Document

Unless otherwise defined herein, the terms defined in the Qualys, Inc. 2012 Equity Incentive Plan (the “Plan”) will have the same defined meanings in this Stock Option Agreement, including the Notice of Stock Option Grant (the “Notice of Grant”), the Terms and Conditions of Stock Option Grant, attached hereto as Exhibit A, and the Appendix, attached hereto as Exhibit B (all together, the “Agreement”).

Termination Period: This Option will be exercisable for three (3) months after Participant ceases to be a Service Provider, unless such termination is due to Participant’s death or Disability, in which case this Option will be exercisable for twelve (12) months after Participant ceases to be a Service Provider. Notwithstanding the foregoing sentence, in no event may this Option be exercised after the Term/Expiration Date as provided above (or in Exhibit B if a special Term/Expiration Date is required for Participant’s country) and may be subject to earlier termination as provided in Section 13(c) of the Plan.

By Participant’s signature and the signature of the Company’s representative below, Participant and the Company agree that this Option is granted under and governed by the terms and conditions of the Plan and this Agreement, all of which are made a part of this document. Participant has reviewed the Plan and this Agreement in their entirety, has had an opportunity to obtain the advice of counsel prior to executing this Agreement and fully understands all provisions of the Plan and Agreement. Participant hereby agrees to accept as binding, conclusive and final all decisions or interpretations of the Administrator upon any questions relating to the Plan and Agreement. Participant further agrees to notify the Company upon any change in the residence address indicated below.

1.Grant of Option. The Company hereby grants to the Participant named in the Notice of Grant (the “Participant”) an option (the “Option”) to purchase the number of Shares, as set forth in the Notice of Grant, at the exercise price per Share set forth in the Notice of Grant (the “Exercise Price”), subject to all of the terms and conditions in this Agreement and the Plan, which is incorporated herein by reference. Subject to Section 18(c) of the Plan, in the event of a conflict between the terms and conditions of the Plan and the terms and conditions of this Agreement, the terms and conditions of the Plan will prevail. For U.S. taxpayers, the Option will be designated as either an Incentive Stock Option (“ISO”) or a Nonstatutory Stock Option (“NSO”). If designated in the Notice of Grant as an ISO, this Option is intended to qualify as an ISO under Section 422 of the Internal Revenue Code of 1986, as amended (the “Code”). However, if this Option is intended to be an Incentive Stock Option, to the extent that it exceeds the $100,000 rule of Code Section 422(d) it will be treated as an NSO. Further, if for any reason this Option (or portion thereof) will not qualify as an ISO, then, to the extent of such nonqualification, such Option (or portion thereof) shall be regarded as a NSO granted under the Plan. In no event will the Administrator, the Company or any Parent or Subsidiary or any of their respective employees or directors have any liability to Participant (or any other person) due to the failure of the Option to qualify for any reason as an ISO.

2.Vesting Schedule. Except as provided in Section 3, the Option awarded by this Agreement will vest in accordance with the vesting provisions set forth in the Notice of Grant. Shares scheduled to vest on a certain date or upon the occurrence of a certain condition will not vest in Participant in accordance with any of the provisions of this Agreement, unless Participant will have been continuously a Service Provider from the Date of Grant until the date such vesting occurs.

(b)Method of Exercise. This Option is exercisable by delivery of an exercise notice, in the form attached as Exhibit C (the “Exercise Notice”) or in a manner and pursuant to such procedures as the Administrator may determine, which will state the election to exercise the Option, the number of Shares in respect of which the Option is being exercised (the “Exercised Shares”), and such other representations and agreements

as may be required by the Company pursuant to the provisions of the Plan. The Exercise Notice will be completed by Participant and delivered to the Company. The Exercise Notice will be accompanied by payment of the aggregate Exercise Price as to all Exercised Shares together and of any Tax-Related Items (as defined in Section 6(a)). This Option will be deemed to be exercised upon receipt by the Company of such fully executed Exercise Notice accompanied by the aggregate Exercise Price.

(a)Withholding of Taxes. Notwithstanding any contrary provision of this Agreement, no certificate representing the Shares will be issued to Participant, unless and until satisfactory arrangements (as determined by the Administrator) will have been made by Participant with respect to the payment of income, employment, social insurance, payroll tax, fringe benefit tax, payment on account or other tax-related items related to Participant’s participation in the Plan and legally applicable to Participant (“Tax-Related Items”) which the Company determines must be withheld with respect to such Shares. If Participant is a non-U.S. employee, payment of Tax-Related Items may not be effectuated by surrender of other Shares with a Fair Market Value equal to the amount of any Tax-Related Items. To the extent determined appropriate by the Company in its discretion, it will have the right (but not the obligation) to satisfy any Tax-Related Items by reducing the number of Shares otherwise deliverable to Participant. If Participant fails to make satisfactory arrangements for the payment of any required Tax-Related Items hereunder at the time of the Option exercise, Participant acknowledges and agrees that the Company may refuse to honor the exercise and refuse to deliver the Shares if such amounts are not delivered at the time of exercise. Further, if Participant is subject to tax in more than one jurisdiction between the Date of Grant and the date of any relevant taxable or tax withholding event, as applicable, Participant acknowledges and agrees that the Company and/or Participant’s employer (the “Employer”), or former employer, as applicable, may be required to withhold or account for tax in more than one jurisdiction.

(b)Notice of Disqualifying Disposition of ISO Shares. If the Option granted to Participant herein is an ISO, and if Participant sells or otherwise disposes of any of the Shares acquired pursuant to the ISO on or before the later of (i) the date two (2) years after the Date of Grant, or (ii) the date one (1) year after the date of exercise, Participant will immediately notify the Company in writing of such disposition. Participant agrees that Participant may be subject to income tax withholding by the Company on the compensation income recognized by Participant.

(c)Code Section 409A. Under Code Section 409A, an option that vests after December 31, 2004 (or that vested on or prior to such date but which was materially modified after October 3, 2004) that was granted with a per share exercise price that is determined by the Internal Revenue Service (the “IRS”) to be less than the fair market value of a share on the date of grant (a “Discount Option”) may be considered “deferred compensation.” A Discount Option may result in (i) income recognition by Participant prior to the exercise of the option, (ii) an additional twenty percent (20%) federal income tax, and (iii) potential penalty and interest charges. The Discount Option may also result in additional state income, penalty and interest charges to Participant. Participant acknowledges that the Company cannot and has not guaranteed that the IRS will agree that the per Share Exercise Price of this Option equals or exceeds the Fair Market Value of a Share on the Date of Grant in a later examination. Participant agrees that if the IRS determines that the Option was granted with a per Share Exercise Price that was less than the Fair Market Value of a Share on the Date of Grant, Participant will be solely responsible for Participant’s costs related to such a determination.

7.Rights as Stockholder. Neither Participant nor any person claiming under or through Participant will have any of the rights or privileges of a stockholder of the Company in respect of any Shares deliverable hereunder unless and until certificates representing such Shares will have been issued, recorded on the records of the Company or its transfer agents or registrars, and delivered to Participant. After such issuance, recordation and delivery, Participant will have all the rights of a stockholder of the Company with respect to voting such Shares and receipt of dividends and distributions on such Shares.

8.No Guarantee of Continued Service. PARTICIPANT ACKNOWLEDGES AND AGREES THAT THE VESTING OF SHARES PURSUANT TO THE VESTING SCHEDULE HEREOF IS EARNED ONLY BY CONTINUING AS A SERVICE PROVIDER AT THE WILL OF THE COMPANY (OR THE PARENT OR SUBSIDIARY EMPLOYING OR RETAINING PARTICIPANT) AND NOT THROUGH THE ACT OF BEING HIRED, BEING GRANTED THIS OPTION OR ACQUIRING SHARES HEREUNDER. PARTICIPANT FURTHER ACKNOWLEDGES AND AGREES THAT THIS AGREEMENT, THE TRANSACTIONS CONTEMPLATED HEREUNDER AND THE VESTING SCHEDULE SET FORTH HEREIN DO NOT CONSTITUTE AN EXPRESS OR IMPLIED PROMISE OF CONTINUED ENGAGEMENT AS A SERVICE PROVIDER FOR THE VESTING PERIOD, FOR ANY PERIOD, OR AT ALL, AND WILL NOT INTERFERE IN ANY WAY WITH PARTICIPANT’S RIGHT OR THE RIGHT

providing services to the Company or any Parent or Subsidiary (regardless of the reason for such termination and whether or not later found to be invalid or in breach of employment laws in the jurisdiction where Participant is a Service Provider or the terms of Participant’s engagement agreement, if any), and unless otherwise expressly provided in this Agreement or determined by the Administrator, (i) Participant’s right to vest in the Option under the Plan, if any, will terminate as of such date and will not be extended by any notice period (e.g., Participant’s period of service would not include any contractual notice period or any period of “garden leave” or similar period mandated under employment laws in the jurisdiction where Participant is a Service Provider or Participant’s engagement agreement, if any, unless Participant is providing bona fide services during such time); and (ii) the period (if any) during which Participant may exercise the Option after such termination of Participant's engagement as a Service Provider will commence on the date Participant ceases to actively provide services and will not be extended by any notice period mandated under employment laws in the jurisdiction where Participant is employed or terms of Participant’s engagement agreement, if any; the Administrator shall have the exclusive discretion to determine when Participant is no longer actively providing services for purposes of his or her Option grant (including whether Participant may still be considered to be providing services while on a leave of absence);

(l)unless otherwise provided in the Plan or by the Company in its discretion, the Option and the benefits evidenced by this Agreement do not create any entitlement to have the Option or any such benefits transferred to, or assumed by, another company nor to be exchanged, cashed out or substituted for, in connection with any corporate transaction affecting the Shares; and

(ii)neither the Company, the Employer, nor any Parent or Subsidiary shall be liable for any foreign exchange rate fluctuation between Participant’s local currency and the United States Dollar that may affect the value of the Option or of any amounts due to Participant pursuant to the exercise of the Option or the subsequent sale of any Shares acquired upon exercise; and

(iii)no claim or entitlement to compensation or damages shall arise from forfeiture of the Option resulting from the termination of Participant’s engagement as a Service Provider (for any reason whatsoever, whether or not later found to be invalid or in breach of employment laws in the jurisdiction where Participant is a Service Provider or the terms of Participant’s

engagement agreement, if any), and in consideration of the grant of the Option to which Participant is otherwise not entitled, Participant irrevocably agrees never to institute any claim against the Company, any Parent, any Subsidiary or the Employer, waives his or her ability, if any, to bring any such claim, and releases the Company, any Subsidiary and the Employer from any such claim; if, notwithstanding the foregoing, any such claim is allowed by a court of competent jurisdiction, then, by participating in the Plan, Participant shall be deemed irrevocably to have agreed not to pursue such claim and agrees to execute any and all documents necessary to request dismissal or withdrawal of such claim.

10.No Advice Regarding Grant. The Company is not providing any tax, legal or financial advice, nor is the Company making any recommendations regarding Participant’s participation in the Plan, or Participant’s acquisition or sale of the underlying Shares. Participant is hereby advised to consult with his or her own personal tax, legal and financial advisors regarding his or her participation in the Plan before taking any action related to the Plan.

11.Data Privacy. Participant hereby explicitly and unambiguously consents to the collection, use and transfer, in electronic or other form, of Participant’s personal data as described in this Agreement and any other Option grant materials by and among, as applicable, the Employer, the Company and any Parent or Subsidiary for the exclusive purpose of implementing, administering and managing Participant’s participation in the Plan.

Participant understands that the Company and the Employer may hold certain personal information about Participant, including, but not limited to, Participant’s name, home address and telephone number, email address, date of birth, social insurance number, passport or other identification number, salary, nationality, job title, any shares of stock or directorships held in the Company, details of all Options or any other entitlement to stock awarded, canceled, exercised, vested, unvested or outstanding in Participant’s favor (“Data”), for the exclusive purpose of implementing, administering and managing the Plan.

Participant understands that Data will be transferred to a stock plan service provider as may be selected by the Company in the future, which is assisting the Company with the implementation, administration and management of the Plan. Participant understands that the recipients of the Data may be located in the United States or elsewhere, and that the recipient’s country (e.g., the United States) may have different data privacy laws and protections than Participant’s country. Participant understands that he or she may request a list with the names and addresses of any potential recipients of the Data by contacting his or her local human resources representative. Participant authorizes the Company and any other possible recipients which may assist the Company (presently or in the future) with implementing, administering and managing the Plan to receive, possess, use, retain and transfer the Data, in electronic or other form, for the sole purposes of implementing, administering and managing Participant’s participation in the Plan. Participant understands that Data will be held only as long as is necessary to implement, administer and manage Participant’s participation in the Plan.

Participant understands that he or she may, at any time, view Data, request additional information about the storage and processing of Data, require any necessary amendments to Data or refuse or withdraw the consents herein, in any case without cost, by contacting in writing his or her local human resources representative. Further, Participant understands that he or she is providing the consents herein on a purely voluntary basis. If Participant does not consent, or if Participant later seeks to revoke his or her consent, his or her engagement as a Service Provider and career with the Employer will not be affected; the only consequence of refusing or withdrawing Participant’s consent is that the Company would not be able to grant Participant Options or other equity awards or administer or maintain such awards. Therefore, Participant understands that refusing or withdrawing his or her consent may affect Participant’s ability to participate in the Plan. For more information on the consequences of Participant’s refusal to consent or withdrawal of consent, Participant understands that he or she may contact his or her local human resources representative.

15.Additional Conditions to Issuance of Stock. If at any time the Company will determine, in its discretion, that the listing, registration, qualification or rule compliance of the Shares upon any securities exchange or under any state, federal or foreign law, the tax code and related regulations or the consent or approval of any governmental regulatory authority is necessary or desirable as a condition to the purchase by, or issuance of Shares to, Participant (or his or her estate) hereunder, such purchase or issuance will not occur unless and until such listing, registration, qualification, rule compliance, consent or approval will have been completed, effected or obtained free of any conditions not acceptable to the Company. The Company will make all reasonable efforts to meet the requirements of any such state, federal or foreign law or securities exchange and to obtain any such consent or approval of any such governmental authority or securities exchange. Assuming such compliance, for income tax purposes the Exercised Shares will be considered transferred to Participant on the date the Option is exercised with respect to such Exercised Shares.

determination of whether or not any Shares subject to the Option have vested). All actions taken and all interpretations and determinations made by the Administrator in good faith will be final and binding upon Participant, the Company and all other interested persons. No member of the Administrator will be personally liable for any action, determination or interpretation made in good faith with respect to the Plan or this Agreement.

18.Electronic Delivery and Acceptance. The Company may, in its sole discretion, decide to deliver any documents related to Options awarded under the Plan or future options that may be awarded under the Plan by electronic means or request Participant’s consent to participate in the Plan by electronic means. Participant hereby consents to receive such documents by electronic delivery and agrees to participate in the Plan through any on-line or electronic system established and maintained by the Company or a third party designated by the Company.

22.Amendment, Suspension or Termination of the Plan. By accepting this Award, Participant expressly warrants that he or she has received an Option under the Plan, and has received, read and understood a description of the Plan. Participant understands that the Plan is discretionary in nature and may be amended, suspended or terminated by the Company at any time.

23.Governing Law and Venue. This Agreement will be governed by the laws of California, without giving effect to the conflict of law principles thereof. For purposes of litigating any dispute that arises under this Option or this Agreement, the parties hereby submit to and consent to the exclusive jurisdiction of the State of California, and agree that such litigation will be exclusively conducted in the courts of San Mateo County, California, or the federal courts for the United States for the Northern District of California, and no other courts, where this Option is made and/or to be performed.

24.Appendix. Notwithstanding any provisions in this Agreement, the Option grant shall be subject to any special terms and conditions set forth in any appendix to this Agreement for Participant’s country (the “Appendix”). Moreover, if Participant relocates to one of the countries included in the Appendix, the special terms and conditions for such country will apply to Participant, to the extent the Company determines that the application of such terms and conditions is necessary or advisable for legal or administrative reasons. The Appendix constitutes part of this Agreement.

herein. Modifications to this Agreement or the Plan can be made only in an express written contract executed by a duly authorized officer of the Company. Notwithstanding anything to the contrary in the Plan or this Agreement, the Company reserves the right to revise this Agreement as it deems necessary or advisable, in its sole discretion and without the consent of Participant, to comply with Code Section 409A or to otherwise avoid imposition of any additional tax or income recognition under Section 409A of the Code in connection with the Option.

27.Insider Trading Restrictions/Market Abuse Laws. Participant acknowledges that, he or she may be subject to insider trading restrictions and/or market abuse laws, which may affect Participant’s ability to acquire or sell Shares or rights to Shares (e.g., the Option) under the Plan during such times as Participant is considered to have “inside information” regarding the Company (as defined by the laws in Participant’s country). Any restrictions under these laws or regulations are separate from and in addition to any restrictions that may be imposed under any applicable Company insider trading policy. Participant is responsible for complying with any applicable restrictions and is advised to speak with his or her personal advisor on this matter.

28.Foreign Asset/Account Reporting; Exchange Control Requirements. Participant’s country may have certain foreign asset and/or foreign account reporting requirements and exchange controls which may affect Participant’s ability to acquire or hold Shares acquired under the Plan or cash received from participating in the Plan (including from any dividends paid on Shares acquired under the Plan) in a brokerage or bank account outside Participant’s country. Participant may be required to report such accounts, assets or transactions to the tax or other authorities in Participant’s country. Participant also may be required to repatriate sale proceeds or other funds received as a result of Participant’s participation in the Plan to Participant’s country through a designated bank or broker within a certain time after receipt. Participant acknowledges that he or she is responsible for complying with any applicable regulations, and that Participant is instructed to speak to his or her personal legal advisor for any details.

This Appendix to Stock Option Agreement (the “Appendix”) includes additional terms and conditions that govern the Option granted to Participant under the Plan if Participant resides and/or works in one of the countries listed below at the time of grant. Certain capitalized terms used but not defined in this Appendix have the meanings set forth in the Plan and/or the Agreement.

This Appendix may also include information regarding exchange controls and certain other issues of which Participant should be aware with respect to participation in the Plan. The information is based on the securities, exchange control, and other laws in effect in the respective countries as of January 2021. Such laws are often complex and change frequently. As a result, the Company strongly recommends that Participant not rely on the information in this Appendix as the only source of information relating to the consequences of participation in the Plan because the information may be out of date at the time Participant exercises the Option or sells Shares acquired under the Plan.

In addition, the information contained herein is general in nature and may not apply to Participant’s particular situation, and the Company is not in a position to assure Participant of a particular result. Accordingly, Participant is advised to seek appropriate professional advice as to how the relevant laws in Participant’s country may apply to Participant’s situation.

Finally, if Participant is a citizen or resident of a country other than the one in which Participant is currently working, transfers employment or residency after the Option is granted, or is considered a resident of another country for local law purposes, the notifications contained herein may not be applicable to Participant, and the Company shall, in its discretion, determine to what extent the terms and conditions contained herein shall apply.

Taxation of Option. The tax treatment of the Option will depend upon when Participant accepts it relative to the offer date. If Participant accepts the Option within 60 days from the offer date, Participant will be taxed at the time of offer. Based on the current interpretation of Belgian tax law by the Belgian Minister of Finance, if Participant accepts the option more than 60 days from the offer date, Participant will be taxed at the time of exercise. By accepting the Option, Participant acknowledges that neither the Employer, the Company nor any Parent or other Subsidiary may be held liable for damages, if any, that Participant may incur should the Minister of Finance’s interpretation not be upheld (with respect to taxation at exercise for options accepted more than 60 days following the offer date). Participant is advised to consult with his or her personal tax advisor prior to accepting the Option.

Foreign Asset/Account Reporting Information. Belgium residents are required to report any securities held (including Shares) or bank or brokerage accounts opened and maintained outside Belgium on their annual tax returns. In a separate report, Belgium residents are also required to provide the National Bank of Belgium with the account details of any such foreign accounts. This report, as well as additional information on how to complete it, can be found on the website of the National Bank of Belgium, www.nbb.be, under Kredietcentrales / Centrales des crédits caption. Participant should consult his or her personal advisor to ensure compliance with applicable reporting obligations.

Exchange Control Information. If Participant is resident or domiciled in Brazil, Participant will be required to submit annually a declaration of assets and rights held outside of Brazil to the Central Bank of Brazil if the aggregate value of such assets and rights is equal to or greater than US$100,000. Assets and rights that must be reported include Shares.

Tax on Financial Transaction (IOF). Payments to foreign countries (including the payment of the exercise price) and repatriation of funds into Brazil and the conversion between BRL and USD associated with such fund transfers may be subject to the Tax on Financial Transactions. It is Participant’s responsibility to comply with any applicable Tax on Financial Transactions arising from his or her participation in the Plan. Participant should consult with his or her personal tax advisor for additional details.

Participant’s active engagement as a Service Provider shall be considered terminated for vesting and other purposes as of the earlier of (a) the date that Participant receives notice of termination of Participant’s engagement as a Service Provider from the Company or the Employer; or (b) the date that Participant is no longer actively providing services to the Company or the Employer, regardless of any notice period or period of pay in lieu of such notice required under applicable employment law; the Administrator shall have the exclusive discretion to determine when Participant’s active provision of services is terminated for purposes of the Option (including whether Participant may still be considered actively employed while on a leave of absence).

Securities Law Information. Participant will not be permitted to sell or otherwise dispose of the Shares acquired upon exercise of the Option within Canada. Participant will be permitted to sell or dispose of such Shares only if such sale or disposal takes place outside of Canada through the facilities of the stock exchange on which the Shares are traded (i.e., the NASDAQ).

Foreign Asset/Account Reporting Information. If the total value of Participant’s foreign property exceeds C$100,000 at any time during the year, Participant must report all of his or her foreign property on Form T1135 (Foreign Income Verification Statement) by April 30 of the following year. Foreign property includes Shares acquired under the Plan as well as the Option itself. The Option must be reported--generally at a nil cost--if the C$100,000 cost threshold is exceeded because of other foreign property Participant holds. If Shares are acquired, their cost generally is the adjusted cost base (“ACB”) of the Shares. The ACB would normally equal the fair market value of the Shares at exercise, but if Participant owns other shares, this ACB may have to be averaged with the ACB of the other shares. Participant should speak with a personal tax advisor to determine the scope of foreign property that must be considered for purposes of this requirement.

Participant hereby authorizes the Company and the Company’s representatives to discuss with and obtain all relevant information from all personnel, professional or not, involved in the administration and operation of the Plan. Participant further authorizes the Company and any Subsidiary and the Plan administrators to disclose and discuss the Plan with their advisors and to record all relevant information and keep such information in Participant’s employee file.

Securities Law Information. The Shares are not and will not be registered with the Colombian registry of publicly traded securities (Registro Nacional de Valores y Emisores) and therefore the Shares may not be offered to the public in Colombia. Nothing in this Agreement should be construed as the making of a public offer of securities in Colombia.

Foreign Asset/Account Reporting Information. Foreign investments held abroad (including Shares received upon exercise of the Option or any dividends paid on such Shares) must be registered with the Central Bank (Banco de la República) if Participant’s aggregate investments (as of December 31 of the applicable calendar year) equal or exceed the equivalent of US$500,000. Further, upon the sale of any Shares that Participant has registered with the Central Bank, Participant must cancel the registration by March 31 of the following year.

account. However, because exchange control regulations change frequently and without notice, Participant should consult with his or her personal legal advisor prior to the exercise of the Option and the sale of Shares acquired at exercise to ensure compliance with current regulations. It is Participant’s responsibility to comply with any applicable Czech exchange control laws.

Exchange Control Information. Cross-border payments in excess of €12,500 must be reported monthly to the German Federal Bank (Bundesbank). Participant is responsible for the reporting obligation and should file the report ("Allgemeine Meldeportal Statistik") electronically by the fifth day of the month following the month in which the payment is made. A copy of the form report can be accessed via the Bundesbank’s website at www.bundesbank.de and is available in both German and English.

Restriction on Sale of Shares. Shares received at exercise are accepted as a personal investment. Should any portion of the Option vest within six months of the Date of Grant, Participant agrees that Participant or his or her heirs or representatives will not offer to the public or otherwise dispose of the Shares acquired at exercise prior to the six-month anniversary of the Date of Grant.

Securities Law Notice. WARNING: The contents of this document have not been reviewed by any regulatory authority in Hong Kong. Participant is advised to exercise caution in relation to the offer. If Participant is in any doubt about any of the contents of this document, he or she should obtain independent professional advice. The Options offered and any Shares acquired under the Plan do not constitute a public offering of securities under Hong Kong law and are available only to employees of the Company and any Subsidiary. The Plan, the Agreement, including this Appendix, and any other incidental communication materials distributed in connection with the Plan have not been prepared in accordance with and are not intended to constitute a “prospectus” for a public offering of securities under the applicable securities legislation in Hong Kong. The Option is intended only for the personal use of Employees of the Company and any Subsidiary and may not be distributed to any other person.

exercise (i.e., where some of the Shares subject to the Option will be sold immediately upon exercise and the proceeds of the sale will be remitted to the Company to cover the exercise price for the purchased shares and any Tax-Related Items withholding). The Company reserves the right to permit this method of payment depending on the development of local law.

Repatriation of Proceeds of Sale. Participant agrees to repatriate to India all proceeds received from the sale of Shares within ninety (90) days of receipt and any dividends paid on such Shares within one hundred and eighty (180) days of receipt. Participant must maintain the foreign inward remittance certificate (“FIRC”) received from the bank where the foreign currency is deposited in the event that the Reserve Bank of India or the Company requests proof of repatriation. It is Participant’s responsibility to comply with applicable exchange control laws in India.

Foreign Asset/Account Reporting Information. Participant is required to declare any foreign bank accounts and any foreign financial assets (including Shares held outside India) in Participant’s annual tax return. Participant is responsible for complying with this reporting obligation and is advised to confer with his or her personal tax advisor in this regard.

Notwithstanding anything to the contrary in the Agreement, Participant may pay the aggregate Exercise Price solely by consideration received by the Company under a formal cashless exercise whereby all Exercise Shares are sold immediately upon exercise (i.e. a “same-day sale”) and the sales proceeds, less the Exercise Price, any Tax-Related Items and broker’s fees or commissions, are remitted to Participant. The Company reserves the right to provide Participant with additional methods of payment in the future.

Participant understands that the Employer, the Company and any Parent or Subsidiary may hold certain personal information about Participant, including Participant’s name, home address, email address and telephone number, date of birth, social insurance number, passport or other identification number, salary, nationality, job title, any Shares or directorships that Participant holds in the Company, details of all options or any other entitlement to Shares or equivalent benefits awarded, canceled, purchased, exercised, vested, unvested or outstanding in Participant’s favor (“Data”), for the exclusive purpose of implementing, administering and managing Participant’s participation in the Plan.

Participant also understands that providing the Company with Data is necessary for the performance of the Plan and that Participant’s refusal to provide Data would make it impossible for the Company to perform its contractual obligations and may affect Participant’s ability to participate in the Plan. The Controller of personal data processing is Qualys, Inc., with its principal operating offices at 919

Participant understands that Data will not be publicized, but it may be transferred to banks, other financial institutions or brokers involved in the management and administration of the Plan. Participant further understands that the Employer, the Company and any Parent or Subsidiary will transfer Data amongst themselves as necessary for the purpose of implementation, administration and management of Participant’s participation in the Plan, and that the Company and any Parent or Subsidiary may each further transfer Data to third parties assisting the Company in the implementation, administration and management of the Plan, including any requisite transfer to a broker or another third party with whom Participant may elect to deposit any Shares acquired under the Plan. Such recipients may receive, possess, use, retain and transfer the Data in electronic or other form, for the purposes of implementing, administering and managing Participant’s participation in the Plan. Participant understands that these recipients may be located in the European Economic Area, or elsewhere, such as the United States. Should the Company exercise its discretion in suspending all necessary legal obligations connected with the management and administration of the Plan, Participant understands that the Company will delete Participant’s Data as soon as it has accomplished all of the necessary legal obligations connected with the management and administration of the Plan.

Participant understands that Data-processing related to the purposes specified above shall take place under automated or non-automated conditions, anonymously when possible, that comply with the purposes for which Data are collected and with confidentiality and security provisions as set forth by applicable laws and regulations, with specific reference to Legislative Decree no. 196/2003.

The processing activity, including communication, the transfer of Participant’s Data abroad, including outside of the European Economic Area, as herein specified and pursuant to applicable laws and regulations, does not require Participant’s consent thereto as the processing is necessary to performance of contractual obligations related to implementation, administration and management of the Plan. Participant understands that, pursuant to Section 7 of the Legislative Decree no. 196/2003, he or she has the right, without limitation to access, delete, update, ask for rectification of the Data and cease, for legitimate reason, any processing of the Data. Furthermore, Participant is aware that the Data will not be used for direct marketing purposes. In addition, the Data provided may be reviewed and questions or complaints can be addressed by contacting Participant’s local human resources department.

Participant acknowledges that he or she has read and specifically and expressly approves the following Sections of the Agreement: Section 2 (Vesting Schedule); Section 4 (Exercise of Option) (as supplemented by the provision above in this Appendix); Section 6 (Tax Obligations); Section 8 (No Guarantee of Continued Service); Section 9 (Nature of Grant); Section 20 (Language); Section 23

Foreign Asset/Account Reporting Information. If Participant is an Italian resident and, during any fiscal year, holds investments or financial assets outside of Italy (e.g., cash, Shares) which may generate income taxable in Italy, Participant is required to report such investments or assets on his or her annual tax return (on UNICO Form, RW Schedule, or on a special form if Participant is not required to file a tax return). These reporting obligations will apply to Participant if he or she is the beneficial owner of foreign financial assets, even if Participant does not directly hold investments abroad or foreign assets.

Foreign Asset Tax Information. The value of the financial assets held outside of Italy by Italian residents is subject to a foreign asset tax. Such tax is currently levied at an annual rate of 2 per thousand (0.2%). The taxable amount will be the fair market value of the financial assets (e.g., Shares acquired under the Plan) assessed at the end of the calendar year. No tax payment duties arise if the amount of the foreign assets tax calculated on all financial assets held abroad does not exceed €12.

Exchange Control Information. If Participant pays more than ¥30,000,000 for the purchase of Shares in any one transaction, Participant must file an ex post facto Payment Report with the Ministry of Finance (the “MOF”) through the Bank of Japan or the bank carrying out the transaction. The precise reporting requirements vary depending on whether the relevant payment is made through a bank in Japan. If Participant intends to acquire Shares with a value in excess of ¥100,000,000 in a single transaction, Participant must also file an ex post facto Report Concerning Acquisition of Shares with the Ministry of Finance through the Bank of Japan within 20 days of acquiring the Shares. The forms to make these reports may be acquired at the Bank of Japan.

Foreign Asset/Account Reporting Information. Participant is required to report details of any assets held outside of Japan (including Shares acquired under the Plan) as of December 31st, to the extent such assets have a total net fair market value exceeding ¥50 million. Such report will be due by March 15th each year. Participant should consult with his or her personal tax advisor to determine if the reporting obligation applies to Participant’s personal situation.

No Entitlement or Claims for Compensation/Policy Statement. In accepting the Option, Participant expressly recognizes that the Company, with offices at 919 E. Hillsdale Blvd., 4th Floor, Foster City, CA 94404, U.S.A., is solely responsible for the administration of the Plan and that participation in the Plan and acquisition of Shares does not constitute an employment relationship between Participant and the Company since Participant is participating in the Plan on a wholly commercial basis and Participant’s sole employer is Qualys Mexico (“Qualys-Mexico”), not the Company in the United States. Based on the foregoing, Participant expressly recognizes that the Plan and the benefits that Participant may derive from participation in the Plan do not establish any rights between Participant and the Employer, Qualys-Mexico, and do not form part of the employment conditions and/or benefits provided by Qualys-Mexico and any modification of the Plan or its termination shall not constitute a change or impairment of the terms and conditions of Participant’s employment.

Finally, Participant hereby declares that he or she does not reserve any action or right to bring any claim against the Company for any compensation or damages regarding any provision of the Plan or the benefits derived under the Plan, and Participant therefore grants a full and broad release to the Company and any Subsidiary, its shareholders, officers, agents or legal representatives with respect to any claim that may arise.

Aceptando este Opción de Compra de Acciones, el participante reconoce que la Compañía y sus oficinas registradas en 919 E. Hillsdale Blvd., 4th Floor, Foster City, CA 94404, U.S.A., es el único responsable de la administración del Plan y que la participación del participante en el mismo y la adquisicion de Acciones no constituye de ninguna manera una relación laboral entre el participante y la Compañía, toda vez que la participación del participante en el Plan deriva únicamente de una relación comercial con la Compañía, reconociendo expresamente que el único empleador del participante lo es Qualys Mexico (“Qualys-Mexico”), no es la Compañía en los Estados Unidos. Derivado de lo anterior, el participante expresamente reconoce que el Plan y los beneficios que pudieran derivar del mismo no establecen ningún derecho entre el participante y su empleador, Qualys-México, y no forman parte de las condiciones laborales y/o prestaciones otorgadas por Qualys-México, y expresamente el participante reconoce que cualquier modificación el Plan o la terminación del mismo de manera alguna podrá ser interpretada como una modificación de los condiciones de trabajo del participante.

Finalmente, el partícipant en este acto manifiesta que no se reserva ninguna acción o derecho para interponer una demanda o reclamación en contra de la Compañía por cualquier compensación o daño o perjuicio en relación con cualquier disposición del Plan o los beneficios derivados del Plan y, en consecuencia, otorga un amplio y total finiquito a la Compañía, sus Afiliadas, sucursales, oficinas de representación, accionistas, directores, funcionarios, agentes y representantes con respecto a cualquier demanda o reclamación que pudiera surgir.

For further information on risk factors impacting the Company’s business that may affect the value of the Shares, Participant may refer to the risk factors discussion in the Company's Annual Report on Form 10-K and Quarterly Reports on Form 10-Q, which are filed with the U.S. Securities and Exchange Commission and are available online at www.sec.gov, as well as on the Company's website at https://investor.qualys.com/. In addition, Participant may receive, free of charge, a copy of the Company's Annual Report, Quarterly Reports or any other reports, proxy statements or communications distributed to the Company's stockholders by contacting Investor Relations, 919 E. Hillsdale Boulevard, 4th Floor, Foster City, California 94404, USA

Participant acknowledges he or she is permitted to dispose or sell Shares acquired under the Plan provided the offer and resale of such shares takes place outside the Philippines through the facilities of a stock exchange on which the Shares are listed. The Shares are currently listed on the Nasdaq Global Select Market in the United States of America.

Exchange Control Information. Participant is required to file quarterly reports to the National Bank of Poland with information on transactions and balances regarding Participant’s rights to Shares (such as Options) and Shares if the total value (calculated individually or together with other assets and liabilities possessed abroad) exceeds PLN 7 million. Participant is also required to transfer funds through a bank account in Poland if the transferred amount in any single transaction exceeds a specified threshold (currently €15,000). Participant is required to retain documents connected with foreign exchange transactions for a period of five years from the date the exchange transaction was made.

Securities Law Information. Participant acknowledges that the Option, the Notice of Grant, the Agreement, the Plan and all other materials that Participant may receive regarding participation in the Plan do not constitute advertising or an offering of securities in Russia. The Shares acquired pursuant to the Plan have not and will not be registered in Russia and therefore, neither the Option nor the Shares may be used for offering or public circulation in Russia. Participant acknowledges that he or she may hold Shares acquired upon exercise of the Option in an account with the Company’s third party broker/administrator in the U.S. However, in no event will Shares issued to Participant under the Plan be delivered to Participant in Russia. Further, Participant is not permitted to sell Shares directly to other Russian individuals.

Foreign Asset/Account Reporting Information. Under current exchange control regulations in Russia, Participant is required to repatriate certain cash amounts he or she receives with respect to the Options, including any dividends and proceeds from the sale of Shares that may be issued to Participant pursuant to the Shares, from his or her U.S. brokerage account to Russia as soon as Participant intends to use those cash amounts for any purpose, including reinvestment. Unless an exception exists, such funds must initially be credited to Participant through a foreign currency account at an authorized bank in Russia. After the funds are initially received in Russia, they may be further remitted to foreign banks in accordance with Russian exchange control laws.

Participant is required to report the opening, closing or change of details of any foreign bank account to Russian tax authorities within one month of opening, closing or change of details of such account. Participant also is required to report (i) the beginning and ending balances in such a foreign bank account each year and (ii) transactions related to such a foreign account during the year to the Russian tax authorities, on or before June 1 of the following year. The tax authorities can require Participant to provide appropriate supporting documents related to transactions in a foreign bank account.

Anti-Corruption Notification. Anti-corruption laws prohibit certain public servants, their spouses and their dependent children from owning any foreign source financial instruments (e.g., Shares of foreign companies such as the Company). Accordingly, Participant should inform the Company if he or she is covered by these laws because Participant should not hold Shares acquired under the Plan.

“Qualifying Person” exemption” under section 273(1)(f) of the Securities and Futures Act (Chapter 289, 2006 Ed.) (“SFA”). The Plan has not been lodged or registered as a prospectus with the Monetary Authority of Singapore. Participant should note that the Option is subject to section 257 of the SFA and that Participant will not be able to make (i) any subsequent sale of the Shares in Singapore or (ii) any offer of such subsequent sale of the Shares subject to the Option in Singapore, unless such sale or offer is made (i) after six months from the Date of Grant or (ii) pursuant to the exemptions under Part XIII Division (1) Subdivision (4) (other than section 280) of the SFA (Chapter 289, 2006 Ed.).

Chief Executive Officer and Director Notification Obligation. If Participant is a chief executive officer, director, associate director or shadow director of a Subsidiary in Singapore, he or she subject to certain notification requirements under the Singapore Companies Act. Among these requirements is an obligation to notify the Singaporean corporation in writing when Participant receives an interest (e.g., an Option, Shares) in the Company or any related companies. In addition, Participant must notify the Singapore employer when Participant sells Shares or shares of any related company (including when Participant sell Shares acquired under the Plan). These notifications must be made within two business days of acquiring or disposing of any interest in the Company or any related company. In addition, a notification must be made of Participant’s interests in the Company or any related company within two business days of becoming a chief executive officer or director.

By accepting the grant of the Option, Participant agrees to notify or the Employer of the amount of any gain realized upon the exercise of the Option. Participant understands that if he or she fails to advise the Employer of the gain realized at exercise, Participant may be liable for a fine. Participant will be responsible for paying the difference between the actual tax liability and the amount withheld.

Exchange Control Information. Under current South African exchange control policy, Participant understands that if he or she is a South African resident, Participant may invest a maximum of ZAR11,000,000 per annum in offshore investments, including in Shares. This limit does not apply to non-resident employees. The first ZAR1,000,000 annual discretionary allowance requires no prior authorization but Participant understand that he or she must obtain tax clearance for the next ZAR10,000,000. It is Participant’s responsibility to ensure that he or she does not exceed this limit and obtains the necessary tax clearance for remittances exceeding ZAR1,000,000. This limit is a cumulative allowance; therefore, Participant’s ability to remit funds for the exercise of Options will be reduced if Participant’s foreign investment limit is utilized to make a transfer of funds offshore that is unrelated to the Plan. Participant acknowledges that if the ZAR11,000,000 limit will be exceeded as a result of a purchase under the Plan, Participant may still participate in the Plan; however, Participant will be required to immediately sell the Shares purchased on his or her behalf under the Plan and repatriate the proceeds to South Africa in order to ensure that Participant does not hold assets outside South Africa with a value in excess of the permitted offshore investment allowance amount.

Participant understands that the Company has unilaterally, gratuitously and discretionally decided to grant stock options under the Plan to individuals who may be employees of the Company or its Subsidiaries throughout the world. This decision is a limited decision that is entered into upon the express assumption and condition that any grant will not bind the Company or any of its Subsidiaries over and above the specific terms of the Plan. Consequently, Participant understands that the Option is granted on the assumption and condition that the Option and any Shares acquired upon exercise of the Option are not a part of any employment contract (either with the Company or any Subsidiary of the Company) and shall not be considered a mandatory benefit, salary for any purposes (including severance compensation) or any other right whatsoever.

Further, Participant understands and agrees that, unless otherwise expressly provided for by the Company or set forth in the Agreement, the Option will be cancelled without entitlement to any Shares if Participant ceases to be a Service Provider for any reason, including, but not limited to: resignation, disciplinary dismissal adjudged to be with cause, disciplinary dismissal adjudged or recognized to be without good cause (i.e., subject to a “despido improcedente”), material modification of the terms of employment under Article 41 of the Workers’ Statute, relocation under Article 40 of the Workers’ Statute, Article 50 of the Workers’ Statute, or under Article 10.3 of Royal Decree 1382/1985. The Administrator shall have the exclusive discretion to determine the date when Participant’s status as a Service Provider has terminated for purposes of the Option.

In addition, Participant understands that this grant would not be made to Participant but for the assumptions and conditions referred to above; thus, Participant acknowledges and freely accepts that should any or all of the assumptions be mistaken or should any of the conditions not be met for any reason, then any grant of, or right to, the Option shall be null and void.

Securities Law Information. No “offer of securities to the public,” as defined under Spanish law, has taken place or will take place in the Spanish territory in connection with the Option. The Agreement has not been, nor will it be, registered with the Comisión Nacional del Mercado de Valores, and does not constitute a public offering prospectus.

Exchange Control Information. Spanish residents who acquire Shares under the Plan must declare such acquisition to the Spanish Dirección General de Comercio e Inversiones (the “DGCI”), for statistical purposes. Because Participant will not purchase or sell the shares through the use of a Spanish financial institution, Participant must make the declaration himself or herself by filing a D-6 form with the DGCI. Generally, the D-6 form must be filed each January while the shares are owned.

When receiving foreign currency payments derived from the ownership of shares (i.e., cash dividends or sale proceeds) exceeding €50,000, Participant must inform the financial institution receiving the payment of the basis upon which such payment is made. Participant will need to provide the financial institution with the following information: (i) the Participant’s name, address and fiscal identification number; (ii) the name and corporate domicile of the Company; (iii) the amount of the payment; (iv) the currency used; (v) the country of origin; (vi) the reasons for the payment; and (vii) additional information that may be required. In addition, if Participant wishes to import the ownership title of any shares (i.e., share certificates) into Spain, he or she must declare the import of such securities to the DGCI.

Foreign Asset/Account Reporting Information. Spanish residents holding rights or assets (e.g., Shares, cash, etc.) in a bank or brokerage account outside of Spain with a value in excess of €50,000 per type of right or asset as of December 31 each year are required to report information on such rights and assets on his or her tax return for such year. Shares acquired under the Plan constitute securities for purposes of this requirement, but the Option (whether vested or unvested) is not considered an asset or right for purposes of this requirement.

Spanish residents are required to electronically declare to the Bank of Spain any securities accounts (including brokerage accounts held abroad), as well as the securities (including Shares acquired upon exercise of the Option) held in such accounts, and any transactions carried out with non-residents, if the value of the transactions for all such accounts during the prior tax year or the balances in such accounts as of December 31 of the prior tax year exceeds €1,000,000. More frequent reporting is required if such transaction value or account balance exceeds €100,000,000. If neither the total balances nor total transactions with non-residents during the relevant period exceed €50,000,000 a summarized form of declaration may be used.

Securities Law Information. The grant of the Option is considered a private offering in Switzerland and is therefore not subject to registration in Switzerland. Neither this document nor any other material related to the Option constitutes a prospectus as such term is understood pursuant to Article 652a of the Swiss Code of Obligations, and neither this document nor any other materials related to the Option may be publicly distributed or otherwise made publicly available in Switzerland.

Securities Law Information. The Plan, the Agreement, including this Appendix, and any other incidental communication materials are intended for distribution only to Participants for the purpose of an employee incentive scheme. Participant should conduct his or her own due diligence on the Option offered pursuant to the Agreement. If Participant does not understand the contents of the Plan and/or the Agreement, Participant should consult an authorized financial adviser. The Emirates Securities and Commodities Authority and the Dubai Financial Services Authority have no responsibility for reviewing or verifying any documents in connection with the Plan. Further, the Ministry of the Economy and the Dubai Department of Economic Development have not approved the Plan or the Agreement nor taken steps to verify the information set out therein, and have no responsibility for such documents.

Joint Election for Transfer of Liability for Employer National Insurance Contributions. As a condition of participation in the Plan and the exercise of the Option and all other stock options granted under the Plan, Participant agrees to accept any liability for secondary Class 1 National Insurance contributions that may be payable by the Company, the Employer or any Subsidiary in connection with the exercise and any event giving rise to Tax-Related Items (the “Employer NICs”). Without prejudice to the foregoing, Participant agrees to execute a joint election with the Company, the form of such joint

election (the “Joint Election”) having been approved formally by Her Majesty’s Revenue and Customs (“HMRC”), and any other required consent or election prior to exercise of the Option or any other stock options granted under the Plan. Participant further agrees to execute such other joint elections as may be required between Participant and any successor to the Company, the Employer or any Subsidiary. Participant further agrees that the Company, the Employer or any Subsidiary may collect the Employer NICs from Participant by any of the means set forth in Section 6(a) of the Agreement.

If Participant does not enter into a Joint Election prior to the exercise of the Option or any other stock options granted under the Plan, he or she will not be entitled to exercise the Option or stock options unless and until he or she enters into a Joint Election, and no Shares will be issued to Participant under the Plan, without any liability to the Company, the Employer or any Subsidiary.

If payment or withholding of the income tax due is not made within 90 days of the event giving rise to the liability or such other period specified in Section 222(1)(c) of the U.K. Income Tax (Earnings and Pensions) Act 2003 (the “Due Date”), the amount of any uncollected tax will constitute a loan owed by Participant to the Employer, effective on the Due Date. Participant agrees that the loan will bear interest at the then-current HMRC Official Rate, it will be immediately due and repayable, and the Company or the Employer may recover it at any time thereafter by any of the means referred to in Section 6(a) of the Agreement. Notwithstanding the foregoing, if Participant is a director or executive officer of the Company (within the meaning of Section 13(k) of the U.S. Securities Exchange Act of 1934, as amended), Participant will not be eligible for such a loan to cover the tax liability. In the event that Participant is a director or executive officer and the income tax due is not collected from or paid by Participant by the Due Date, the amount of any uncollected income tax will constitute a benefit to Participant on which additional income tax and national insurance contributions will be payable. Participant will be responsible for reporting and paying any income tax and national insurance contributions due on this additional benefit directly to HMRC under the self-assessment regime.

(“Purchaser”) hereby elects to purchase ______________ shares (the “Shares”) of the Common Stock of Qualys, Inc. (the “Company”) under and pursuant to the 2012 Equity Incentive Plan (the “Plan”) and the Stock Option Agreement, dated ________ and including the Notice of Grant, the Terms and Conditions of Stock Option Grant and the Appendix (all together, the “Agreement”). The purchase price for the Shares will be $_____________, as required by the Agreement.

4.Rights as Stockholder. Until the issuance (as evidenced by the appropriate entry on the books of the Company or of a duly authorized transfer agent of the Company) of the Shares, no right to vote or receive dividends or any other rights as a stockholder will exist with respect to the Shares subject to the Option, notwithstanding the exercise of the Option. The Shares so acquired will be issued to Purchaser as soon as practicable after exercise of the Option. No adjustment will be made for a dividend or other right for which the record date is prior to the date of issuance, except as provided in Section 13 of the Plan.

5.Tax Consultation. Purchaser understands that Purchaser may suffer adverse tax consequences as a result of Purchaser’s purchase or disposition of the Shares. Purchaser represents that Purchaser has consulted with any tax consultants Purchaser deems advisable in connection with the purchase or disposition of the Shares and that Purchaser is not relying on the Company for any tax advice.

6.Entire Agreement; Governing Law. The Plan and Agreement are incorporated herein by reference. This Exercise Notice, the Plan and the Agreement constitute the entire agreement of the parties with respect to the subject matter hereof and supersede in their entirety all prior undertakings and agreements of the Company and Purchaser with respect to the subject matter hereof, and may not be


Grant Number
Date of Grant
Vesting Commencement Date
Number of Shares Granted
Exercise Price per Share
Total Exercise Price
Type of Option			[X] Nonstatutory Stock Option
Term/Expiration Date


Submitted by:						Accepted by:

PURCHASER						QUALYS, INC.





Signature						By


Print Name						Its

Address:







						Date Received