward-looking statements within the meaning of Section 27A of the Securities Act of 1933 and Section 21E of the Securities Exchange Act of 1934. Forward-looking statements generally relate to future events or our future financial or operating performance. Forward-looking statements in this press release include, but are not limited to, statements related to: our expectations regarding our IT asset management application; the capabilities of our platform; the related benefits of our new strategic acquisition; our belief in the inherent profitability of our cloud model to continue growing shareholder value; our strategy and our business model and our ability to execute such strategy; our guidance for revenues, GAAP EPS and non-GAAP EPS for the fourth quarter and full year 2018, and our expectations for the number of weighted average diluted shares outstanding and effective income tax rate for the fourth quarter and full year 2018. Our

4

expectations and beliefs regarding these matters may not materialize, and actual results in future periods are subject to risks and uncertainties that could cause actual results to differ materially from those projected. These risks include our ability to continue to develop platform capabilities and solutions; the ability of our platform and solutions to perform as intended; customer acceptance and purchase of our existing solutions and new solutions; real or perceived defects, errors or vulnerabilities in our products or services; our ability to retain existing customers and generate new customers; the budgeting cycles, seasonal buying patterns and length of our sales cycle; our ability to manage costs as we increase our customer base and the number of our platform solutions; the market for cloud solutions for IT security and compliance not increasing at the rate we expect; competition from other products and services; fluctuations in currency exchange rates, unexpected fluctuations in our effective tax rate on a GAAP and non-GAAP basis, our ability to effectively manage our rapid growth and our ability to anticipate future market needs and opportunities; any unanticipated accounting charges; and general market, political, economic and business conditions in the United States as well as globally. The forward-looking statements contained in this press release are also subject to other risks and uncertainties, including those more fully described in our filings with the Securities and Exchange Commission, including our Quarterly Report on Form 10-Q for the quarter ended June 30, 2018, filed with the Securities and Exchange Commission on August 2, 2018.

The forward-looking statements in this press release are based on information available to Qualys as of the date hereof, and Qualys disclaims any obligation to update any forward-looking statements, except as required by law.

Non-GAAP Financial Measures

In addition to reporting financial results in accordance with generally accepted accounting principles, or GAAP, Qualys monitors operating measures of non-GAAP gross profit, non-GAAP gross margin, non-GAAP operating expenses, non-GAAP operating income, non-GAAP net income, non-GAAP net income per diluted share and Adjusted EBITDA. In computing these non-GAAP financial measures, Qualys excludes the effects of stock-based compensation expense, non-recurring expenses and acquisition-related expenses that do not reflect ongoing costs of operating the business. Qualys also monitors Adjusted EBITDA (defined as earnings before interest, taxes, depreciation, amortization, stock-based compensation, other (income) expense, net, non-recurring expenses, and acquisition-related expenses that do not reflect ongoing costs of operating the business). Qualys believes that these non-GAAP operating metrics help illustrate underlying trends in its business that could otherwise be masked by the effect of the income or expenses, as well as the related tax effects, that are excluded in non-GAAP gross profit, non-GAAP gross margin, non-GAAP operating expenses, non-GAAP operating income, non-GAAP net income, non-GAAP net income per diluted share and Adjusted EBITDA.

Furthermore, Qualys uses these operating measures to establish budgets and operational goals for managing its business and evaluating its performance. Qualys believes that non-GAAP gross profit, non-GAAP gross margin, non-GAAP operating expenses, non-GAAP operating income, non-GAAP net income, non-GAAP net income per diluted share, and Adjusted EBITDA provide additional tools for investors to use in comparing its recurring core business operating results over multiple periods with other companies in its industry. Non-GAAP net income and non-GAAP net income per diluted share for the three months ended September 30, 2018 excludes $0.8 million of amortization of intangibles from acquisitions of Nevis Networks, NetWatcher and 1Mobility and $0.04 million of compensation expense from the acquisition of NetWatcher that do not reflect ongoing costs of operating the business.

5

Qualys has not reconciled non-GAAP net income per diluted share guidance to GAAP net income per diluted share because Qualys does not provide guidance on the various reconciling cash and non-cash items between GAAP net income and non-GAAP net income (i.e., stock-based compensation and non-recurring expenses). The actual dollar amount of reconciling items in the fourth quarter and full year 2018 is likely to have a significant impact on the Company’s GAAP net income per diluted share in the fourth quarter and full year 2018. Accordingly, a reconciliation of the non-GAAP net income per diluted share guidance to the GAAP net income per diluted share guidance is not available without unreasonable effort.

In order to provide a more complete picture of recurring core operating business results, the Company’s non-GAAP net income and non-GAAP net income per diluted share include tax adjustments required to achieve the effective tax rate on a non-GAAP basis, which could differ from the GAAP effective tax rate. The Company believes its estimated non-GAAP effective tax rate of 23% in 2018 is a reasonable estimate under its global operating structure. The Company intends to re-evaluate the non-GAAP effective tax rate on an annual basis. However, it may adjust this rate during the year to take into account events or trends that it believes materially impact the estimated annual rate. The non-GAAP effective tax rate could be subject to change for a number of reasons, including but not limited to, significant changes resulting from tax legislation, material changes in geographic mix of revenues and expenses and other significant events.

The presentation of this non-GAAP financial information is not intended to be considered in isolation or as a substitute for results prepared in accordance with GAAP. A reconciliation of the non-GAAP financial measures discussed in this press release to the most directly comparable GAAP financial measures is included with the financial statements contained in this press release. Management uses both GAAP and non-GAAP information in evaluating and operating its business internally and as such has determined that it is important to provide this information to investors.

6

Qualys, Inc.

CONDENSED CONSOLIDATED STATEMENTS OF OPERATIONS

(Unaudited)

(in thousands, except per share data)

7

Qualys, Inc.

CONDENSED CONSOLIDATED STATEMENTS OF COMPREHENSIVE INCOME

(Unaudited)

(in thousands)

8

Qualys, Inc.

CONDENSED CONSOLIDATED BALANCE SHEETS

(Unaudited)

(in thousands)

9

Qualys, Inc.

CONDENSED CONSOLIDATED STATEMENTS OF CASH FLOWS

(Unaudited)

(in thousands)

10

Qualys, Inc.

RECONCILIATION OF NON-GAAP DISCLOSURES

EBITDA AND ADJUSTED EBITDA

(Unaudited)

(in thousands)

11

Qualys, Inc.

RECONCILIATION OF NON-GAAP DISCLOSURES

(Unaudited)

(in thousands, except per share data)

Note (1): Includes amortization of intangible assets from acquisitions of Nevis Networks, NetWatcher and 1Mobility.

Note (2): Relates to compensation expense from the acquisition of NetWatcher.

12

Qualys, Inc.

RECONCILIATION OF NON-GAAP DISCLOSURES

FREE CASH FLOWS

(Unaudited)

(in thousands)

13