Qualys, Inc.

day and thank you for standing by. Welcome to the QALYS third quarter 2025 investor call. At this time, all participants are in a listen-only mode. After the speaker's presentation, there will be a question-answer session. To ask a question during the session, you will need to press star 1-1 on your telephone. You will then hear an automated message advising your hand is raised. To withdraw your question, please press star 1-1 again. Please be advised that today's conference is being recorded. I would now like to hand the conference over to your first speaker today, Blair King. Please go ahead.

Thank you, Brianna. Good afternoon, and welcome to QALYS' third quarter 2025 earnings call. Joining me today to discuss our results are Sumedh Thakkar, our president and CEO, and Jimmy Kim, our CFO. Before we get started, I would like to remind you that our remarks today will include forward-looking statements that generally relate to future events or our future financial or operating performance. Actual results may differ materially from these statements, and factors that could cause results to differ materially are set forth in today's press release and our filings with the SEC. including our latest form 10Q and 10K. Any forward-looking statements that we make on this call are based on assumptions as of today, and we undertake no obligation to update these statements as a result of new information or future events. During this call, we will present both GAAP and non-GAAP financial measures. The reconciliation of GAAP to non-GAAP measures is included in today's earnings press release. And as a reminder, the press release prepared remarks and investor presentation are all available on the investor relations section of our website. So with that, I'd like to now turn the call over to Saman.

Thanks, Blair, and welcome to our third quarter earnings call. With third actors continuing to reduce time to explore at a fast pace, I believe the future of cybersecurity is moving from attack surface management to risk surface management, using agentic AI-powered proactive risk management with business quantification and automated remediation. Against this backdrop, we continue to execute well in Q3, demonstrated by another quarter of solid revenue growth and profitability. Over the last couple of years, I've had the privilege of meeting with hundreds of CISOs, CIOs, and security leaders worldwide. From these conversations, one theme has stood out, the need to operationalize cyber risk management in business terms to align budget spend with business risk. CISOs are looking for a practical approach to consolidate tools where possible and empower their teams to use best of breed where it makes sense. They want to seamlessly unify their security toolset into a centralized risk fabric that provides an alternative to single-vendor platformization by operationalizing the management of multiple risk vectors to effectively measure, communicate, and ultimately remediate the organization's risk posture. The Risk Operations Center ROC, powered by Qualys ETM, delivers on this ask. At our recently concluded ROCCON Risk Operations Conference in Houston, where we elevated the business risk conversation To feature a specialized CFO and board track, our customers validated this approach. With the broadening of the agenda for ROCCOM, the attendance was up 20% over last year's QSC event. While traditional security operations centers focused on detecting breaches after they happened, Qualys is pioneering the first agentic AI risk operations center, ROCC, a new category in cybersecurity designed to centralize an organization's response to threats before they impact the business. Powered by our ETM solution, the ROC processes several petabytes of high-fidelity data every day, normalizes and correlates intelligence from both qualis and non-qualis sources, and equips AI and humans to collaborate in real-time, detecting and responding to threats at machine speed. This isn't about more alerts. It's about actions that close blind spots before attackers can exploit them. Unlike traditional continuous threat exposure management CTEM tools that simply highlight the exposure but lack adequate native remediation capabilities, our differentiated ETM solution combines CRQ, CTEM, and native remediation operations to fix the risks that matter most quickly and at scale. By aligning security and IT decisions directly with business priorities, we are providing organizations with measurable proactive risk reduction that boards and customers value. Early adoption is already validating the model, with POCs continuing to convert to commercial deployments, underscoring both the scale of this opportunity and its parallels to the early days of VMDR. And we're not stopping there. Our R&D engine is continuing to deliver innovations, rapidly expanding our platform and positioning Qualys for a larger upsell opportunity. In doing so, Qualys is now extending several proven module native capabilities into ETM, empowering organizations to harness them seamlessly across the entire attack surface. By democratizing trillions of security exposures from both Qualys and third-party tools, including vulnerabilities, misconfigurations, and identities aggregated by our ETM solution, we are unleashing a sophisticated predictive platform that leverages a combination of Qualys through its framework our true-length threat management capabilities, and a mission-ready agentic AI workforce operating autonomously from discovery to remediation with full ITSM integration. This unique combination of capabilities identifies trending threats in real time, benchmarks the risk against peers, assesses organizational impact, and quantifies risk in clear, actionable terms that matter most to the business. As a result, security and IT teams can continuously prioritize ticket and remediate threats based on organizational risks associated with emerging exposure targeting specific industries, asset types, and identities. We believe these most recent additions to our ETM solution further advance our differentiation in the market, enhance security operations, and significantly accelerate measurable outcomes for customers. Next up for our ETM solution, I'm particularly excited about yet another pioneering capability from Qualys, TrueConfirm. TrueConfirm flexes the power of our platform to confirm exploitability before customers become compromised. Using automated validation at scale, we remove the guesswork for customers by running safe exploits over the network to confirm whether the attackers will succeed in their breach attempts while closing the gap between theoretical and actual exposure. This approach further allows customers to be laser-focused on prioritizing only exploitable blind spots for the next logical step which is automated remediation with TrueRisk Eliminate. Our industry-leading capabilities are increasingly being recognized by our customers, partners, and third-party analysts. Specifically, at Black Hat, Qualys won two Pawnee Awards for our outstanding contribution to threat research underpinned by our strong leadership in threat intelligence and triage. Equally important, GigaOM recognized Qualys as the leader in patch management, a market Qualys pioneered with over 140 million patches deployed in the last year alone. While some competitors are only beginning to validate the strategy, Qualys has advanced well beyond patching. True risk eliminate closes the unpatchable gap, enabling IT and security teams to automate an array of compensating controls when patches are deemed too risky to deploy or simply not available. And with adversaries increasingly exploiting vulnerabilities at AI speed, our umbrella of AI-based automated remediation solutions has evolved into a significant adoption layer, a distinctive competitive advantage, and opens new market opportunities for Qualys. Moving on to our business update. With customers spending $500,000 or more, with us growing 5% from a year ago to $211, Let me share a couple of recent wins, which illustrate why organizations ready to centralize their response to cyber risk are turning to Qualys to help unify their security tools, quantify and remediate risk in their environments, and fortify their security operations. In Q3, one of my favorite wins was with a Global 700 customer that was previously only using Qualys for PCI scanning. This customer, like many organizations, were buried under fragmented telemetry manuals, spreadsheets, and disconnected tools. With little automation, their teams were spending more time documenting than reducing risk and consequently were burdened by an onslaught of compliance audits. This customer chose Qualys to transform siloed risk signals spanning code repositories, endpoints, identity, cloud container, and network assets into a cohesive real-time risk management solution by consolidating Qualys and non-Qualys data. This included replacing their existing vulnerability management vendor and purchasing three additional Qualys modules, including ETM, to begin operationalizing the risk operation center with ingested third-party data resulting in a mid-six-figure annual booking sub-sell. By consolidating these data sources into Qualys platform, we are delivering this customer a vendor-agnostic orchestration layer with full visibility of their attack and risk surface, centralized risk management, quantification, prioritization, and remediation, while unleashing the operational efficiencies of security stack consolidation aligned with acceptable risk parameters for the business. With our innovative technology, unmatched platform effect and focus on reducing risk and friction, this will underscore Squalus' ability to eclipse legacy siloed solutions and advance our leadership in the industry. It's also an outstanding example of how we are working with our managed risk operation MROC partners of choice to activate the ROC with new wind business. For the next phase, this customer is evaluating our total cloud native CNAP solution and through this eliminate solutions while also bringing additional third party tools into Qualys platform representing a significant upsell opportunity. Further leveraging our MROC partner ecosystem to drive new logos was a new six-figure customer win with a major airline in the Middle East. This customer chose Qualys because of our unified detection and remediation capabilities with TrueRisk Eliminate. Nearly nine months after announcing GA with our ETM solution and over 28 POCs converting to commercial success already, we have gained valuable insights into ETM pricing and packaging. As a point of reference, we expect that for every $1 of VMDR, ETM can drive an uplift of up to 100%. now that ETM will include cybersecurity asset management, as well as other ETM feature enhancements, such as those mentioned earlier, and third-party data ingestion. Given this, starting with our Q1 2026 earnings call, we will shift from reporting cybersecurity asset management, LTM bookings, to ETM customer penetration, as we believe ETM will be evolving into a key pillar of growth for Qualys over the next several years. Turning to our federal business, we achieved a high six-figure upsell with an existing large government agency This customer has previously used multiple legacy and next-gen tools to manage a variety of risk management use cases across their security IT and DevOps team. In addition to the complexity of using multiple point products, this government agency has become increasingly frustrated with increasing costs associated with legacy on-prem deployments, the efficiencies of operating siloed systems, and elongated remediation efforts. With a distinct need to shift several monolithic workloads to micro-application across its hybrid environment on a FedRAMP high solution. This customer accelerated the consolidation of its security stack over 17 Qualys modules, including VMDR, cybersecurity asset management, TotalAppSec, TotalCloud, TrueRisk, Eliminate, and TotalAI. Today, this customer is leveraging a unified dashboard that provides them with a greater insight in automation than any of the competitive products they evaluated, while taking full advantage of the speed and scale of cloud-native platforms. This alongside a significant seven-figure state win are a testament to the strength we see in our federal, state, and local government business and the long-term growth potential of the market. Beyond these wins, we are also increasingly gaining leverage from our partner ecosystem. In Q3, partner-led deal registration increased, demonstrating the success of our partner-first sales motion. In addition, we have now certified nearly a dozen partners who are actively launching MROC services, leveraging ETM, to deliver centralized automated pre-breach risk management. Momentum is building towards a global ROC alliance, and we expect to certify additional strategic partners in the coming months ahead who are committed to positioning Qualys as their MROC partner of choice. Further contributing to our platform growth is our flexible platform pricing model, which we are calling QFlex. We beta tested QFlex in Q3 to help customers accelerate and maximize the adoption of the Qualys enterprise risk platform. In less than a quarter after introducing this model, we're seeing notable customer interest and tremendous success. To give you an example, an existing Global 10 customer made a multi-year commitment under our QFlex program, increasing their annual bookings by over 50% while adding new modules to their subscription count with Qualys. This one reflects our growing capabilities in risk management and we expect the contribution from QFlex to continue to grow. Our continuous innovation, early ROC deployments, strategic wins with federal, customer, and state agencies, momentum in partner-led initiatives, and the initial adoption of QFLEX collectively underscore Qualys' strength in unifying risk management workflows, reducing operational complexity for customers, and addressing today's toughest security challenges. We believe these achievements not only validate our ongoing investments, but also position Qualys as a trusted leader in pre-breach cyber risk management setting the stage for durable growth and long-term success. With that, I will turn the call over to Jumi to further discuss our third quarter results and look for the fourth quarter and full year 2025.