Qualys, Inc.

Ladies and gentlemen, thank you for standing by. Welcome to QALYS' second quarter 2025 investors call. At this time, all participants are in a listen-only mode. After the speaker's presentation, there will be a question and answer session. To ask a question during the session, you will need to press star 1-1 on your telephone. You will then hear an automated message advising your hand is raised. And to withdraw your question, please press star 1-1 again. Please be advised that today's conference is being recorded. I would now like to turn the conference over to Blair King, Investor Relations. Please go ahead, sir.

Thank you, Michelle. Good afternoon and welcome to Qualys' second quarter 2025 earnings call. Joining me today to discuss our results are Smed Thakkar, President and CEO, and Jimmy Kim, our CFO. Hello. Before we get started, I would like to remind you that our remarks today will include forward-looking statements that generally relate to future events or our future financial or operating performance. The actual results may differ materially from these statements. The factors that could cause results to differ materially are set forth in today's press release and our filings with the SEC. including our latest form 10Q and 10K. Any forward-looking statements that we make on this call are based on assumptions as of today, and we undertake no obligation to update these statements as a result of new information or future events. During this call, we will present both GAAP and non-GAAP financial measures. The reconciliation of GAAP and non-GAAP measures is included in today's earnings press release. And as a reminder, the press release prepared remarks and investor presentation We're all available on the investor relations section of our website. So I'd like now to turn the call over to Sumedh.

Thank you, Blair, and welcome to our second quarter earnings call. In Q2, we continued to execute well, resulting in another quarter of solid revenue growth and profitability. In this new era of cybersecurity driven by advanced data analytics, automation, and AI, Qualys is pioneering a new risk operation center category in cybersecurity and redefining how organizations manage cyber risk. While traditional security operations centers saw focus on detecting breaches after they happen, the ROC is built for prevention. Qualys' cloud-native ETM, Enterprise Tourist Management Solution, powers this transformation. With over 18 trillion data points processed in real time, we have unleashed the power of our platform to integrate and normalize signals from both Qualys and non-Qualys tools, including CrowdStrike, Security Scorecard, Tenable, and Wiz. Unlike other continuous threat exposure management, solutions that simply highlight exposure and lack effective remediation or business context, Qualys' ETM solution is a powerful orchestration layer aggregating both Qualys and non-Qualys security findings, applying threat intelligence, and delivering a unified business contextual view of risk with holistic prioritization and automated remediation. This business-aligned approach to pre-breach cyber risk management continues to resonate strongly with customers and boards and positions Qualys at the forefront of a paradigm shift in cybersecurity. One defined not just by the detection of the vulnerabilities, but by measurable proactive automated risk reduction at scale. With active POCs already converting after announcing GA just a short while ago, we continue to see many parallels between this new market opportunity and the early days of our VMDR launch, including a significant greenfield opportunity and growing demand. With our latest announcement yesterday, we are very excited to introduce Qualys' latest game-changing vision for the future of cyber risk management with the launch of a fully reimagined agentic AI platform built on a unified fiber to seamlessly manage cyber risk across multi-vendor environment. At its core, every cyber risk AI agent represents a specialized autonomous AI fabric equipped to automate complex business processes and autonomously adapt to customer's environment by accessing diverse internal and external data sources, applications, and machines. These agents achieve complete end-to-end outcomes for cybersecurity teams. Available in a first-of-a-kind agentic AI marketplace for risk management, CISOs can now quickly augment their team with highly specialized autonomous experts that can bring down the time to remediation, increase accuracy, and reduce costs. Users can use out-of-the-box cyber risk agents available in the marketplace, interactively create their own specialist agents, or leverage third-party agents from our partners that can be added to the marketplace in the future. Further advancing our remediation focus beyond patching, we are also introducing new capabilities to our TrueRisk eliminate umbrella of remediation solutions. Now organizations can quickly determine trending risks to their environment. the estimated impact of a breach on a particular asset, and the probability of successfully applying a patch. If applying a patch is deemed a significant operational risk to the business, security and IT teams can alternatively choose to automate an array of compensating controls to prevent an incident from occurring. Embedding Qualys' AI assistance directly into remediation workflows is a significant adoption lever, a strong competitive differentiator, and opens new market opportunities well beyond patch management. Continuing this rapid pace of innovation, we are further broadening our ETM solution and bringing natively integrated identity security posture management, ISPM, to market at a time when identities have become part of the new perimeter. Compromised credentials are central to nearly every major cyber attack today, and Qualys' solution is aimed at helping organizations stay in front of adversaries by continuously analyzing identity systems for misconfigurations, excessive privileges, and toxic combinations with assets. By unifying the identity risk surface, we eliminate silos and help security teams visualize identity exposure and remediate risk before attackers escalate privileges or move laterally. Spanning devices, cloud workloads, and applications, Qualys now provides holistic protection using Qualys and non-Qualys data sources across key identity touchpoints, mapped to asset criticality, and backed by real-time remediation through a single natively integrated platform. These innovative new approaches to cybersecurity risk management, along with several others we are showcasing at Black Hat this week, allow our customers to reduce complexity and cost, achieve better outcome, and create multidimensional path for durable long-term growth in our business. Moving on to the business update, over the last several months, I have personally met with many customers, prospects, and partners, and the message has remained resoundingly clear. Organizations are increasingly anchoring pre-breach cyber spend to solutions that articulate and demonstrate a measurable impact on cyber risk. Rather than consolidating around a single vendor, CISOs are seeking platforms that allow flexibility across their security stack while unifying risk through a common framework. This requires a centralized risk fabric, which brings together diverse tools and enables teams to uniformly assess, prioritize, and remediate risk. With a 25-year track record of converting operational challenges for customers into strong competitive advantages, we are well positioned to capitalize on these evolving market opportunities. In Q2, this success was demonstrated by the number of customers spending $500,000 or more growing 7% from a year ago to 212. It was also evidenced by notable industry endorsements in the market we helped pioneer. Qualys' VMDR with TrueRisk and TotalCloud were voted the best vulnerability and cloud security posture management solution respectively at the 2024 SC Awards in Europe. IDC named Qualys as a major player in CNAP and Kopinger Cole recognized Qualys as a leader in CNAP and a market leader in attack surface management. Let me share a couple of recent wins which illustrate these accolades and reflect why companies ready to centralize their response to cyber risk turning to Qualys to help unify their security tools, quantify and mediate risk in their environments, and achieve better security outcomes. First, a global fintech company determined that managing siloed tools added complexity to their operations, lacked integration, and missed detections, which hindered their ability to assess risk and centralize remediation. This customer chose Qualys to transform siloed risk signals spanning code repositories, endpoints, identity, cloud, container IT, and network assets into a cohesive real-time risk management solution by consolidating Qualys and non-Qualys data. This included purchasing seven Qualys modules, including ETM, to begin operationalizing their risk operation center with ingested data from CrowdStrike, BitSight, and WIS, resulting in a seven-figure annual booking deal. By consolidating these data sources into the Qualys platform, we're now delivering this customer a vendor-agnostic orchestration layer with full visibility of their attack surface, centralized risk assessment, quantification, prioritization, and remediation, while unleashing the operational efficiencies of security stack consolidation aligned with acceptable risk parameters for the business. Another marquee win was a large federal government agency previously using multiple legacy and next-gen solutions to manage a variety of risk management use cases across that IT security and DevOps teams. In addition to the complexity of using multiple points products, this government agency was frustrated with increasing costs associated with outdated on-prem deployments from last several years. Looking to migrate to a cloud native solution that meets the CISA binding operational directives, they are now in the process of replacing two of their existing vendors in a high six-figure annual booking deployment using 10 Qualys modules, including Cybersecurity Asset Management, VMDR, Patch Management, and Total Cloud. Through this highly strategic and competitive win, the customer is now able to leverage unified dashboards across nearly a dozen separate bureaus that provide them a greater insight and automation that any of the competitive products that they had evaluated taking full advantage of the speed and scale of the integrated platform. With out-of-the-box support for CDM within the CISA framework, we are now working towards a phase two agency-wide rollout of the cybersecurity asset management solution, representing a significant upsell opportunity for us. Beyond this win, we are pleased to announce Qualys has recently received agency authorization for FedRAMP High. With this authorization, Qualys is the only FedRAMP High platform offering inventory vulnerability management, patch management, CSPM, container security, and EDR in a single unified workflow across hybrid environments. As government agencies increasingly transition workloads from on-prem environments to the cloud, the achievement marks a significant milestone and establishes Qualys as the only modern alternative to legacy scanners for federal, state, and local agencies. Our authorization consolidated platform and Continued investment in public sector expansion underscores our commitment to this market and positions call as well to drive long-term incremental growth. That momentum was on full display at our second annual public sector risk conference, cyber risk conference in May, where we were especially encouraged by the strong turnout and positive feedback to the concept of a risk operation center to bring efficiency to government agencies instead of playing risk whack-a-mole with multiple siloed legacy solutions. Investing in our partner's ecosystem remains a key pillar of our growth agenda. Through our strategic technical alliances program, we are driving deep technology integrations, wholesaling opportunities, and demand generation programs. We believe this expanding ecosystem bolsters our capacity, harnesses transformative solution sales, and brings new business to Qualys. Additionally, we have advanced our global ROC ecosystem by certifying three new strategic MROC partners who wanted to partner with Qualys to bring the rock to their customer base. With growing channel momentum and a growing pipeline of fresh new MROC services being offered to customers, we look forward to sharing some exciting new wins in the upcoming quarters. With more and more customers and partners beginning to perceive Qualys as a leading pre-breach risk mitigation management platform that consolidates and orchestrates multiple security solutions and workflows, I am pleased to announce May Mitchell as our newly appointed CMO. Pipeline creation, growing module adoption, winning new business, and evangelizing the AI native rock are key priorities. With May at the helm and her long experience in cybersecurity, we are intensifying our marketing activities and increasing focus on ramping top of the funnel initiatives and enhancing brand awareness to help drive adoption of the Qualys platform to new heights. To further accelerate awareness and unleash new Qualys capabilities for customers, I'm also pleased to announce the launch of our Qualys platform pricing model, where we enable customers to purchase Qualys units, QLUs, providing access to the entire platform and flexibly utilizing Qualys modules of their choice over the course of their subscription term. Instead of purchasing Qualys modules individually, organizations now adopt the products they need today and in the future through a frictionless process design to flexibly replace existing technologies and seamlessly switch between Qualys modules. Customers are expressing strong enthusiasm for this new pricing model, and we believe it will further enhance long-term customer loyalty, drive larger lands, reduce cost, and bolster cyber resilience over time with more customers adopting more Qualys solutions faster. In summary, Qualys is well-armed with fresh new capabilities, a new agency-authorized FedRAMP high solution for government-wide use, strong channel momentum, and flexible platform pricing to help customers unify pre-breach risk management workflows reduce cost, and address today's toughest security challenges. With trusted innovation and early rock adoption, we're strengthening our position as the partner of choice for customers ready to centralize their response to cyber risk and believe we are poised to outpace our competitors, extend our thought leadership, and build upon an already strong foundation to drive durable long-term growth in the business. With that, I will turn the call over to Jumi. to further discuss our second quarter results and outlook for the third quarter and full year 2025.