2022 
Environmental, 
Social, and 
Governance Report

1
4
5
6
2
3
Table of 
Contents
Introduction	 	
	
	
	
	
3
A Message from Our CEO	
	
	
	
3
Our Vision 	
	
	
	
	
	
4
Qualys Cloud Platform	
	
	
	
5
Our Approach to ESG	
	
	
	
6
ESG Oversight	
	
	
	
	
7
Governance and Responsible 
Business Practices	
	
	
	
	
8
Board and Leadership Diversity	
	
	
9
Code of Conduct	
	
	
	
	
9
Intellectual Property	 	
	
	
	
10
Political Advocacy	
	
	
	
	
10
Vendor Management and Responsible Sourcing	
10
Our Customer Commitment		
	
	
11
Enterprise Risk Management and 
   Business Continuity		
	
	
	
12
Customer Privacy	
	
	
	
	
12
Cybersecurity		
	
	
	
	
13
Supporting Our Team and Community	
	
15
Diversity, Equity, and Inclusion	
	
	
16
Employee Engagement, Training, 
     and Development	 	
	
	
	
17
Benefits and Compensation 		
	
	
18
Our Community Engagement	
	
	
19
Sustainable Business Operations 	
	
	
20	
Optimizing Our Energy Use	 	
	
	
21
Assessing Our Carbon Footprint	
	
	
22
Employee Commuting Programs	
	
	
23
Reducing Our Waste	 	
	
	
	
23
Minimizing Our Customers’ Environmental Impact 	23
Appendix	
	
	
	
	
	
24
United Nations Sustainable Development 
     Goals (SDGs) 	
	
	
	
	
25
SASB Standards   	
	
	
	
	
26
Legal Notice Regarding Forward-Looking 
     Statements		
	
	
	
	
26
2  |  Qualys 2022 Environmental, Social, and Governance Report

Introduction   |    Governance and Responsible Business Practices   |   Our Customer Commitment   |   Supporting Our Team and Community   |   Sustainable Business Operations   |   Appendix
3  |  Qualys 2022 Environmental, Social, and Governance Report
Doing the right thing for our people, communities, 
and environment invokes the trust of our customers, 
partners, employees, and stockholders, enabling us to 
grow our business profitably and meet the diverse needs 
of our constituents.
The passion and vision for helping companies minimize 
cyber risks has driven Qualys since it pioneered vulnerability 
management in the cloud in 1999—through today, with 
the recent launch of our VMDR platform with TruRisk 
and Patch Management. Over the past 20-plus years, we 
have operated a vast cloud platform that, in 2022 alone, 
conducted more than 6 billion scans, managed 92 million 
agents, and deployed more than 45 million patches.
At Qualys, we measure success on the basis of our ability 
to enable a safer environment in the digital world. Today, 
we help more than 10,000 subscription customers, 
including some of the world’s largest airlines, banks, 
healthcare providers, education institutions, manufacturers, 
and technology companies, to secure their digital 
experiences—and in turn, strive to enhance people’s lives 
and positively impact society.

Over the past year, we have made significant progress 
toward integrating ESG into our priorities, policies, and 
processes. Our ESG journey is a team effort, and I wish 
to thank everyone who has contributed to us forging a 
path to a better and more secure world—our Board, our 
employees, and our customers. I invite you to learn more 
about our journey in our first Qualys ESG Report.
Sincerely,
Sumedh Thakar
President and CEO, Qualys
A Message From Our CEO
I am proud to share Qualys’ inaugural 
Environmental, Social, and Governance 
(ESG) Report. Our commitment to strong 
governance, environmental stewardship, 
and social responsibility is essential to 
our business strategy and long-term 
value creation for our stakeholders.

Introduction   |    Governance and Responsible Business Practices   |   Our Customer Commitment   |   Supporting Our Team and Community   |   Sustainable Business Operations   |   Appendix
4  |  Qualys 2022 Environmental, Social, and Governance Report
At Qualys, we are passionate about 
helping companies navigate their digital 
transformations and make their customers’ 
digital experiences—banking, booking 
travel, shopping, mobile payments, and 
more—as secure as possible.
We were founded in 1999 as one of the first Software as a 
Service (SaaS) security companies and have since grown 
to become a pioneer and leading provider of cloud IT, 
cybersecurity, and compliance solutions. Our Qualys Cloud 
Platform is used by over 10,000 customers worldwide, 
including many of the top companies listed in the Forbes 
Global 100 and Fortune 100.
Our success is not measured just by our growth as a 
company. We measure our success by the impact we have 
on our customers and the value we bring to their digital 
transformation. Digital transformation has completely 
changed how businesses operate and deliver customer 
value. As a key enabler of digital transformation, Qualys 
plays a crucial role in streamlining and consolidating IT, 
security, and compliance tools onto a single cloud 
platform for greater agility, better business outcomes, 
and substantial cost savings.
Our cloud-based approach consolidates over 20 IT, 
security and compliance applications into one integrated, 
easy-to-use solution that automates many manual tasks.  
This allows customers to deliver services to their own 
customers more efficiently and effectively while also 
improving their risk and compliance posture. With 
Qualys, our customers have better control over their IT, 
security, and compliance spending and can respond to 
threats faster.

We strive to make the digital world a safer place for 
everyone, and we are committed to being a vital partner 
in our customers’ digital transformations.
Our Vision
Everything visible. Everything secure.

10,000+ 

70%

2,143

20+
subscription 
customers 
worldwide
of Forbes 
Global 50
employees 
worldwide
applications 
protecting thousands 
of customers 
in 130 countries
Figure 1: Qualys at a Glance as of December 31, 2022

Introduction   |    Governance and Responsible Business Practices   |   Our Customer Commitment   |   Supporting Our Team and Community   |   Sustainable Business Operations   |   Appendix
5  |  Qualys 2022 Environmental, Social, and Governance Report

 
Qualys Cloud Platform
Companies need help keeping up with the ever-evolving 
landscape of cybersecurity threats. They find themselves 
with siloed teams that struggle to keep their digital 
footprints secure and compliant.
At Qualys, we endeavor to help organizations get more 
security and to drive better business outcomes. With the 
power of a single cloud agent and multiple scanners, the 
Qualys Cloud Platform provides a continuous, always-
on assessment of a company’s global IT, security, and 
compliance posture. It provides real-time visibility and 
control across all IT and OT assets, enabling quick 
responses to emerging threats and potential exploits.
It also offers over 20 cloud apps, tailored to specific IT, 
security, and compliance requirements. These apps help 
companies protect a range of assets across on-premises, 
endpoints, cloud, container, and mobile environments.


By taking a risk-based approach to cybersecurity and 
providing visibility across the enterprise, the Qualys 
Cloud Platform helps companies achieve both operational 
maturity and cyber resiliency. It consolidates security and 
compliance spend and reduces IT complexity, allowing 
companies to focus on their digital transformation journey 
with confidence.
92 million
Cloud agents across servers, 
endpoints, clouds and containers
2+ trillion
Security events 
collected in real time
13+ trillion data points
Indexed on elasticsearch clusters, giving 2-second visibility
6+ billion
IP scans/
audits a year
100,000+
Scanner appliances
Active Scanners
Cloud Agents
Figure 2: Platform Brings Global Visibility Across Hybrid IT Environments as of December 31, 2022

Introduction   |    Governance and Responsible Business Practices   |   Our Customer Commitment   |   Supporting Our Team and Community   |   Sustainable Business Operations   |   Appendix
6  |  Qualys 2022 Environmental, Social, and Governance Report
Our Approach to ESG
At Qualys, we are fiercely passionate about protecting 
our customers from cyber threats and ensuring that they 
are compliant with both internal policies and external 
regulations. We believe that our success is measured 
not just by financial gains but also by the positive impact 
we have on the world around us. That’s why our 
commitment to our customers is underpinned by 
our sound governance practices, efforts to support 
our employees and communities, and environmental 
stewardship. We are pleased to share our inaugural ESG 
Report, highlighting our current ESG practices, initiatives, 
and progress across four pillars of commitment.
Unless otherwise noted, all information and data provided 
in this report cover our fiscal year 2022 (FY 2022) 
operations, reflecting data for the period from January 1 
through December 31, 2022.

To further address the primary ESG factors relevant to 
our stakeholders, we have aligned the report with the 
SASB accounting standards related to the Software and 
Information Technology (IT) services industry where 
possible. We have also identified several United Nations 
Sustainable Development Goals (SDGs) that we believe 
our business activities and priority areas support. Both are 
included in the Appendix at the end of this report. 
Throughout the report, we guide readers to additional 
sources of information on Qualys.com and other website 
references for convenience. Please see our forward-looking 
statement at the end of this report for more information.
Governance and Responsible 
Business Practices

We are committed to sound corporate governance and ethical 
business practices that build value and trust with all stakeholders.
Our Customer Commitment

Our goal is to delight our customers through innovative solutions 
that assist in reducing cyber risk.
Supporting Our Team and 
Community

We believe every employee makes a difference, and we strive 
to empower employees in their roles and support their career 
growth. We continuously work to strengthen our communities 
through volunteer efforts and charitable giving.
Sustainable Business Operations

We are committed to reducing the environmental impact of 
our operations and to providing more environmentally friendly 
solutions for our customers through our cloud-based platform. 
Figure 3: ESG Pillars

Introduction   |    Governance and Responsible Business Practices   |   Our Customer Commitment   |   Supporting Our Team and Community   |   Sustainable Business Operations   |   Appendix
7  |  Qualys 2022 Environmental, Social, and Governance Report
ESG Oversight
Our Board of Directors (Board) believes that ESG 
oversight is the responsibility of the entire Board. Each 
Board committee works closely with management to 
oversee ESG initiatives across our business operations in 
the areas aligned with their respective responsibilities. 
Our Nominating and ESG Committee is dedicated to 
overseeing our overall ESG activities, programs, and public 
disclosures. Our Audit and Risk Committee has oversight 
of policies on risk assessment and risk management, 
including security, data privacy, reliability, business 
continuity, and capacity matters. Our Compensation 
and Talent Committee oversees various human capital 
management areas, including talent acquisition, 
compensation, benefits, training and development, and 
diversity, equity, and inclusion (DEI).

To further inform and increase awareness of our approach 
to ESG and related objectives, we are committed to 
ongoing engagement with our essential stakeholders 
including our shareholders, employees, suppliers, local 
communities, and customers.
Figure 4: ESG Governance Structure




Audit 
and Risk 
Committee




Compensation 
and Talent 
Committee

Board of Directors




Nominating 
and ESG 
Committee
Oversight of
 ESG approach 
and reporting
Oversight of risk assessment, 
including security, 
data privacy, and 
business continuity
Oversight of human capital, 
including training and 
development and DEI

8  |  Qualys 2022 Environmental, Social, and Governance Report
Introduction   |            Governance and Responsible Business Practices   |   Our Customer Commitment   |   Supporting Our Team and Community   |   Sustainable Business Operations   |   Appendix
Governance and Responsible 
Business Practices
Our Board sets the bar high for our employees, officers, and directors 
based on sound and ethical governance practices. We believe the 
independence of our directors and the diversity of our Board are 
crucial in facilitating the Board’s responsibilities.
8  |  Qualys 2022 Environmental, Social, and Governance Report
Introduction   |            Governance and Responsible Business Practices   |   Our Customer Commitment   |   Supporting Our Team and Community   |   Sustainable Business Operations   |   Appendix

9  |  Qualys 2022 Environmental, Social, and Governance Report
Introduction   |            Governance and Responsible Business Practices   |   Our Customer Commitment   |   Supporting Our Team and Community   |   Sustainable Business Operations   |   Appendix
Qualys is committed to maintaining a 
strong corporate governance program 
that complies with regulation, reflects best 
practices, and continues to evolve as new 
expectations and opportunities emerge.

Board and Leadership Diversity
The Board seeks to identify director candidates with a wide 
range of perspectives, competencies, and knowledge that 
will best complement the skills, diversity, and experiences 
of the current Board. Two directors on our current six-
member Board identify as women, and one director 
identifies as being from an underrepresented community.
Our executive leadership is also gender and ethnically 
diverse, with more than 50% of the executive team hailing 
from underrepresented communities. For more information 
about our approach to diversity, equity, and inclusion, see 
Supporting Our Team and Community.
Code of Conduct
Our Code of Business Conduct and Ethics (Code), which 
applies to all employees and the Board, covers responsible 
behavior related to avoiding conflicts of interest, public 
communications, financial reporting, safeguarding 
company assets, and interactions with governments, 
customers, suppliers, and competitors. Our third-party 
agents, contractors, and vendors are also expected to 
review and abide by the Code.

Our Code is further supported by the internal 
Anticorruption Compliance Policy and Guidelines, which 
provide detailed guidance regarding our ethical and legal 
obligations relating to the U.S. Foreign Corrupt Practices 
Act (FCPA) and United Kingdom Bribery Act (UKBA).

All employees are required to sign and acknowledge 
the Code of Business Conduct and Ethics upon hire. We 
also conduct compliance-related training on the Code 
and related topics. Violations of the Code are strictly 
prohibited; further, we strictly prohibit any retaliation 
against a person who has reported in good faith a violation 
or suspected violation of the law, our Code, or other 
Qualys policies. Complaints may be filed anonymously 
through our whistleblower hotline, by email, or via 
regular mail. We are dedicated to ethical and responsible 
governance, and our Chief Legal Officer and Chief 
Financial Officer are responsible for reviewing reports on 
suspected violations and escalating as needed.
Governance and Responsible Business Practices
Independent
Non-independent
5
1
Independence
<50 Years
50-60 Years
>60 Years
2
1
3
Age
Female
Male
2
4
Gender
Figure 5: Qualys Board 
Composition as of June 7, 2023
For more information about 
the composition of our Board, 
please refer to our latest 
Proxy Statement.

10  |  Qualys 2022 Environmental, Social, and Governance Report
Introduction   |            Governance and Responsible Business Practices   |   Our Customer Commitment   |   Supporting Our Team and Community   |   Sustainable Business Operations   |   Appendix
Intellectual Property
We take the utmost care and work diligently to protect our 
intellectual property. We rely on trade secrets, copyrights, 
patents, trademarks, and contractual protections to 
establish and protect our intellectual property rights 
and proprietary technology. Qualys also subscribes to 
trademark watch services that alert us to any potentially 
identical and/or confusingly similar marks to our 
trademarks, along with an attorney’s recommendation 
on the results of the trademark watch based on their 
consideration of prior trademark rights and the likely 
impact on our business. For more information on our 
intellectual property practices, please see our latest 
annual report on Form 10-K.
Political Advocacy
While Qualys reserves the right to communicate its 
position on important issues to elected representatives 
and other government officials, the Company does not 
maintain a political action committee (PAC). In FY 2022, 
the Company did not make any corporate contributions 
or incur any expenses related to lobbying. We do 
not reimburse, compensate, or otherwise incentivize 
employees to make political contributions. All expectations 
for our employees related to political contributions and 
lobbying are covered in our Code.
Vendor Management and 
Responsible Sourcing
Qualys is committed to responsibility in our supply chain 
and strives to enhance transparency and accountability 
throughout our operations. We work with a variety of 
vendors to support our product offerings as well as our 
day-to-day business operations, and our approach to 
responsibility starts with the Qualys Code. All contractors 
and vendors are expected to review and abide by the 
Code, and we recognize that our operations’ environmental 
and social impact also extends to our vendor practices.

We are committed to conducting business in a legal, ethical, 
and responsible manner and require that our approved vendors 
meet the same high standards. Consequently, vendors that play 
a significant role in ensuring the reliability and integrity of our 
core business are subject to security risk assessments and 
other compliance reviews designed to verify that they meet 
our standards related to security, compliance, and other key 
attributes. For leading vendors, we perform reviews and/or 
audits of third-party and vendor-provided documentation to 
ensure compliance with contractual requirements.

The Board and executive leadership team are also 
dedicated to ensuring that no modern slavery or human 
trafficking is associated with our supply chain or with 
any part of our business. To support this commitment, 
our procurement documentation includes a requirement 
for our suppliers to confirm that they are not involved in 
modern slavery or human trafficking.

Finally, we work with our leading contract manufacturers 
to ensure compliance with regulations relating to the use 
of conflict minerals in our products.

Please see our Modern Slavery Act Statement and latest 
Form SD for more information on these policies and 
related compliance programs.

11  |  Qualys 2022 Environmental, Social, and Governance Report
Introduction   |   Governance and Responsible Business Practices   |            Our Customer Commitment   |   Supporting Our Team and Community   |   Sustainable Business Operations   |   Appendix
Our Customer 
Commitment
Customers need to understand their cyber exposure across hybrid 
environments with the ability to remediate as quickly as possible 
to reduce overall risk. To help customers tackle evolving security 
challenges, Qualys is continuously innovating and enhancing our platform. 
Introduction   |   Governance and Responsible Business Practices   |            Our Customer Commitment   |   Supporting Our Team and Community   |   Sustainable Business Operations   |   Appendix
11  |  Qualys 2022 Environmental, Social, and Governance Report

12  |  Qualys 2022 Environmental, Social, and Governance Report
Introduction   |   Governance and Responsible Business Practices   |            Our Customer Commitment   |   Supporting Our Team and Community   |   Sustainable Business Operations   |   Appendix
Our commitment to customers means 
that we hold ourselves to the highest 
standards; take pride in the robustness 
of our risk management, cybersecurity, 
and customer data privacy efforts; and 
continuously review and enhance them. 
Enterprise Risk Management and 
Business Continuity 
Our Board has responsibility for the oversight of risk 
management, with Board committees assisting in 
specified areas of focus. The Audit and Risk Committee 
is responsible for our guidelines and policies with respect 
to risk assessment and management. This committee also 
reviews and monitors management’s assessment of the 
key risks. The Nominating and ESG Committee assists with 
risks associated with Board organization, membership, and 
structure, and ESG matters.

The Board meets with our Chief Executive Officer and 
other members of the senior management team quarterly, 
or whenever required, to discuss strategy and risks facing 
the company. We also conduct regular tabletop exercises 
to help ensure that our team is prepared in the event of a 
significant threat to our operations.

Our IT, security, and compliance solutions are delivered 
from multiple multi-tenant platforms spread throughout 
the world. Our security platform is built on a modern 
cloud-agnostic microservices architecture and can be 
deployed in any public or private cloud infrastructure 
setup. We have reliability and resiliency built into every 
platform deployment. We follow best practices to back 
up and replicate our data to ensure fault tolerance and 
recovery, even in the case of a full data center outage. Our 
backup and disaster recovery plans are certified through 
third-party audits and tested annually.

For further information on our approach to risk 
management and key risks, please see our most recent 
Proxy Statement and annual report on Form 10-K.
Customer Privacy
Due to the nature of our business (purely business-
to-business), Qualys collects a very limited amount of 
Personally Identifiable Information (PII). We employ a 
variety of measures to protect data that is collected, 
including encrypting all information that is submitted 
when ordering our services using the Transport Layer 
Security (TLS) protocol. Our security procedures are 
subject to annual Statement on Standards for Attestation 
Engagements No. 18 (SSAE 18) SOC 2 industry-standard 
audits by an internationally recognized accounting firm. 
Please see our Privacy Statement for more information 
on how we use and protect PII that is collected through 
the course of our business operations or through visiting 
our website.

Qualys has a rigorous approach to security, and we are 
constantly working to improve our security measures and 
keep our customers’ data safe and secure.
Our Customer Commitment

13  |  Qualys 2022 Environmental, Social, and Governance Report
Introduction   |   Governance and Responsible Business Practices   |            Our Customer Commitment   |   Supporting Our Team and Community   |   Sustainable Business Operations   |   Appendix
Cybersecurity
Cybersecurity and compliance are our business, and it 
is a business that runs on trust. Our customers look to 
Qualys to protect their systems and applications from 
ever-evolving cyberattacks and maintain compliance 
with related policies, regulations, and customer privacy 
considerations. We continually work to enhance the 
security of our systems and provide customers with the 
strongest protections possible. We hold ourselves to 
the highest standards regarding data security policies 
and customer privacy programs. We do not just aim 
for “good”—we start with “great” and work to exceed 
expectations. Trust is the foundation of our business, and 
we take the responsibility to protect our customers’ data 
and privacy very seriously.
Oversight of cybersecurity and customer data privacy at 
Qualys begins with our Board and the direct supervision 
of the Audit and Risk Committee. Our Chief Information 
Security Officer has management oversight of IT, platform, 
physical infrastructure, and product security, and other 
department leaders regularly update the Board on 
cybersecurity and customer privacy.

Our software services are rigorously audited by 
independent third-party companies and government 
bodies for compliance with various global and regional 
standards. Qualys software passes a series of automated 
and manual tests before reaching production. We 
continuously monitor vulnerabilities, misconfigurations, 
and weaknesses across our enterprise.

14  |  Qualys 2022 Environmental, Social, and Governance Report
Introduction   |   Governance and Responsible Business Practices   |            Our Customer Commitment   |   Supporting Our Team and Community   |   Sustainable Business Operations   |   Appendix
The International Organization 
for Standardization (ISO) is 
a framework of policies and 
procedures that includes all 
legal, physical, and technical 
controls involved in an 
organization’s information risk 
management processes.
The Federal Risk and 
Authorization Management 
Program (FedRAMP), 
established by the U.S. 
government, provides a 
standardized approach 
to security assessment, 
authorization, and continuous 
monitoring for cloud products 
and services. FedRAMP uses 
NIST Special Publication 
800-53 as its library of 
system controls.
CSA STAR Self-Assessment 
is a complimentary offering 
that documents the security 
controls provided by Qualys 
solutions, thereby helping 
users assess the security 
of Qualys cloud computing 
solutions they currently use or 
are considering using.
The Payment Card Industry 
(PCI) Security Standards 
Council (SSC) maintains a 
structured process for security 
solution providers to become 
an Approved Scanning 
Vendor that meets PCI SSC 
requirements to perform PCI 
data security scanning.
Qualys has achieved 
certifications to the 
following ISO standards: 
ISO/IEC 27001:2013, 
ISO/IEC 27017: 2015, and 
ISO/IEC 27018:2019.
Qualys has completed the 
FedRAMP Authorization to 
Operate (ATO) process and 
maintains FedRAMP Moderate 
ATO. We are currently 
pursuing FedRAMP High 
ATO with the Joint 
Authorization Board.
Qualys has completed 
Level 1: Self-Assessment. 
STAR Self-Assessments 
are updated annually.
Qualys has been certified as a 
PCI SSC-Approved Scanning 
Vendor. Our PCI security 
solution meets the external 
scanning requirements of 
PCI DSS Requirement 11.2.2.
At Qualys, we believe a vigilant and well-trained workforce 
is fundamental to keeping our organization and our 
customers secure. Employees receive annual training 
and information regarding our security policies and 
procedures, and we conduct ongoing security exercises, 
including phishing simulations, red teaming, and third-
party penetration testing to maintain vigilance of key 
cybersecurity controls.

The Qualys Cybersecurity Fusion Center, staffed by 
experts in the field, monitors potential cybersecurity 
threats to our business and those of our customers on 
a 24/7 basis. We regularly conduct internal penetration 
tests of our cybersecurity systems and annually contract 
with a qualified third party to perform an independent 
penetration test of the Qualys Cloud Platforms. Qualys 
security teams continuously scan IT infrastructure for 
vulnerabilities and compliance with configuration best 
practices and apply remediations as appropriate, with 
priority based on those issues that represent the highest 
risk to the organization.
Figure 6: Data Security Certifications and Attestations as of December 31, 2022

Introduction   |   Governance and Responsible Business Practices   |   Our Customer Commitment   |            Supporting Our Team and Community   |   Sustainable Business Operations   |   Appendix
15  |  Qualys 2022 Environmental, Social, and Governance Report
Supporting Our Team 
and Community
At Qualys, we believe that doing right by our employees and communities 
maintains the trust of our customers, partners, employees, and investors, 
and doing so meets the diverse needs of our clients. 
Introduction   |   Governance and Responsible Business Practices   |   Our Customer Commitment   |            Supporting Our Team and Community   |   Sustainable Business Operations   |   Appendix
15  |  Qualys 2022 Environmental, Social, and Governance Report

Introduction   |   Governance and Responsible Business Practices   |   Our Customer Commitment   |            Supporting Our Team and Community   |   Sustainable Business Operations   |   Appendix
16  |  Qualys 2022 Environmental, Social, and Governance Report
We take a holistic approach to human capital 
management, investing in our company 
culture, employee learning and development, 
and the recruitment and training of the next 
generation of Qualys leaders. 
Diversity, Equity, and Inclusion 
We are committed to fostering a culture of diversity, 
equity, and inclusion, and we believe we are a leader in 
the promotion and practice of diversity and inclusion. Our 
objective is to continue to improve our hiring, development, 
advancement, and retention of diverse talent and to foster 
an inclusive workplace. In addition to having more than 50% 
of the executive team from underrepresented communities, 
we are also continuing to improve diversity among our 
growing workforce, with steady increases in recent years 
in the percentage of women employed among our global 
workforce and with over half of our US-based employees 
from underrepresented communities. We lead by our 
actions and not by our words.

We strive to provide an environment that promotes equal 
opportunity and prohibits discriminatory practices against race, 
religion, color, national origin, age, gender, sexual orientation, 
or any other protected characteristics. Our employees 
and managers are required to complete training aimed at 
maintaining a harassment-free, diverse, and secure workplace.
Qualys is focused on building a pipeline of diverse 
candidates across all our job functions. We define diversity 
as underrepresented job seekers, like women, minorities, 
people with disabilities, older workers, and LGBTQIA 
audiences. In the U.S., we use a partner aligned with the 
diversity recruitment and federal contract compliance 
program (OFCCP) to ensure that our jobs reach a diverse 
audience. We are a longstanding member and supporter 
of the Executive Women’s Forum, which focuses on 
advancing all women in the information security, IT risk 
management, and privacy industries. In India, our focus 
in 2022 and beyond has been sponsoring women from 
socioeconomically disadvantaged backgrounds as they 
pursue bachelor’s degrees. Our goal is to build a pipeline of 
female managers across the industry.

As of December 31, 2022, we had 2,143 full-time employees, 
including 1,062 in research and development, 376 in sales 
and marketing, 478 in operations and customer support, 
and 227 in general and administrative. As of December 31, 
2022, approximately 75% of our employees were located 
outside of the United States, with 66% of our employees 
located in Pune, India.
We have offices and employees all over the world, and we 
take pride in our cultural diversity. Our company holiday 
calendar includes events and festivals from all regions 
and religions, and we include diverse cultural initiatives 
throughout the year to ensure that employees feel 
represented. In the United States, Qualys has an affirmative 
action plan (AAP) that outlines company efforts to advance 
equal opportunity and workforce diversity.
Diversity is our strength, and we are dedicated to creating 
an inclusive and equitable workplace for all.
Supporting Our Team and Community

Introduction   |   Governance and Responsible Business Practices   |   Our Customer Commitment   |            Supporting Our Team and Community   |   Sustainable Business Operations   |   Appendix
17  |  Qualys 2022 Environmental, Social, and Governance Report
Employee Engagement, Training, 
and Development
Investing in employees is critical to our success. Qualys 
employees participate in an onboarding program to 
integrate new hires into role-specific functions and 
company culture. Qualys offers managers and employees 
various training courses as needed.
To support career growth inside and outside Qualys, we 
offer free self-paced and instructor-led certified training on 
core Qualys topics, giving employees and non-employees 
an opportunity to achieve certifications and job-related 
courses free of charge. Additionally, we provide training 
opportunities through Cloud Academy, where employees 
in roles like engineering, sales, support, and product 
management can access a library of content, to help with 
the technical skills needed to master and advance in 
their roles.

To allow for open dialogue between employees and 
managers, we conduct formal employee reviews each 
year. Corrective action plans are developed for any 
employee who may be struggling to meet his or her job 
responsibilities. Employee performance is considered 
during compensation reviews.

In addition to formal reviews, HR has quarterly meetings 
with all managers to check in with teams, and regularly 
conducts exit interviews and surveys in the U.S. and India. 
Qualys India also conducts an assimilation program for 
new employees, through which feedback is collected as 
employees join the company.

Introduction   |   Governance and Responsible Business Practices   |   Our Customer Commitment   |            Supporting Our Team and Community   |   Sustainable Business Operations   |   Appendix
18  |  Qualys 2022 Environmental, Social, and Governance Report
Benefits and Compensation
We understand that providing competitive compensation 
and benefits plays a critical role in attracting and retaining 
the best available personnel. That is why we offer robust 
compensation and benefits to our employees, including 
competitive base salaries, variable pay and equity awards, 
and generous benefits packages. To support the health and 
wellness of our workforce, Qualys offers premium health 
coverage with minimal out-of-pocket contributions for 
our employees.
Qualys maintains a Compensation and Talent Committee 
of the Board of Directors to oversee the company’s 
compensation policies, plans and benefits programs, 
and overall compensation philosophy. The Committee 
approves CEO and executive officers’ compensation plans, 
and reviews, approves, and administers various employee 
benefit plans, among other duties.

As part of its ongoing review of the performance 
criteria and compensation of designated key executives, 
the Compensation and Talent Committee also meets 
annually with the CEO, the Company’s principal human 
resources executive, and any other corporate officers as it 
deems appropriate.

Qualys aims to maintain a healthy work-life balance and 
provide resources to support our employees’ mental 
and physical well-being. Periodically, we host a company- 
wide “Take a Break Day,” offering all global employees an 
additional opportunity to take the day off without using 
any of their accrued paid leave. Our global employees and 
their families have access to the LifeBalance Employee 
Assistance Program (EAP) at no charge, offering 
counseling sessions on many topics, including mental 
health, substance abuse, grief and loss, financial or 
workplace issues, and more.

Introduction   |   Governance and Responsible Business Practices   |   Our Customer Commitment   |            Supporting Our Team and Community   |   Sustainable Business Operations   |   Appendix
19  |  Qualys 2022 Environmental, Social, and Governance Report
Our Community Engagement
We value the communities that support our operations 
and have several company and employee-led initiatives 
to support the communities in which we operate. As 
part of our strategic efforts to build a more educated 
and diverse workforce and support the management 
of climate risk, our community initiatives in 2022 were 
centered on advancing education, gender equality, and 
the environment. Please see the UN SDG section in the 
Appendix for more information about our impact.
In India, our team donated full scholarships to computer 
science and IT engineering students at the Vellore 
Institute of Technology. We also continued to support 
women in STEM through a donation to the Lila Poonawalla 
Foundation. We promoted reading in Pune schools by 
building a library and donating more than a thousand books. 
To celebrate our 10 years of operations in Pune, our team 
planted 1,000 trees in Mahalunge Hill and across the city.
In the United States, Qualys prepared and donated 
200 backpacks for a back-to-school drive so students at 
underserved schools could start the school year off with 
excitement and confidence. Throughout the year, 
we also partnered with Toys for Tots, Angel Tree, and 
other nonprofit organizations to help support our 
local communities.

Our company culture is one of generosity and empathy, 
and we are proud of our employees who volunteer 
their time and resources to make a difference in the 
communities we serve. We believe that by giving back, we 
are not only making a positive impact on the world but 
also creating a better place for our employees, customers, 
and partners to live and work.

Figure 7: Spotlight on 2022 Charitable Giving in Pune
As part of our 10 Years in Pune celebration, we 
helped to make the city greener through our 
1,000 Trees for 10 Years initiative. Our employees 
volunteered to plant trees throughout local 
neighborhoods in Pune.
We donated fully stocked libraries with more than 
1,000 books to two village schools in Pune.
We continued to sponsor bachelor’s degrees 
for women from socioeconomically disadvantaged 
backgrounds.

20  |  Qualys 2022 Environmental, Social, and Governance Report
Introduction   |   Governance and Responsible Business Practices   |   Our Customer Commitment   |   Supporting Our Team and Community   |            Sustainable Business Operations   |   Appendix
Sustainable 
Business Operations
We are deeply committed to finding ways to reduce the 
environmental impact of our operations and recognize 
that the challenge of climate change will require global 
collaboration to mitigate its impacts. We strive to do our 
part by operating within energy-efficient networks and 
data centers and by working to reduce our energy, waste, 
and materials consumption to minimize our direct 
environmental footprint.
20  |  Qualys 2022 Environmental, Social, and Governance Report
Introduction   |   Governance and Responsible Business Practices   |   Our Customer Commitment   |   Supporting Our Team and Community   |            Sustainable Business Operations   |   Appendix

21  |  Qualys 2022 Environmental, Social, and Governance Report
Introduction   |   Governance and Responsible Business Practices   |   Our Customer Commitment   |   Supporting Our Team and Community   |            Sustainable Business Operations   |   Appendix
In Pune, India, where most of our 
employees are based, we have prioritized 
our environmental initiatives and leveraged 
the learnings from these initiatives at other 
locations where possible. 

The Qualys Pune office is located in a LEED Gold-certified 
facility equipped with sophisticated building management 
tools, sustainability features, and a dedicated facilities 
team to operationalize our environmental programs.
We continue to re-evaluate our real estate portfolio 
to better reflect our business needs and reduce our 
environmental impact. As many of our employees 
have transitioned to hybrid work schedules, we plan 
to reassess our leases and manage our real estate 
footprint accordingly.

Figure 8: Sustainability Spotlight on Our Pune Office

Advanced building management system that uses IOT to 
track facility parameters (e.g., energy use, temperature, humidity)

8,620 m2 of carbon neutral flooring

Precision air conditioning deployed for 
optimum management

Detailed operational checks daily by an 
around-the-clock facilities team

Wet and dry waste measured daily with a focus 
on waste reduction and recycling

Employee transportation program

Optimizing Our Energy Use
To minimize our energy use, we employ a data-driven 
approach, using real-time data to optimize our systems. 
In Pune, we recently unracked some of our UPS modules 
(which provide backup power) to better align with our 
needs. Within the next year, we plan to install lighting and 
AC sensors in more than 100 rooms in the Pune office, 
allowing the building management system to dynamically 
adapt to changes in occupancy.
As of Q1 2023, we have 11 multi-tenant platforms across the 
world, six of which are in collocated facilities. The others 
are hosted in public cloud environments. Though data 
centers are inherently energy-intensive, utilizing collocated 
facilities allows us to leverage economies of scale for power 
and cooling. In addition, most of our third-party providers 
continue to advance their own sustainability programs to 
reduce their environmental impact.

Figure 9: Environmental Initiatives at Select Data Centers
Location
Type
Environmental Measures
Santa Clara, 
United States
Collocated
Energy Star Certified, wireless sensor 
technology, smart lighting
Barrie, 
Canada
Collocated
Free cooling optimization through hot 
aisle containment or passive exhaust 
chimneys
Pune, India
Collocated
Planned rooftop solar panel installation
Amsterdam, 
Netherlands
Collocated 1
ISO 50001:2018 (energy management), 
ISO 14001:2015 (environmental 
management), LEED Gold, rooftop solar 
arrays, LED lighting, Aquifer Thermal 
Energy Storage (ATES) system
1 Note that our operations at the Amsterdam facility were transitioned to the cloud before the 
end of FY 2022.
Sustainable Business Operations

22  |  Qualys 2022 Environmental, Social, and Governance Report
Introduction   |   Governance and Responsible Business Practices   |   Our Customer Commitment   |   Supporting Our Team and Community   |            Sustainable Business Operations   |   Appendix
Assessing Our Carbon Footprint
In 2022, we engaged an external consultancy to complete 
a greenhouse gas (GHG) assessment for fiscal years 2020 
and 2021. This review was conducted in alignment with the 
WRI/WBCSD GHG Protocol Corporate Accounting and 
Reporting Standard and Scope 2 Standard, and included 
global Scope 1 and Scope 2 GHG emissions within our 
operational control, as defined below:
Scope 1: Direct emissions from owned/controlled 
operations
Scope 2: Indirect emissions from the use of purchased 
electricity, steam, heating, and cooling

This assessment accounts for emissions associated 
with heating, purchased electricity, generator use, and 
available refrigeration/fire suppression information in 
our seven office locations. We also included electricity 
emissions within our operational control in the four and 
five collocated data centers used by Qualys in FYs 2020 
and 2021, respectively. No mobile Scope 1 emission sources 
were detected for Qualys in 2020 or 2021.
2
2 Emissions from our employee commuting programs (outlined on page 23) 
have been determined to fall under Scope 3 and therefore have not been 
included in our assessment of Scope 1 and Scope 2 emissions.
Figure 10: Scope 1 and Scope 2 GHG Emissions for FYs 2020 and 2021

Global Emissions (in MTCO2e3)
Emissions Category
FY 2020
FY 2021
Scope 1 Emissions
1,778
1,779
Location-Based4 Scope 2 Emissions
3,140
4,931
Market-Based5 Scope 2 Emissions
2,960
4,692
Total Scope 1 and Location-Based 
Scope 2 Emissions
4,919
6,710
Total Scope 1 and Market-Based 
Scope 2 Emissions
4,738
6,471
3 Metric Tons of Carbon Dioxide equivalent. Total emissions numbers may not sum due 
to rounding.
4 Location-based emissions are those estimated based on local grid power sources.
5 Market-based emissions are those estimated after factoring in power purchase agreements 
and renewable energy certificates.
Figure 11: GHG Intensity Metrics for FYs 2020 and 2021
Intensity Factor
FY 2020
FY 2021
Unit
Scope 1 and Scope 2 Emission 
Intensity per Square Foot 
(Location Based)
12.70
17.32
t CO2e/ 
1,000 sq ft
Scope 1 and Scope 2 Emission 
Intensity per Revenue 
(Location Based)
11.96
18.49
t CO2e/ 
million USD
Between 2020 and 2021, we saw an increase in GHG 
emissions, due primarily to an increase in the number of data 
centers utilized by Qualys and an increase in office electricity 
use, presumably due to shifting working environments.
Electricity consumption was responsible for 73% of 
location-based Scope 1 and Scope 2 emissions across 
facilities in 2021, much of which can be attributed to our 
data centers. Moving forward, we aim to further explore 
how our data centers utilize renewable energy and verify 
the use of renewable energy certificates (RECs), power 
purchase agreements (PPAs), and equivalents. 
We intend to update this GHG assessment annually to 
monitor our footprint and identify reduction opportunities.

23  |  Qualys 2022 Environmental, Social, and Governance Report
Introduction   |   Governance and Responsible Business Practices   |   Our Customer Commitment   |   Supporting Our Team and Community   |            Sustainable Business Operations   |   Appendix
Employee Commuting Programs
Many of our employees have a hybrid work schedule, 
reducing the need to report to physical workplaces. 
For those who do work in a Qualys office, we provide 
transportation options to reduce emissions and traffic from 
individual commuting.
In our Pune office, we offer an employee transportation 
program through a third party to provide safe and 
reliable transport to and from work. Shared staff 
transportation reduces the need for employees to drive 
single-occupancy vehicles, and we continue to optimize 
the routes to increase fuel efficiency. All vehicles used 
for this program are required to have valid pollution and 
fitness certificates, ensuring that they meet standards for 
emissions and safety.
Reducing Our Waste
Qualys recognizes waste reduction is good for both the 
planet and our business, and we have implemented several 
waste management programs. We utilize recycling at our 
Pune, Foster City, Raleigh, and Reading offices.
We periodically require the disposal of electronic waste 
(e-waste), such as computer hardware and light bulbs. 
Whenever this service is needed, we strive to use 
environmentally conscious recycling vendors. In May 2020, 
we recycled 710 kg (~1,565 lb.) of e-waste from our Pune 
office through a partner who holds ISO 14001 and OHSAS 
18001 certifications. As hardware approaches its end-of-life 
phase, we explore different ways to reduce waste, and in 
2022 we were able to repurpose some of the equipment as 
an alternative to recycling.
Minimizing Our Customers’ 
Environmental Impact 
The products Qualys brings to market can enable 
improved environmental sustainability for our customers. 
Our cloud-based solutions help to minimize the number 
of physical servers our customers must deploy within their 
own environments, reducing their energy consumption. In 
addition, Qualys Cloud applications deliver content and 
dashboards that are visible on any device, thus lowering 
paper and printing costs for our customers.

24  |  Qualys 2022 Environmental, Social, and Governance Report
Introduction   |   Governance and Responsible Business Practices   |   Our Customer Commitment   |   Supporting Our Team and Community   |   Sustainable Business Operations   |            Appendix
Appendix
24  |  Qualys 2022 Environmental, Social, and Governance Report
Introduction   |   Governance and Responsible Business Practices   |   Our Customer Commitment   |   Supporting Our Team and Community   |   Sustainable Business Operations   |            Appendix

25  |  Qualys 2022 Environmental, Social, and Governance Report
Introduction   |   Governance and Responsible Business Practices   |   Our Customer Commitment   |   Supporting Our Team and Community   |   Sustainable Business Operations   |            Appendix
United Nations Sustainable Development Goals
The United Nations Sustainable Development Goals (SDGs) are a collaborative, global effort to achieve a better and more 
sustainable future for all. Qualys supports all 17 Global Goals and has identified six focus areas where we have the greatest 
impact through our business strategy, products, and services.
RESPONSIBLE
CONSUMPTION
AND PRODUCTION
12
CLIMATE
ACTION
13
QUALITY
EDUCATION
4
GENDER
EQUALITY
5
DECENT WORK AND 
ECONOMIC GROWTH
8
INDUSTRY, INNOVATION 
AND INFRASTRUCTURE
9
DESCRIPTION
APPLICABLE 
TARGETS
QUALYS 
ALIGNMENT
RELEVANT 
REPORT SECTION
Ensure inclusive and 
equitable quality education 
and promote lifelong learning 
opportunities for all	

Achieve gender equality 
and empower all women 
and girls	
Promote sustained, inclusive 
and sustainable economic 
growth, full and productive 
employment and decent 
work for all	
Build resilient infrastructure, 
promote inclusive and 
sustainable industrialization 
and foster innovation	
Ensure sustainable 
consumption and 
production patterns
Take urgent action to 
combat climate change 
and its impacts	
4.1
5.5	
8.2        8.5
9.1	
12.2       12.5
13.2       13.3
Our corporate philanthropy 
includes a specific focus on 
promoting children’s education 
through the donation of 
supplies, libraries, technology, 
and other resources. 	
We participate in strategic 
recruitment for diversity, 
including engineering graduates 
from women’s universities in 
India. Through a partner, we 
circulate our job postings to 
diversity hubs. We are also a 
longtime member and sponsor of 
the Executive Women’s Forum.	
We employ more than 2,000 
employees worldwide and 
provide competitive benefits and 
compensation packages.	
Qualys’ software allows 
organizations to protect their 
systems and applications from 
cyber-attacks by identifying 
and remediating vulnerabilities 
in their IT systems and web 
applications. 	
We strive to do our part by 
operating within energy-efficient 
networks and data centers 
and by working to reduce our 
energy, waste, and materials 
consumption to protect the 
planet for future generations.
We baselined our Scope 1 and 
Scope 2 GHG emissions for 
FY 2020 and 2021 and plan to 
continue to monitor and improve 
our environmental metrics and 
climate risk management. 	
Supporting Our Team
and Community
Supporting Our Team
and Community
Supporting Our Team
and Community
Our Customer Commitment 
Sustainable Business Operations
Sustainable Business Operations

26  |  Qualys 2022 Environmental, Social, and Governance Report
Introduction   |   Governance and Responsible Business Practices   |   Our Customer Commitment   |   Supporting Our Team and Community   |   Sustainable Business Operations   |            Appendix
SASB Standards
The following table details the SASB Standards, part of the IFRS Foundation, related to Software and IT Services 
and references the sections within this report or other public documents where the SASB disclosure topic or a 
related topic is discussed.
Legal Notice Regarding Forward-
Looking Statements
This ESG report contains forward-looking statements 
within the meaning of Section 27A of the Securities Act 
of 1933 and Section 21E of the Securities Exchange Act of 
1934. Forward-looking statements generally relate to future 
events or our future financial or operating performance 
and include, but are not limited to, plans, objectives, 
expectations and intentions, and other statements 
contained in this report that are not historical facts 
and statements identified by words such as “expects,” 
“plans,” “believes,” “seeks,” “estimates,” or words of 
similar meaning. Our expectations and beliefs regarding 
these matters may not materialize, and actual results in 
future periods are subject to risks and uncertainties that 
could cause actual results to differ materially from those 
projected. These risks include those more fully described in 
our filings with the Securities and Exchange Commission, 
including our Annual Report on Form 10-K and Quarterly 
Reports on Form 10-Q. The forward-looking statements 
in this ESG report are based on information available to 
Qualys as of the date hereof, and Qualys disclaims any 
obligation to update any forward-looking statements, 
except as required by law.
Topic
Relevant Report Section(s)
Environmental Footprint of Hardware Infrastructure
Optimizing Our Energy Use
Data Privacy & Freedom of Expression
Customer Privacy
Please also see our latest annual report on Form 10-K for discussion of 
any material legal proceedings, including incidents concerning data privacy.
Data Security
Cybersecurity
Please also see our latest annual report on Form 10-K for discussion of 
any material legal proceedings, including incidents concerning cybersecurity.
Recruiting & Managing a Global, Diverse, 
& Skilled Workforce
Diversity, Equity, and Inclusion
Employee Engagement, Training, and Development
Intellectual Property Protection & Competitive Behavior
Please also see our latest annual report on Form 10-K for discussion of any 
material legal proceedings, including incidents concerning anti-competitive behavior.
Managing Systemic Risks from Technology Disruptions
Enterprise Risk Management and Business Continuity
Please also refer to our latest annual report on Form 10-K for more information 
on our key business continuity risks.

© 2023 Qualys