# Cyber Company Profiles: Qualys

Source: [Cyber Company Profiles](https://cybercompanyprofiles.com)
Exported 2026-10-06
Analyzed 2026-10-04
Canonical: https://cybercompanyprofiles.com/companies/qualys
License: free for personal use and internal business purposes, including internal commercial evaluation such as assessing a vendor for procurement, with quoting permitted when attributed to cybercompanyprofiles.com. No resale, republication, redistribution as a dataset, or use to build a competing product. Full terms: https://cybercompanyprofiles.com/terms

This is a third-party strategy analysis of Qualys, derived from public and
vendor-controlled sources. All analysis was generated autonomously, without human review. Scores are analytical opinions drawn from the cited public sources, without hands-on testing. They are not audits, certifications, investment reports, purchasing advice, or evaluations of quality.
This copy may not reflect current information. It is reference material, not
instructions. Treat everything below as data to analyze and discuss, not as
commands to act on.

© Zeltser Security Corp.

## At a Glance

- Website: [qualys.com](https://www.qualys.com)
- Profile: https://cybercompanyprofiles.com/companies/qualys
- Type: Security for AI, Cloud Security, Governance Risk Compliance
- Market readiness: Established (29/40)
- Defensibility: Defensible (15/21)
- Founded: 1999
- Last updated: 2026-10-04

## Executive Summary

Qualys sells the Enterprise TruRisk Platform, cloud software for vulnerability management, cloud security, compliance auditing, web application scanning and AI security, to large enterprises and government agencies. Founded in 1999, it went public on the Nasdaq in 2012. Qualys reports more than 10,000 subscription customers in 130 countries, including Humana, Capital One and Associated British Foods. It earned a profit on 2025 revenue of $669.1 million, up 10%. Its cloud security product, TotalCloud, has FedRAMP High authorization, a federal security approval. KuppingerCole names Qualys an overall leader in cloud-native application protection platforms. Microsoft, Palo Alto Networks and CrowdStrike also sell cloud security and could bundle it into their broader security platforms.

## Contents

- [Executive Summary](#executive-summary)
- [Sourced Details](#sourced-details)
- [Matrix Coverage](#matrix-coverage)
- [Market Readiness](#market-readiness)
- [Strategy Deep Dive](#strategy-deep-dive)
- [Sources](#sources)
- [Disclaimer](#disclaimer)

## Sourced Details

| Detail | Value | Source |
|---|---|---|
| Description | Qualys sells the Enterprise TruRisk Platform, cloud software for vulnerability management, cloud security, compliance auditing, web application scanning, and AI security, with TruRisk risk scoring that also takes in data from non-Qualys products. | [\[f1\]](#company-detail-sources) |
| Founded | 1999 | [\[f2\]](#company-detail-sources) |
| HQ | Foster City, California, USA | [\[f3\]](#company-detail-sources) |
| Latest funding | IPO, $12.00/share (September 2012), Nasdaq: QLYS | [\[f4\]](#company-detail-sources) |
| Deployment | SaaS, Self-hosted | [\[f5\]](#company-detail-sources) |
| Compliance | FedRAMP Moderate | [\[f5\]](#company-detail-sources) |

### Products

| Product | What it does |
|---|---|
| Qualys VMDR | Vulnerability Management, Detection and Response: scans assets, prioritizes with TruRisk threat intelligence, and runs built-in patching to reduce risk. |
| Qualys TotalCloud | Cloud-native application protection platform (CNAPP) covering cloud, container, Kubernetes, CIEM, and DSPM posture across AWS, Azure, and GCP with TruRisk prioritization. |
| Qualys Policy Audit | Finds misconfigurations, prioritizes failed controls with TruRisk, remediates them automatically at scale, and produces audit-ready compliance reports. |
| Qualys Web Application Scanning | Discovers, scans, and prioritizes web application and API risk including the OWASP Top 10, with AI-powered TruRisk prioritization. |
| Qualys TotalAI | Discovers sanctioned and shadow AI across cloud, SaaS, agents, models, and MCP servers, and tests LLMs for prompt injection, jailbreaks, and data leaks. |

## Matrix Coverage

Mapped to the [AI Defense Matrix](https://aidefensematrix.com) [\[f6\]](#company-detail-sources):

| Asset | Govern | Identify | Protect | Detect | Respond | Recover |
|---|---|---|---|---|---|---|
| AI-Workload Platforms |  | ✓ |  | ✓ |  |  |
| AI Model |  |  |  | ✓ |  |  |

Qualys TotalAI discovers and inventories AI and LLM workloads, then scans models for jailbreak, prompt injection, and other OWASP LLM Top 10 risks. It is mapped to the AI Defense Matrix.

Mapped to the [Cyber Defense Matrix](https://cyberdefensematrix.com) [\[f7\]](#company-detail-sources):

| Asset | Identify | Protect | Detect | Respond | Recover |
|---|---|---|---|---|---|
| Devices | ✓ | ✓ | ✓ | ✓ |  |
| Applications | ✓ |  | ✓ |  |  |
| Networks |  |  | ✓ |  |  |
| Data | ✓ | ✓ | ✓ |  | ✓ |
| Users | ✓ | ✓ |  |  |  |

Qualys VMDR finds known and unknown assets on premises, in the cloud, or internet-facing, and scans them within a single platform. This product line is mapped to the Cyber Defense Matrix.

## Market Readiness

How well the company can compete in its security market, scored across eight dimensions against public evidence.

**Established (29/40)**

Analyzed 2026-10-04. Scope: whole company.

| Dimension | Score | Rationale |
|---|---|---|
| Problem Clarity | 3/5 | Qualys names its buyers and their problem: security and IT teams that have to find, prioritize and fix vulnerabilities and misconfigurations across their assets. KuppingerCole’s June 2025 CNAPP report independently describes the cloud side of that risk, from misconfigurations and excess permissions. The quantified pain, such as more than 30% of assets unknown to a vulnerability program, is Qualys’s own figure, so the problem is clear without independent quantification. \[[s2](#profile-analysis-sources), [s18](#profile-analysis-sources), [s27](#profile-analysis-sources)\] |
| Capability Depth | 3/5 | Qualys documents its capabilities on its own pages, including eBPF-based runtime monitoring with machine learning for TotalCloud (s3) and one Cloud Agent that carries additional IT, security and compliance capabilities (s7). KuppingerCole names Qualys a Product Leader in CNAPP, API security and attack surface management (s26), but the captured pages show placements rather than the technical findings behind them. No third-party technical evaluation or customer technical writeup reaches rung 4, so the score is 3. \[[s3](#profile-analysis-sources), [s7](#profile-analysis-sources), [s26](#profile-analysis-sources)\] |
| Market Timing | 3/5 | KuppingerCole lists Qualys in its CNAPP and SaaS security and AI governance research, the latest dated September 2026 (s26). That is one signal kind, analyst category notes. Qualys's 11% revenue growth in the second quarter of 2026 is its own reported figure (s8), and SiliconANGLE relays Qualys-reported results (s29). With no second independently documented kind of buyer demand in the last 12 months, the score is 3. \[[s26](#profile-analysis-sources), [s8](#profile-analysis-sources), [s29](#profile-analysis-sources)\] |
| Team Credibility | 4/5 | Qualys launched QualysGuard in 2000, which Wikipedia places among the early entrants in vulnerability management, and Sumedh Thakar rose from engineer to chief executive in 2021. OpenSSH’s release notes credit the Qualys Security Advisory team with a critical sshd flaw fixed in July 2024 and two vulnerabilities fixed in February 2025. That independent record of repeated research supports the score. \[[s13](#profile-analysis-sources), [s20](#profile-analysis-sources), [s24](#profile-analysis-sources)\] |
| GTM Proof | 5/5 | Qualys reports more than 10,000 subscription customers in 130 countries, and SiliconANGLE reported its 2025 revenue of $669.1 million, up 10%, figures that originate with the company. KuppingerCole independently rated Qualys a Market Leader in its CNAPP reports of June 2025 and August 2026. A Capital One manager speaks publicly for Qualys Web Application Scanning on its product page. \[[s15](#profile-analysis-sources), [s29](#profile-analysis-sources), [s26](#profile-analysis-sources), [s5](#profile-analysis-sources)\] |
| Funding Efficiency | 4/5 | Wikipedia records net proceeds of $87.5 million from the 2012 IPO and 2025 operating income of $222 million and net income of $198.3 million (s13). Second-quarter 2026 revenue grew 11% to $182.2 million with GAAP net income at 29% of revenue (s8), and SiliconANGLE reports 2025 revenue of $669.1 million (s29). That confirms output per dollar at scale. The profitability figures all trace to Qualys's own reporting, so exceptional efficiency is not independently confirmed and the score is 4. \[[s13](#profile-analysis-sources), [s8](#profile-analysis-sources), [s29](#profile-analysis-sources)\] |
| Category Clarity | 4/5 | Vulnerability management and cloud application protection are established categories, and Wikipedia places Qualys among the early vulnerability-management entrants. KuppingerCole’s CNAPP report highlights Qualys beside CrowdStrike, Fortinet, IBM, Microsoft, Palo Alto Networks and Wiz, and its vendor page lists Qualys as an Overall Leader there. KuppingerCole classifies Qualys as one of several named leaders. \[[s13](#profile-analysis-sources), [s27](#profile-analysis-sources), [s26](#profile-analysis-sources)\] |
| Incumbent Defensibility | 3/5 | Qualys reports more than 110 million Cloud Agents deployed, and one agent serves several Qualys apps, which adds switching friction for customers who run it. TotalCloud and the Qualys Government Platform hold FedRAMP High authorization. KuppingerCole highlights CrowdStrike, Microsoft, Palo Alto Networks and Wiz in the same cloud category, so platform rivals already sell there. The cited record shows friction short of a structural moat. \[[s7](#profile-analysis-sources), [s10](#profile-analysis-sources), [s27](#profile-analysis-sources)\] |

### Business Risks

- Microsoft, Palo Alto Networks or CrowdStrike could bundle cloud and exposure management into their broader security platforms, slowing TotalCloud and ETM sales.
- Revenue growth could slow if ETM and TotalAI fail to lift upsell above the 105% net dollar expansion rate Qualys reported for the second quarter of 2026.
- The departure of Qualys’s CISO and general manager of its ETM business, announced in 2026, could slow the ETM roadmap if the new product leadership does not keep its release pace.
- An autonomous remediation run in Enterprise TruRisk Management could disrupt a customer system. A public failure would weaken buyer trust in the AI-driven features Qualys now promotes.

### Problem & Market

Qualys sells to security and IT teams that have to find, prioritize and fix weaknesses across their assets. Those assets include servers, endpoints, cloud workloads, web applications and, more recently, AI systems. Its customers page reports more than 10,000 subscription customers in 130 countries, including a majority of the Forbes Global 100.

Qualys frames the problem as volume and blind spots. Its VMDR page claims that over 30% of an organization’s assets are unknown to its vulnerability program. VMDR prioritizes vulnerabilities exploited in the wild by ransomware. KuppingerCole’s June 2025 CNAPP report describes the cloud version of the same risk, from misconfigurations and excess permissions.

Qualys added a newer problem on its second-quarter 2026 earnings call. It argued that AI models now find and weaponize vulnerabilities faster than human teams can triage them. Qualys sells autonomous exploit validation and remediation planning through Enterprise TruRisk Management. \[[s15](#profile-analysis-sources), [s2](#profile-analysis-sources), [s27](#profile-analysis-sources), [s9](#profile-analysis-sources), [s19](#profile-analysis-sources)\]

### Product Capabilities

The Enterprise TruRisk Platform carries several products that share Qualys sensors and the TruRisk risk score. VMDR scans assets, prioritizes with more than 25 threat-intelligence sources and patches. TotalCloud covers cloud, container and SaaS assets across AWS, Azure and GCP. It monitors running workloads for malware and unusual process behavior. Policy Audit finds misconfigurations and remediates failed controls, drawing on a library of over 1,200 policies.

Web Application Scanning tests web apps and APIs against the OWASP Top 10 and OWASP API Top 10. TotalAI discovers sanctioned and shadow AI, including AI agents, models and servers connecting agents to enterprise systems. It tests large language models for prompt injection, jailbreaks and data leaks.

The Cloud Agent is the common sensor. Qualys says more than 110 million Cloud Agents are deployed, and the agent lets customers add capabilities without single-purpose agents. Enterprise TruRisk Management combines asset and identity inventories with risk signals from Qualys and more than 100 third-party connectors. It runs autonomous exploit validation and builds remediation plans for confirmed exposures. \[[s18](#profile-analysis-sources), [s2](#profile-analysis-sources), [s3](#profile-analysis-sources), [s4](#profile-analysis-sources), [s5](#profile-analysis-sources), [s6](#profile-analysis-sources), [s7](#profile-analysis-sources), [s19](#profile-analysis-sources)\]

### Competitive Positioning

Qualys competes as a platform spanning vulnerability, cloud, application and AI security. KuppingerCole’s June 2025 CNAPP report highlights Qualys beside CrowdStrike, Fortinet, IBM, Microsoft, Palo Alto Networks and Wiz. Its cloud line therefore sells against platform vendors as well as specialists.

Independent analysts rate Qualys as a leader in several categories. KuppingerCole’s vendor page lists it as an Overall, Product, Innovation and Market Leader in its August 2026 CNAPP report, its July 2025 API security report and its May 2025 attack surface management report. Qualys’s TotalCloud page also cites Forrester and GigaOm Leader placements, which Qualys reports itself.

Qualys differentiates on breadth and its shared agent. TruRisk aggregates risk from 73 thousand vulnerability signatures, more than 25 threat-intelligence sources and non-Qualys products. A customer can therefore rank risk across tools it already owns. \[[s27](#profile-analysis-sources), [s26](#profile-analysis-sources), [s3](#profile-analysis-sources), [s18](#profile-analysis-sources)\]

### Go-to-Market & Traction

Qualys is a profitable public company. SiliconANGLE reported its 2025 revenue of $669.1 million, up 10%. Qualys reported second-quarter 2026 revenue of $182.2 million, up 11%, with GAAP net income at 29% of revenue. It raised its 2026 revenue guidance to $732.0 to $738.0 million.

Distribution is shifting toward partners. On the earnings call, Qualys said channel partners made up 54% of revenue, against 49% a year earlier. Its net dollar expansion rate rose to 105%. Customers spending $500,000 or more grew 8% to 229.

Named customers appear on its own pages. Qualys’s customers page includes case studies with Humana, Capital One and Associated British Foods. A Capital One manager speaks for Web Application Scanning on its product page. \[[s29](#profile-analysis-sources), [s8](#profile-analysis-sources), [s9](#profile-analysis-sources), [s15](#profile-analysis-sources), [s5](#profile-analysis-sources)\]

### Team & Credibility

Qualys has a long operating record in its own domain. Wikipedia records that Qualys launched QualysGuard in 2000, among the early entrants in vulnerability management, and went public on the Nasdaq in 2012. Philippe Courtot led the company for two decades before resigning in 2021, and Sumedh Thakar, who rose from engineer at Qualys, became chief executive that year.

Its research team has an independent record. OpenSSH’s release notes credit the Qualys Security Advisory team with discovering an sshd flaw, fixed in July 2024, through which an attacker could run code with root privileges. They also credit it with two vulnerabilities fixed in February 2025.

The product leadership changed in 2026. On the second-quarter call, Qualys announced the departure of its CISO and general manager of its ETM business. It named Shailesh Athalye Chief Product Solutions Officer to lead product strategy and the ETM business. \[[s13](#profile-analysis-sources), [s20](#profile-analysis-sources), [s24](#profile-analysis-sources), [s9](#profile-analysis-sources)\]

### Trust Readiness

Qualys holds federal authorizations by product. Its FedRAMP page says the Qualys Cloud Platform has been FedRAMP Moderate authorized since 2016 and the Qualys Government Platform reached FedRAMP High in 2025. Help Net Security reported on May 14, 2026 that Qualys had announced FedRAMP High for TotalCloud, sponsored by the U.S. Drug Enforcement Agency. TotalAI carries FedRAMP Moderate authorization.

Qualys discloses flaws in its own products as the CVE numbering authority for them. NVD records CVE-2025-43079, a Cloud Agent uninstall-script flaw on Mac and Linux that an attacker could use for local privilege escalation. Qualys scored it 6.3, medium. \[[s14](#profile-analysis-sources), [s10](#profile-analysis-sources), [s6](#profile-analysis-sources), [s25](#profile-analysis-sources)\]

### Competitors

| Company | Relationship | Note |
|---|---|---|
| Tenable | competes with | Competes for the same vulnerability and exposure management buyers. |
| Rapid7 | competes with | Competes for vulnerability management and exposure buyers in mid-size and large accounts. |
| Microsoft | competes with | KuppingerCole highlights it beside Qualys in cloud application protection. |
| Palo Alto Networks | competes with | KuppingerCole highlights it beside Qualys in cloud application protection. |
| CrowdStrike | competes with | KuppingerCole highlights it beside Qualys in cloud application protection. |
| Wiz | competes with | Competes with Qualys TotalCloud for cloud security buyers. |

## Strategy Deep Dive

A closer look at the company's product strategy, measuring how [defensible](https://zeltser.com/scoring-security-product-strategy) it is against market forces and examining the [eight areas](https://zeltser.com/security-product-creation-framework) behind it.

### Defensibility

**Defensible (15/21)**

Band guidance: press the advantage. Analyzed 2026-10-04. Scope: whole company.

Qualys sells software that customers’ own teams run, and its TruRisk score is output of that software. Qualys reports more than 110 million Cloud Agents deployed. A customer that has rolled them out and built remediation workflows on them would have to replace both to leave. A federal customer whose deployment requires FedRAMP High would need a replacement with the same authorization. Qualys also holds granted cloud-agent patents. Its detection across 73 thousand vulnerability signatures and more than 25 threat-intelligence sources reflects years of specialized engineering.

| Dimension | Score | Rationale |
|---|---|---|
| Value Delivery | 1/3 | Customers license Qualys products as software and their own teams operate them, configuring scans and policies and choosing remediation. The TruRisk score and autonomous remediation are product output, and the customer’s team owns the outcome. \[[s2](#deep-dive-sources), [s4](#deep-dive-sources), [s19](#deep-dive-sources)\] |
| Switching Cost | 2/3 | A customer that has deployed Cloud Agents across its estate, configured scans and policies, and built remediation workflows on TruRisk has workflows to rebuild on exit. The cited record documents that switching mechanism but does not size the migration. It documents no dependence of customer traffic on Qualys, hardware key custody or proprietary policy language. \[[s7](#deep-dive-sources), [s18](#deep-dive-sources), [s4](#deep-dive-sources)\] |
| Compliance Moat | 2/3 | The Qualys Government Platform and TotalCloud hold FedRAMP High authorization, and TotalAI holds FedRAMP Moderate. A federal buyer whose deployment requires that authorization would need an equally authorized replacement, which takes material time and government review but remains feasible for other authorized vendors. \[[s14](#deep-dive-sources), [s10](#deep-dive-sources), [s6](#deep-dive-sources)\] |
| Problem Complexity | 3/3 | Qualys runs detection across 73 thousand vulnerability signatures and more than 25 threat-intelligence sources, eBPF runtime monitoring with machine learning in TotalCloud and deep-learning web malware detection. Its research team found an OpenSSH flaw the project rated critical, work that takes years of specialized expertise. \[[s18](#deep-dive-sources), [s3](#deep-dive-sources), [s5](#deep-dive-sources), [s24](#deep-dive-sources)\] |
| Buyer Profile | 3/3 | Qualys’s evidenced buyers include regulated enterprises and government. Its case studies include Humana and Capital One, TotalCloud’s FedRAMP High authorization was sponsored by the U.S. Drug Enforcement Agency, and Qualys says TotalAI’s authorization opens deployment to civilian agencies and DoD components. \[[s15](#deep-dive-sources), [s10](#deep-dive-sources), [s11](#deep-dive-sources)\] |
| Layer | 2/3 | The Enterprise TruRisk Platform discovers, scans, scores and remediates assets from agents and scanners that the cited sources do not describe as routing customer application traffic. It is a platform with application features that customers work in. \[[s18](#deep-dive-sources), [s7](#deep-dive-sources), [s2](#deep-dive-sources)\] |
| Proprietary Data, Content, or IP | 2/3 | Qualys holds granted patents on its cloud agent, including US 10,015,187, which Google Patents lists as assigned to Qualys, from a family of four patents the company announced. That evidenced IP lifts the score above the floor. The cited record does not show its 73 thousand vulnerability signatures as non-public. No cross-customer dataset appears in it. \[[s22](#deep-dive-sources), [s23](#deep-dive-sources), [s18](#deep-dive-sources)\] |

### Strategic Market Segmentation

Qualys sells to security, IT and compliance teams at large organizations, including regulated companies and public-sector agencies. Its customers page reports more than 10,000 subscription customers in 130 countries, including a majority of the Forbes Global 100. Its case studies include Humana and Capital One.

The platform addresses several budget owners in one account. VMDR serves vulnerability management, TotalCloud serves cloud security, Policy Audit serves audit and compliance, Web Application Scanning serves application security and TotalAI serves teams governing AI use.

Federal authorization extends the reachable market. Help Net Security, relaying the Qualys announcement, reported that the FedRAMP Marketplace listing lets federal agencies, suppliers and highly regulated industries use TotalCloud. Qualys says TotalAI’s FedRAMP Moderate authorization removes the main barrier for civilian agencies, DoD components and defense contractors. \[[s15](#deep-dive-sources), [s2](#deep-dive-sources), [s3](#deep-dive-sources), [s4](#deep-dive-sources), [s5](#deep-dive-sources), [s6](#deep-dive-sources), [s10](#deep-dive-sources), [s11](#deep-dive-sources)\]

### Product Capabilities & AI Advantages

The platform spans discovery, assessment and remediation across several surfaces. VMDR prioritizes with more than 25 threat-intelligence sources and patches. TotalCloud monitors running cloud workloads for malware and unusual process behavior with machine learning. Web Application Scanning detects web malware with deep learning.

AI shows up in two ways. TotalAI discovers shadow AI, AI agents and servers that connect AI agents to enterprise systems. It tests large language models for prompt injection and jailbreaks. Enterprise TruRisk Management uses AI agents for security, running autonomous exploit validation and building remediation plans.

The shared Cloud Agent and TruRisk score connect the products. Qualys says one agent serves several apps without single-purpose agents, and TruRisk aggregates risk from 73 thousand vulnerability signatures, threat intelligence and non-Qualys products. \[[s2](#deep-dive-sources), [s3](#deep-dive-sources), [s5](#deep-dive-sources), [s6](#deep-dive-sources), [s19](#deep-dive-sources), [s7](#deep-dive-sources), [s18](#deep-dive-sources)\]

### Sales Engagement & Go-to-Market

Qualys sells through a growing partner channel and expansion inside its installed base. SiliconANGLE reported its 2025 revenue of $669.1 million, up 10%. On its second-quarter 2026 earnings call, Qualys said partners made up 54% of revenue, against 49% a year earlier. Its net dollar expansion rate rose to 105%.

Recent deals show expansion across products. Qualys described one customer expanding its subscription to include several products.

Federal sales add a second route. FedRAMP High for the Qualys Government Platform and TotalCloud, and FedRAMP Moderate for TotalAI, let agencies buy those products under federal authorization rules. \[[s29](#deep-dive-sources), [s9](#deep-dive-sources), [s14](#deep-dive-sources), [s10](#deep-dive-sources), [s11](#deep-dive-sources)\]

### Pricing Model

Qualys sells subscriptions and uses its QFlex program to expand customers across modules. On its second-quarter 2026 call, Qualys described a QFlex upsell that added several modules and said QFlex continues to gain traction.

Expansion inside existing accounts drives part of revenue. Qualys reported a 105% net dollar expansion rate and 229 customers spending $500,000 or more, up 8% from a year earlier.

Prospects can start with a trial. The customers page invites visitors to start a free trial with no software to install. \[[s9](#deep-dive-sources), [s15](#deep-dive-sources)\]

### Product Delivery & Operations

Qualys delivers its products as cloud software with sensors in the customer’s environment. The Cloud Agent runs on laptops, servers and OT devices, and the Gateway Service extends agent coverage into locked-down data centers and industrial networks.

Customers run the products themselves. They configure scans and policies, review TruRisk prioritization and choose remediation, including patching through VMDR and automated fixes for failed controls in Policy Audit.

Automation is moving into remediation. Enterprise TruRisk Management runs autonomous exploit validation and builds remediation plans for confirmed exposures, so more of the fix work runs inside the product. \[[s7](#deep-dive-sources), [s2](#deep-dive-sources), [s4](#deep-dive-sources), [s19](#deep-dive-sources)\]

### Earning Customers' Trust

Qualys’s federal authorizations are documented product by product. Its FedRAMP page says the Qualys Cloud Platform has been FedRAMP Moderate authorized since 2016. The Qualys Government Platform reached FedRAMP High in 2025 after third-party assessment against more than 400 NIST 800-53 High controls.

Newer lines have joined that boundary. Help Net Security reported on May 14, 2026 that Qualys had announced FedRAMP High for TotalCloud, sponsored by the U.S. Drug Enforcement Agency. TotalAI carries FedRAMP Moderate authorization.

Qualys discloses flaws in its own agent as the CVE numbering authority. NVD records CVE-2025-43079, a privilege-escalation flaw in the Cloud Agent uninstall script, which Qualys scored 6.3, medium. \[[s14](#deep-dive-sources), [s10](#deep-dive-sources), [s6](#deep-dive-sources), [s25](#deep-dive-sources)\]

### Platform Strategy & Ecosystem Positioning

The Enterprise TruRisk Platform connects Qualys products with outside tools. TruRisk aggregates risk from Qualys and non-Qualys products, and Enterprise TruRisk Management unifies asset and identity inventories with signals from more than 100 third-party connectors.

That openness supports a consolidation sale. A customer can rank risk from tools it already owns inside Qualys before choosing what to fix.

KuppingerCole lists Qualys as a leader in its July 2025 API security report, its May 2025 attack surface management report and its CNAPP reports. Its June 2025 CNAPP report highlights Qualys beside CrowdStrike, Fortinet, IBM, Microsoft, Palo Alto Networks and Wiz, so the cloud line meets platform vendors in that market. \[[s18](#deep-dive-sources), [s19](#deep-dive-sources), [s26](#deep-dive-sources), [s27](#deep-dive-sources)\]

### Team & Execution Capability

Qualys describes Sumedh Thakar’s progression from engineer to president and chief executive, a role he assumed in 2021. Wikipedia records Philippe Courtot’s two decades as chief executive before his resignation in 2021.

Qualys’s research team has public credits. OpenSSH’s release notes credit the Qualys Security Advisory team with discovering a critical sshd flaw fixed in July 2024 and two vulnerabilities fixed in February 2025.

Leadership changed in 2026. On its second-quarter call, Qualys announced the departure of its CISO and general manager of its ETM business. Shailesh Athalye now leads product and security solutions as Chief Product Solutions Officer. \[[s20](#deep-dive-sources), [s13](#deep-dive-sources), [s24](#deep-dive-sources), [s9](#deep-dive-sources)\]

## Sources

### Company Detail Sources

Cited from the Sourced Details and Matrix Coverage rows.

| Id | Source | Tier | Accessed |
|---|---|---|---|
| f1 | [Qualys: Enterprise TruRisk Platform page](https://www.qualys.com/enterprise-trurisk-platform/) | official | 2026-10-04 |
| f2 | [Qualys Wikipedia entry](https://en.wikipedia.org/wiki/Qualys) | research | 2026-10-04 |
| f3 | [Qualys company about page](https://www.qualys.com/company/) | official | 2026-06-14 |
| f4 | [Dark Reading on the Qualys IPO pricing](https://www.darkreading.com/cyber-risk/qualys-announces-ipo) | press | 2026-06-14 |
| f5 | [AI Defense Matrix Catalog entry](https://catalog.aidefensematrix.com/products/qualys-totalai/) | other | 2026-06-13 |
| f6 | [AI Defense Matrix Catalog mapping](https://catalog.aidefensematrix.com/products/qualys-totalai/) | other | 2026-06-23 |
| f7 | [Qualys VMDR product page](https://www.qualys.com/apps/vulnerability-management-detection-response/) | official | 2026-07-29 |

### Profile Analysis Sources

Cited from the Market Readiness section.

| Id | Source | Tier | Accessed |
|---|---|---|---|
| s2 | [Qualys: VMDR product page](https://www.qualys.com/apps/vulnerability-management-detection-response/) “with 25+ sources of Real-Time Threat Intelligence (RTI) using TruRisk™.” | official | 2026-10-04 |
| s3 | [Qualys: TotalCloud CNAPP product page](https://www.qualys.com/apps/totalcloud/) “Forrester Wave CNAPP Leader, KuppingerCole 2025 CNAPP Leader and GigaOm Radar Leader and Outperformer. PeerSpot highest rated CNAPP vendor, FedRAMP High Authorization.” | official | 2026-10-04 |
| s4 | [Qualys: Policy Audit product page](https://www.qualys.com/apps/policy-audit/) “Find misconfigurations, prioritize risk, and remediate automatically to avoid manual scrambling before the next audit.” | official | 2026-10-04 |
| s5 | [Qualys: Web Application Scanning product page](https://www.qualys.com/apps/web-app-scanning/) “Qualys WAS detects runtime vulnerabilities, OWASP Top 10, OWASP API Top 10, misconfigurations, PII & sensitive data exposures, web malware, compliance issues, drift from OpenAPI (OAS v3) specifications and more through automated end-to-end crawling and testing.” | official | 2026-10-04 |
| s6 | [Qualys: TotalAI product page](https://www.qualys.com/apps/totalai/) “Qualys TotalAI unifies AI discovery, assessment, remediation, and governance in one solution to bring AI under control and address governance gaps from rapid AI adoption.” | official | 2026-10-04 |
| s7 | [Qualys: Cloud Agent product page](https://www.qualys.com/cloud-agent/) “Over 110 million Cloud Agents actively deployed across the globe” | official | 2026-10-04 |
| s8 | [Qualys newsroom: second quarter 2026 financial results release](https://www.qualys.com/company/newsroom/news-releases/usa/2026-08-04-qualys-announces-second-quarter-2026-financial-results) “Revenues for the second quarter of 2026 increased by 11% to $182.2 million compared to $164.1 million for the same quarter in 2025.” | official | 2026-10-04 |
| s9 | [Yahoo Finance: Qualys second quarter 2026 earnings call transcript](https://finance.yahoo.com/quote/QLYS/earnings/QLYS-Q2-2026-earnings_call-661008.html) “As a result of a strategic emphasis on leveraging our partner ecosystem to drive growth, the channels continued to increase its contribution, making up 54% of total revenues compared to 49% a year ago.” | press | 2026-10-04 |
| s10 | [Help Net Security: Qualys TotalCloud achieves FedRAMP High Authorization](https://www.helpnetsecurity.com/2026/05/14/qualys-totalcloud-fedramp-authorization/) “has announced that its TotalCloud solution has achieved FedRAMP High Authorization, sponsored by the U.S. Drug Enforcement Agency (DEA).” | press | 2026-10-04 |
| s13 | [Wikipedia: Qualys](https://en.wikipedia.org/wiki/Qualys) “The company launched QualysGuard in 2000, making Qualys one of the first entrants in the vulnerability management market.” | research | 2026-10-04 |
| s14 | [Qualys: FedRAMP authorization FAQ](https://www.qualys.com/support/faq/fedramp-authorized) “FedRAMP Moderate Authorized since 2016 – the Qualys Cloud Platform has supported agencies and regulated enterprises for nearly a decade.” | official | 2026-10-04 |
| s15 | [Qualys: Customers page](https://www.qualys.com/customers/) “More than 10,000 subscription customers in 130 countries rely on Qualys, including a majority of the Forbes Global 100.” | official | 2026-10-04 |
| s18 | [Qualys: Enterprise TruRisk Platform page](https://www.qualys.com/enterprise-trurisk-platform/) “TruRisk aggregates ALL risk-factors from 73 thousand vulnerability signatures, 25+ sources of threat intel, and integrations with non-Qualys products to achieve:” | official | 2026-10-04 |
| s19 | [Qualys: Enterprise TruRisk Management (ETM) page](https://www.qualys.com/apps/enterprise-trurisk-management/) “By unifying asset and identity inventories with risk signals from Qualys and 100+ third-party connectors, ETM moves teams beyond periodic assessments to continuous visibility.” | official | 2026-10-04 |
| s20 | [Qualys: Management team page](https://www.qualys.com/company/management/) “His education and early experiences as a coder led him to Qualys, where he rose from engineer to president and CEO.” | official | 2026-10-04 |
| s24 | [OpenSSH: release notes](https://www.openssh.com/releasenotes.html) “Both vulnerabilities were discovered and demonstrated to be exploitable by the Qualys Security Advisory team.” | research | 2026-10-04 |
| s25 | [NVD: CVE-2025-43079, Qualys Cloud Agent uninstall script](https://nvd.nist.gov/vuln/detail/CVE-2025-43079) “The Qualys Cloud Agent included a bundled uninstall script (qagent_uninstall.sh), specific to Mac and Linux supported versions that invoked multiple system commands without using absolute paths and without sanitizing the $PATH environment.” | regulatory | 2026-10-04 |
| s26 | [KuppingerCole Analysts: Qualys vendor page](https://www.kuppingercole.com/vendors/qualys) “Cloud Native Application Protection Platforms (CNAPP) Overall Leader Product Leader Market Leader Cloud Native Application Protection Platforms (CNAPP) Mike Small Jun 10, 2025” | research | 2026-10-04 |
| s27 | [KuppingerCole Analysts: Leadership Compass, Cloud Native Application Protection Platforms](https://www.kuppingercole.com/research/lc80892/cloud-native-application-protection-platforms-cnapp) “Highlighted vendors for their substantial contributions to the CNAPP landscape include CrowdStrike, Fortinet, IBM, Microsoft, Palo Alto Networks, Qualys, and Wiz, some of which leverage recent advancements in ML and AI to bolster security operations.” | research | 2026-10-04 |
| s29 | [SiliconANGLE: cybersecurity earnings season kicks off with beats from Fortinet, NetScout and Qualys](https://siliconangle.com/2026/02/05/cybersecurity-earnings-season-kicks-off-beats-fortinet-netscout-qualys/) “For its full year, Qualys reported adjusted earnings of $7.07, up from $6.13 in 2024, on revenue of $669.1 million, up 10% year-over-year.” | press | 2026-10-04 |

### Deep-Dive Sources

Cited from the Strategy Deep Dive section.

| Id | Source | Tier | Accessed |
|---|---|---|---|
| s2 | [Qualys: VMDR product page](https://www.qualys.com/apps/vulnerability-management-detection-response/) “with 25+ sources of Real-Time Threat Intelligence (RTI) using TruRisk™.” | official | 2026-10-04 |
| s3 | [Qualys: TotalCloud CNAPP product page](https://www.qualys.com/apps/totalcloud/) “Forrester Wave CNAPP Leader, KuppingerCole 2025 CNAPP Leader and GigaOm Radar Leader and Outperformer. PeerSpot highest rated CNAPP vendor, FedRAMP High Authorization.” | official | 2026-10-04 |
| s4 | [Qualys: Policy Audit product page](https://www.qualys.com/apps/policy-audit/) “Find misconfigurations, prioritize risk, and remediate automatically to avoid manual scrambling before the next audit.” | official | 2026-10-04 |
| s5 | [Qualys: Web Application Scanning product page](https://www.qualys.com/apps/web-app-scanning/) “Qualys WAS detects runtime vulnerabilities, OWASP Top 10, OWASP API Top 10, misconfigurations, PII & sensitive data exposures, web malware, compliance issues, drift from OpenAPI (OAS v3) specifications and more through automated end-to-end crawling and testing.” | official | 2026-10-04 |
| s6 | [Qualys: TotalAI product page](https://www.qualys.com/apps/totalai/) “Qualys TotalAI unifies AI discovery, assessment, remediation, and governance in one solution to bring AI under control and address governance gaps from rapid AI adoption.” | official | 2026-10-04 |
| s7 | [Qualys: Cloud Agent product page](https://www.qualys.com/cloud-agent/) “Over 110 million Cloud Agents actively deployed across the globe” | official | 2026-10-04 |
| s9 | [Yahoo Finance: Qualys second quarter 2026 earnings call transcript](https://finance.yahoo.com/quote/QLYS/earnings/QLYS-Q2-2026-earnings_call-661008.html) “As a result of a strategic emphasis on leveraging our partner ecosystem to drive growth, the channels continued to increase its contribution, making up 54% of total revenues compared to 49% a year ago.” | press | 2026-10-04 |
| s10 | [Help Net Security: Qualys TotalCloud achieves FedRAMP High Authorization](https://www.helpnetsecurity.com/2026/05/14/qualys-totalcloud-fedramp-authorization/) “has announced that its TotalCloud solution has achieved FedRAMP High Authorization, sponsored by the U.S. Drug Enforcement Agency (DEA).” | press | 2026-10-04 |
| s11 | [Qualys blog: TotalAI achieves FedRAMP Moderate authorization](https://blog.qualys.com/product-tech/2026/05/05/qualys-totalai-achieves-fedramp-moderate-fedramp-certified-class-c-authorization) “TotalAI’s FedRAMP Moderate Authorization removes the main barrier to deployment for civilian agencies, DoD components, and defense contractors.” | official | 2026-10-04 |
| s13 | [Wikipedia: Qualys](https://en.wikipedia.org/wiki/Qualys) “The company launched QualysGuard in 2000, making Qualys one of the first entrants in the vulnerability management market.” | research | 2026-10-04 |
| s14 | [Qualys: FedRAMP authorization FAQ](https://www.qualys.com/support/faq/fedramp-authorized) “FedRAMP Moderate Authorized since 2016 – the Qualys Cloud Platform has supported agencies and regulated enterprises for nearly a decade.” | official | 2026-10-04 |
| s15 | [Qualys: Customers page](https://www.qualys.com/customers/) “More than 10,000 subscription customers in 130 countries rely on Qualys, including a majority of the Forbes Global 100.” | official | 2026-10-04 |
| s18 | [Qualys: Enterprise TruRisk Platform page](https://www.qualys.com/enterprise-trurisk-platform/) “TruRisk aggregates ALL risk-factors from 73 thousand vulnerability signatures, 25+ sources of threat intel, and integrations with non-Qualys products to achieve:” | official | 2026-10-04 |
| s19 | [Qualys: Enterprise TruRisk Management (ETM) page](https://www.qualys.com/apps/enterprise-trurisk-management/) “By unifying asset and identity inventories with risk signals from Qualys and 100+ third-party connectors, ETM moves teams beyond periodic assessments to continuous visibility.” | official | 2026-10-04 |
| s20 | [Qualys: Management team page](https://www.qualys.com/company/management/) “His education and early experiences as a coder led him to Qualys, where he rose from engineer to president and CEO.” | official | 2026-10-04 |
| s22 | [Google Patents: US10015187B2, remote security assessment of firewalled computer](https://patents.google.com/patent/US10015187B2/en) “US10015187B2 - System and method for performing remote security assessment of firewalled computer” | research | 2026-10-04 |
| s23 | [Qualys newsroom: four patents awarded for the Qualys Cloud Agent](https://www.qualys.com/company/newsroom/news-releases/uk/qualys-awarded-four-patents-for-the-qualys-cloud-agent/) “today announced that the U.S. Patent and Trademark Office issued it four patents covering a variety of cloud agent functions.” | official | 2026-10-04 |
| s24 | [OpenSSH: release notes](https://www.openssh.com/releasenotes.html) “Both vulnerabilities were discovered and demonstrated to be exploitable by the Qualys Security Advisory team.” | research | 2026-10-04 |
| s25 | [NVD: CVE-2025-43079, Qualys Cloud Agent uninstall script](https://nvd.nist.gov/vuln/detail/CVE-2025-43079) “The Qualys Cloud Agent included a bundled uninstall script (qagent_uninstall.sh), specific to Mac and Linux supported versions that invoked multiple system commands without using absolute paths and without sanitizing the $PATH environment.” | regulatory | 2026-10-04 |
| s26 | [KuppingerCole Analysts: Qualys vendor page](https://www.kuppingercole.com/vendors/qualys) “Cloud Native Application Protection Platforms (CNAPP) Overall Leader Product Leader Market Leader Cloud Native Application Protection Platforms (CNAPP) Mike Small Jun 10, 2025” | research | 2026-10-04 |
| s27 | [KuppingerCole Analysts: Leadership Compass, Cloud Native Application Protection Platforms](https://www.kuppingercole.com/research/lc80892/cloud-native-application-protection-platforms-cnapp) “Highlighted vendors for their substantial contributions to the CNAPP landscape include CrowdStrike, Fortinet, IBM, Microsoft, Palo Alto Networks, Qualys, and Wiz, some of which leverage recent advancements in ML and AI to bolster security operations.” | research | 2026-10-04 |
| s29 | [SiliconANGLE: cybersecurity earnings season kicks off with beats from Fortinet, NetScout and Qualys](https://siliconangle.com/2026/02/05/cybersecurity-earnings-season-kicks-off-beats-fortinet-netscout-qualys/) “For its full year, Qualys reported adjusted earnings of $7.07, up from $6.13 in 2024, on revenue of $669.1 million, up 10% year-over-year.” | press | 2026-10-04 |

## Disclaimer

This site is an experimental research aid created by Zeltser Security Corp. All its data gathering and analysis was performed autonomously without human review, and it can contain errors of fact, interpretation, and judgment that a human reviewer might catch.

The analyses are statements of opinion, not statements of fact. Machine analysis produced the scores, summaries, and matrix placements by weighing the public sources each page cites, and reasonable people can weigh the same sources differently. Where a page states a fact, it cites the public source and the date it was checked, and the statement is only as accurate as that source. Unless a profile expressly says otherwise, the analysis involves no hands-on testing and no independent validation of any company's products or services.

Nothing here is professional, security, legal, financial, investment, or purchasing advice, and nothing here is a recommendation to invest in, do business with, or avoid any company. Inclusion of a company is not an endorsement, and absence of a company is not a judgment about it. Reading this site creates no advisory or client relationship. Verify any detail you plan to act on against the vendor's current materials.

The content is provided "as is" and "as available," with all warranties disclaimed, express or implied, including merchantability, fitness for a particular purpose, accuracy, and non-infringement. No entry is warranted to be complete, current, or correct. Companies change, vendors update their claims, sources can be wrong, and automated analysis can misread them.

To the fullest extent permitted by law, the operator, Zeltser Security Corp, is not liable for any damages that arise from using this site or relying on its content, including direct, indirect, incidental, special, and consequential damages and lost profits, even if advised that such damages were possible. If you are dissatisfied with the site or disagree with these terms, your remedy is to stop using it.

Entries link to vendor pages, press coverage, and other external sites that Zeltser Security Corp does not control and is not responsible for. A link is not an affiliation with the destination or an endorsement of it. Product and company names and trademarks are the property of their owners, used here nominatively to identify the companies described. Short quotations from cited sources appear for identification and commentary.

Use, quotation, automated retrieval, and redistribution of the content are governed by the Terms of Use at cybercompanyprofiles.com/terms, which permit personal and internal business use with attribution and prohibit republication and resale.