Qualys, Inc. — FY2022 Form 10-K
Reporting period: Fiscal year ended December 31, 2022. This is an annual filing; the provided text does not give a separate fourth-quarter financial breakdown.
Business context
Qualys provides cloud-delivered IT security, vulnerability management, compliance, web application, asset management, and cloud/container security subscriptions. It serves more than 10,000 customers, principally through renewable subscriptions recognized ratably over the service term. No customer represented more than 10% of revenue. In 2022, 42% of revenue came through channel partners and 60% came from U.S. customers.
Financial and operating performance
| Metric | FY2022 | FY2021 | Change / context |
|---|---|---|---|
| Revenue | $489.7 million | $411.2 million | Up 19%; growth came from existing customers (80% of the increase) and new customers (20%). |
| Gross profit / margin | $386.9 million / 79% | $321.7 million / 78% | Margin improved 1 percentage point. |
| Operating income / margin | $130.5 million / 26% | $87.7 million / 21% | Improved as operating expenses fell as a share of revenue. |
| Net income / margin | $108.0 million / 22% | $71.0 million / 17% | Basic EPS $2.81; diluted EPS $2.74, versus $1.82 and $1.77. |
| Adjusted EBITDA | $218.6 million / 45% | $191.2 million / 46% | Amount increased; margin declined 1 percentage point. Non-GAAP measure. |
| Cash from operations | $198.9 million | $200.6 million | Nearly flat year over year. |
| Cash, cash equivalents and marketable securities | $380.5 million | Not stated here as a comparable total | Includes $52.7 million held outside the U.S. |
| Debt | No borrowings reported on the balance sheet | — | Operating lease liabilities are separately reported. |
Operating cash flow less capital expenditures was approximately $183.5 million, calculated from the filing’s figures; this is not a company-reported free-cash-flow measure. Current assets were $473.3 million and current liabilities were $352.2 million. Deferred revenue totaled $317.2 million, including current and noncurrent amounts.
Material changes versus FY2021
- Revenue grew 19%, with increased demand from both existing and new customers.
- Operating income rose to $130.5 million from $87.7 million. General and administrative expense declined $18.3 million, primarily because FY2021 included $27.3 million of accelerated stock-based compensation following the former CEO’s disability-related departure.
- Research and development expense increased 24% and sales and marketing expense increased 27%, mainly due to higher personnel costs and investment in growth.
- Income tax expense increased to $25.7 million from $18.4 million. The filing cites higher pretax income and the 2022 requirement to capitalize and amortize R&D expenses for tax purposes; it also reports higher cash taxes in 2022.
- Qualys repurchased 2.5 million shares for $317.3 million, versus $130.0 million in FY2021. Approximately $154.5 million remained authorized at year-end; the board authorized a further $100 million in February 2023.
- Qualys acquired Blue Hexagon technology assets for $10 million in cash consideration, plus assumed deferred revenue, to add AI/ML-driven network threat detection capabilities.
Outlook, risks and unusual items
- Management said it expects revenue growth from new and existing customers to continue, but this filing does not provide numeric financial guidance. It expects 2023 capital expenditures of $18 million to $25 million and stated existing liquidity and operating cash flow should fund operations for the next twelve months and beyond.
- Key risks include macroeconomic weakness and reduced IT spending, competition and pricing pressure, subscription renewals and customer acquisition, reliance on channel partners (42% of revenue), cybersecurity incidents, and service disruption at third-party cloud facilities. Foreign exchange, privacy and regulatory compliance, and the ability to scale the platform are also identified risks.
- The filing describes a 2020 security incident involving an Accellion file-transfer server; attackers obtained certain information, affected customers were notified, and the company incurred response costs. Qualys warns that future incidents could cause liability, reputational harm, or customer losses.
- Legal proceedings: the company reported a $1.5 million accrual for a matter considered probable and reasonably estimable, while stating it had no ongoing legal proceedings with a material loss that was at least reasonably possible as of year-end.
- Grant Thornton issued unqualified opinions on the financial statements and internal control over financial reporting. Management also concluded disclosure controls and internal controls were effective as of December 31, 2022.
Important facts for investors to verify
- Whether customer retention, renewal rates, and subscription expansion sustain growth; net dollar expansion rate was 109% in 2022 versus 108% in 2021.
- How much of reported profitability and cash generation is affected by stock-based compensation, tax timing, and other non-GAAP adjustments.
- Whether the substantial 2022 repurchases and subsequent authorization remain consistent with investment needs and liquidity plans.
- The progress and commercial contribution of 2022 product introductions and the Blue Hexagon technology acquisition.
- Developments in the $1.5 million legal matter, cybersecurity exposures, and third-party cloud platform resilience.
- The impact of R&D tax capitalization, foreign exchange movements, and macroeconomic conditions on future cash taxes and results.