Qualys

QualysGuard launched in 2000, and the decision that made it distinctive was not what it scanned but how it arrived. Competitors sold software you installed. Qualys sold a subscription to a service, at a time when software as a service barely existed as a phrase - and the argument for it was specific rather than fashionable: **vulnerability data ages badly.** A scanner is only as good as its knowledge of what to look for, and installed software is exactly as current as its last update, which in most organisations is not very. A service updated centrally is current for everyone at once.

**That is the same argument this timeline shows repeatedly, arriving for a fifth time.** IronPort made it about email sender reputation in 2002, Zscaler about web traffic in 2007, Cloudflare about the web in 2009, CrowdStrike about endpoint behaviour in 2013. Qualys made it about vulnerability knowledge in 2000, which makes it the earliest instance on this page. The idea that a centrally operated platform beats locally installed software because it is never stale was worked out in this segment first.

**And it completes a trio here on a different axis.** Tenable, Rapid7 and Qualys compete in the same market and the other two entries contrast them on open source - one closed a project to fund itself, one bought a project and kept it open. Qualys differs on something else entirely: **it never shipped software to be run by the customer at all.** Three companies, three strategies, three answers to what a security vendor actually sells.

**Philippe Courtot's career before Qualys is worth its own paragraph.** In 1988 he founded cc:Mail, took it to roughly forty per cent of the email platform market, and sold it to Lotus in 1991. In 1993 he became chief executive of Verity, taking it public in 1995. He then led Signio through its acquisition by VeriSign. Qualys was his fifth chief executive role, and he ran it for two decades.

He also spent that time on work with no commercial return attached: helping found the Cloud Security Alliance in 2008, starting the Trustworthy Internet Movement and the CSO Interchange, and serving as a trustee of the Internet Society. He stepped down in March 2021 for health reasons and died on 5 June that year, aged 76.

The company went public in 2012 and reported revenue of $669M for 2025 with around 2,625 staff. The product argument has moved where every vendor in this segment moved, from finding everything to ranking what matters, because the constraint stopped being detection a long time ago and became the fact that nobody can patch it all.