Form of Stock Option Agreement under the 2012 Equity Incentive Plan

Unless otherwise defined herein, the terms defined in the Qualys, Inc. 2012 Equity Incentive Plan (the “Plan”) will have the same defined meanings in this Stock Option Agreement, including the Notice of Stock Option Grant (the “Notice of Grant”), the Terms and Conditions of Stock Option Grant, attached hereto as Exhibit A, and the Appendix, attached hereto as Exhibit B (all together, the “Agreement”).

Participant has been granted an Option to purchase Common Stock of Qualys, Inc. (the “Company”), subject to the terms and conditions of the Plan and this Agreement, as follows:

Vesting Schedule: Subject to accelerated vesting as set forth below or in the Plan, this Option will be exercisable, in whole or in part, in accordance with the following schedule: [TBD]

Termination Period: This Option will be exercisable for three (3) months after Participant ceases to be a Service Provider, unless such termination is due to Participant’s death or Disability, in which case this Option will be exercisable for twelve (12) months after Participant ceases to be a Service Provider. Notwithstanding the foregoing sentence, in no event may this Option be exercised after the Term/Expiration Date as provided above (or in Exhibit B if a special Term/Expiration Date is required for Participant’s country) and may be subject to earlier termination as provided in Section 13(c) of the Plan.

By Participant’s signature and the signature of the Company’s representative below, Participant and the Company agree that this Option is granted under and governed by the terms and conditions of the Plan and this Agreement, all of which are made a part of this document. Participant has reviewed the Plan and this Agreement in their entirety, has had an opportunity to obtain the advice of counsel prior to executing this Agreement and fully understands all provisions of the Plan and Agreement. Participant hereby agrees to accept as binding, conclusive and final all decisions or interpretations of the Administrator upon any questions relating to the Plan and Agreement. Participant further agrees to notify the Company upon any change in the residence address indicated below.

1.Grant of Option. The Company hereby grants to the Participant named in the Notice of Grant (the “Participant”) an option (the “Option”) to purchase the number of Shares, as set forth in the Notice of Grant, at the exercise price per Share set forth in the Notice of Grant (the “Exercise Price”), subject to all of the terms and conditions in this Agreement and the Plan, which is incorporated herein by reference. Subject to Section 18(c) of the Plan, in the event of a conflict between the terms and conditions of the Plan and the terms and conditions of this Agreement, the terms and conditions of the Plan will prevail. For U.S. taxpayers, the Option will be designated as either an Incentive Stock Option (“ISO”) or a Nonstatutory Stock Option (“NSO”). If designated in the Notice of Grant as an ISO, this Option is intended to qualify as an ISO under Section 422 of the Internal Revenue Code of 1986, as amended (the “Code”). However, if this Option is intended to be an Incentive Stock Option, to the extent that it exceeds the $100,000 rule of Code Section 422(d) it will be treated as an NSO. Further, if for any reason this Option (or portion thereof) will not qualify as an ISO, then, to the extent of such nonqualification, such Option (or portion thereof) shall be regarded as a NSO granted under the Plan. In no event will the Administrator, the Company or any Parent or Subsidiary or any of their respective employees or directors have any liability to Participant (or any other person) due to the failure of the Option to qualify for any reason as an ISO.

For non-U.S. taxpayers, the Option will be designated as an NSO.

2.Vesting Schedule. Except as provided in Section 3, the Option awarded by this Agreement will vest in accordance with the vesting provisions set forth in the Notice of Grant. Shares scheduled to vest on a certain date or upon the occurrence of a certain condition will not vest in Participant in accordance with any of the provisions of this Agreement, unless Participant will have been continuously a Service Provider from the Date of Grant until the date such vesting occurs.

3.Administrator Discretion. The Administrator, in its discretion, may accelerate the vesting of the balance, or some lesser portion of the balance, of the unvested Option at any time, subject to the terms of the Plan. If so accelerated, such Option will be considered as having vested as of the date specified by the Administrator.

4.Exercise of Option.

(a)Right to Exercise. This Option may be exercised only within the term set out in the Notice of Grant, and may be exercised during such term only in accordance with the Plan and the terms of this Agreement.

(b)Method of Exercise. This Option is exercisable by delivery of an exercise notice, in the form attached as Exhibit C (the “Exercise Notice”) or in a manner and pursuant to such procedures as the Administrator may determine, which will state the election to exercise the Option, the number of Shares in respect of which the Option is being exercised (the “Exercised Shares”), and such other representations and agreements

as may be required by the Company pursuant to the provisions of the Plan. The Exercise Notice will be completed by Participant and delivered to the Company. The Exercise Notice will be accompanied by payment of the aggregate Exercise Price as to all Exercised Shares together and of any Tax-Related Items (as defined in Section 6(a)). This Option will be deemed to be exercised upon receipt by the Company of such fully executed Exercise Notice accompanied by the aggregate Exercise Price.

5.Method of Payment. Payment of the aggregate Exercise Price will be by any of the following, or a combination thereof, at the election of Participant:

(a)cash;

(b)check;

(c)consideration received by the Company under a formal cashless exercise program adopted by the Company in connection with the Plan; or

(d)if Participant is a U.S. employee, surrender of other Shares which have a Fair Market Value on the date of surrender equal to the aggregate Exercise Price of the Exercised Shares, provided that accepting such Shares, in the sole discretion of the Administrator, will not result in any adverse accounting consequences to the Company.

6.Tax Obligations.

(a)Withholding of Taxes. Notwithstanding any contrary provision of this Agreement, no certificate representing the Shares will be issued to Participant, unless and until satisfactory arrangements (as determined by the Administrator) will have been made by Participant with respect to the payment of income, employment, social insurance, payroll tax, fringe benefit tax, payment on account or other tax-related items related to Participant’s participation in the Plan and legally applicable to Participant (“Tax-Related Items”) which the Company determines must be withheld with respect to such Shares. If Participant is a non-U.S. employee, payment of Tax-Related Items may not be effectuated by surrender of other Shares with a Fair Market Value equal to the amount of any Tax-Related Items. To the extent determined appropriate by the Company in its discretion, it will have the right (but not the obligation) to satisfy any Tax-Related Items by reducing the number of Shares otherwise deliverable to Participant. If Participant fails to make satisfactory arrangements for the payment of any required Tax-Related Items hereunder at the time of the Option exercise, Participant acknowledges and agrees that the Company may refuse to honor the exercise and refuse to deliver the Shares if such amounts are not delivered at the time of exercise. Further, if Participant is subject to tax in more than one jurisdiction between the Date of Grant and the date of any relevant taxable or tax withholding event, as applicable, Participant acknowledges and agrees that the Company and/or Participant’s employer (the “Employer”), or former employer, as applicable, may be required to withhold or account for tax in more than one jurisdiction.

(b)Notice of Disqualifying Disposition of ISO Shares. If the Option granted to Participant herein is an ISO, and if Participant sells or otherwise disposes of any of the Shares acquired pursuant to the ISO on or before the later of (i) the date two (2) years after the Date of Grant, or (ii) the date one (1) year after the date of exercise, Participant will immediately notify the Company in writing of such disposition. Participant agrees that Participant may be subject to income tax withholding by the Company on the compensation income recognized by Participant.

(c)Code Section 409A. Under Code Section 409A, an option that vests after December 31, 2004 (or that vested on or prior to such date but which was materially modified after October 3, 2004) that was granted with a per share exercise price that is determined by the Internal Revenue Service (the “IRS”) to be less than the fair market value of a share on the date of grant (a “Discount Option”) may be considered “deferred compensation.” A Discount Option may result in (i) income recognition by Participant prior to the exercise of the option, (ii) an additional twenty percent (20%) federal income tax, and (iii) potential penalty and interest charges. The Discount Option may also result in additional state income, penalty and interest charges to Participant. Participant acknowledges that the Company cannot and has not guaranteed that the IRS will agree that the per Share Exercise Price of this Option equals or exceeds the Fair Market Value of a Share on the Date of Grant in a later examination. Participant agrees that if the IRS determines that the Option was granted with a per Share Exercise Price that was less than the Fair Market Value of a Share on the Date of Grant, Participant will be solely responsible for Participant’s costs related to such a determination.

7.Rights as Stockholder. Neither Participant nor any person claiming under or through Participant will have any of the rights or privileges of a stockholder of the Company in respect of any Shares deliverable hereunder unless and until certificates representing such Shares will have been issued, recorded on the records of the Company or its transfer agents or registrars, and delivered to Participant. After such issuance, recordation and delivery, Participant will have all the rights of a stockholder of the Company with respect to voting such Shares and receipt of dividends and distributions on such Shares.

8.No Guarantee of Continued Service. PARTICIPANT ACKNOWLEDGES AND AGREES THAT THE VESTING OF SHARES PURSUANT TO THE VESTING SCHEDULE HEREOF IS EARNED ONLY BY CONTINUING AS A SERVICE PROVIDER AT THE WILL OF THE COMPANY (OR THE PARENT OR SUBSIDIARY EMPLOYING OR RETAINING PARTICIPANT) AND NOT THROUGH THE ACT OF BEING HIRED, BEING GRANTED THIS OPTION OR ACQUIRING SHARES HEREUNDER. PARTICIPANT FURTHER ACKNOWLEDGES AND AGREES THAT THIS AGREEMENT, THE TRANSACTIONS CONTEMPLATED HEREUNDER AND THE VESTING SCHEDULE SET FORTH HEREIN DO NOT CONSTITUTE AN EXPRESS OR IMPLIED PROMISE OF CONTINUED ENGAGEMENT AS A SERVICE PROVIDER FOR THE VESTING PERIOD, FOR ANY PERIOD, OR AT ALL, AND WILL NOT INTERFERE IN ANY WAY WITH PARTICIPANT’S RIGHT OR THE RIGHT

OF THE COMPANY (OR THE PARENT OR SUBSIDIARY EMPLOYING OR RETAINING PARTICIPANT) TO TERMINATE PARTICIPANT’S RELATIONSHIP AS A SERVICE PROVIDER AT ANY TIME, WITH OR WITHOUT CAUSE.

9.Nature of Grant. In accepting the Option, Participant acknowledges, understands and agrees that:

(a)the Plan is established voluntarily by the Company, it is discretionary in nature, and may be amended, suspended or terminated by the Company at any time, to the extent permitted by the Plan;

(b)the grant of the Option is voluntary and occasional and does not create any contractual or other right to receive future grants of options, or benefits in lieu of options, even if options have been granted in the past;

(c)all decisions with respect to future option or other grants, if any, will be at the sole discretion of the Company;

(d)Participant is voluntarily participating in the Plan;

(e)the Option and any Shares acquired under the Plan are not intended to replace any pension rights or compensation;

(f)the Option and Shares acquired under the Plan and the income and value of same, are not part of normal or expected compensation for purposes of calculating any severance, resignation, termination, redundancy, dismissal, end-of-service payments, bonuses, long-service awards, pension or retirement or welfare benefits or similar payments;

(g)unless otherwise agreed with the Company, the Option and the Shares subject to the Option, and the income and value of same, are not granted for, or in connection with, any service Participant may provide as a director of any Parent or Subsidiary of the Company;

(h)the future value of the Shares underlying the Option is unknown, indeterminable, and cannot be predicted with certainty;

(i)if the underlying Shares do not increase in value, the Option will have no value;

(j)if Participant exercises the Option and acquires Shares, the value of such Shares may increase or decrease in value, even below the Exercise Price;

(k)for purposes of the Option, Participant’s engagement as a Service Provider will be considered terminated as of the date Participant is no longer actively

providing services to the Company or any Parent or Subsidiary (regardless of the reason for such termination and whether or not later found to be invalid or in breach of employment laws in the jurisdiction where Participant is a Service Provider or the terms of Participant’s engagement agreement, if any), and unless otherwise expressly provided in this Agreement or determined by the Administrator, (i) Participant’s right to vest in the Option under the Plan, if any, will terminate as of such date and will not be extended by any notice period (e.g., Participant’s period of service would not include any contractual notice period or any period of “garden leave” or similar period mandated under employment laws in the jurisdiction where Participant is a Service Provider or Participant’s engagement agreement, if any, unless Participant is providing bona fide services during such time); and (ii) the period (if any) during which Participant may exercise the Option after such termination of Participant's engagement as a Service Provider will commence on the date Participant ceases to actively provide services and will not be extended by any notice period mandated under employment laws in the jurisdiction where Participant is employed or terms of Participant’s engagement agreement, if any; the Administrator shall have the exclusive discretion to determine when Participant is no longer actively providing services for purposes of his or her Option grant (including whether Participant may still be considered to be providing services while on a leave of absence);

(l)unless otherwise provided in the Plan or by the Company in its discretion, the Option and the benefits evidenced by this Agreement do not create any entitlement to have the Option or any such benefits transferred to, or assumed by, another company nor to be exchanged, cashed out or substituted for, in connection with any corporate transaction affecting the Shares; and

(m)the following provisions apply only if Participant is providing services outside the United States:

(i)the Option and the Shares subject to the Option are not part of normal or expected compensation or salary for any purpose;

(ii)neither the Company, the Employer, nor any Parent or Subsidiary shall be liable for any foreign exchange rate fluctuation between Participant’s local currency and the United States Dollar that may affect the value of the Option or of any amounts due to Participant pursuant to the exercise of the Option or the subsequent sale of any Shares acquired upon exercise; and

(iii)no claim or entitlement to compensation or damages shall arise from forfeiture of the Option resulting from the termination of Participant’s engagement as a Service Provider (for any reason whatsoever, whether or not later found to be invalid or in breach of employment laws in the jurisdiction where Participant is a Service Provider or the terms of Participant’s

engagement agreement, if any), and in consideration of the grant of the Option to which Participant is otherwise not entitled, Participant irrevocably agrees never to institute any claim against the Company, any Parent, any Subsidiary or the Employer, waives his or her ability, if any, to bring any such claim, and releases the Company, any Subsidiary and the Employer from any such claim; if, notwithstanding the foregoing, any such claim is allowed by a court of competent jurisdiction, then, by participating in the Plan, Participant shall be deemed irrevocably to have agreed not to pursue such claim and agrees to execute any and all documents necessary to request dismissal or withdrawal of such claim.

10.No Advice Regarding Grant. The Company is not providing any tax, legal or financial advice, nor is the Company making any recommendations regarding Participant’s participation in the Plan, or Participant’s acquisition or sale of the underlying Shares. Participant is hereby advised to consult with his or her own personal tax, legal and financial advisors regarding his or her participation in the Plan before taking any action related to the Plan.

12.Address for Notices. Any notice to be given to the Company under the terms of this Agreement will be addressed to the Company at Qualys, Inc., 919 E. Hillsdale Blvd, 4th Floor, Foster City, CA 94404, or at such other address as the Company may hereafter designate in writing.

13.Non-Transferability of Option. This Option may not be transferred in any manner otherwise than by will or by the laws of descent or distribution and may be exercised during the lifetime of Participant only by Participant.

14.Binding Agreement. Subject to the limitation on the transferability of this grant contained herein, this Agreement will be binding upon and inure to the benefit of the heirs, legatees, legal representatives, successors and assigns of the parties hereto.

15.Additional Conditions to Issuance of Stock. If at any time the Company will determine, in its discretion, that the listing, registration, qualification or rule compliance of the Shares upon any securities exchange or under any state, federal or foreign law, the tax code and related regulations or the consent or approval of any governmental regulatory authority is necessary or desirable as a condition to the purchase by, or issuance of Shares to, Participant (or his or her estate) hereunder, such purchase or issuance will not occur unless and until such listing, registration, qualification, rule compliance, consent or approval will have been completed, effected or obtained free of any conditions not acceptable to the Company. The Company will make all reasonable efforts to meet the requirements of any such state, federal or foreign law or securities exchange and to obtain any such consent or approval of any such governmental authority or securities exchange. Assuming such compliance, for income tax purposes the Exercised Shares will be considered transferred to Participant on the date the Option is exercised with respect to such Exercised Shares.

16.Plan Governs. This Agreement is subject to all terms and provisions of the Plan. In the event of a conflict between one or more provisions of this Agreement and one or more provisions of the Plan, the provisions of the Plan will govern. Capitalized terms used and not defined in this Agreement will have the meaning set forth in the Plan.

17.Administrator Authority. The Administrator will have the power to interpret the Plan and this Agreement and to adopt such rules for the administration, interpretation and application of the Plan as are consistent therewith and to interpret or revoke any such rules (including, but not limited to, the

determination of whether or not any Shares subject to the Option have vested). All actions taken and all interpretations and determinations made by the Administrator in good faith will be final and binding upon Participant, the Company and all other interested persons. No member of the Administrator will be personally liable for any action, determination or interpretation made in good faith with respect to the Plan or this Agreement.

18.Electronic Delivery and Acceptance. The Company may, in its sole discretion, decide to deliver any documents related to Options awarded under the Plan or future options that may be awarded under the Plan by electronic means or request Participant’s consent to participate in the Plan by electronic means. Participant hereby consents to receive such documents by electronic delivery and agrees to participate in the Plan through any on-line or electronic system established and maintained by the Company or a third party designated by the Company.

19.Captions. Captions provided herein are for convenience only and are not to serve as a basis for interpretation or construction of this Agreement.

20.Language. If Participant has received this Agreement, or any other document related to the Option and/or the Plan translated into a language other than English and if the meaning of the translated version is different than the English version, the English version will control.

21.Agreement Severable. In the event that any provision in this Agreement will be held invalid or unenforceable, such provision will be severable from, and such invalidity or unenforceability will not be construed to have any effect on, the remaining provisions of this Agreement.

22.Amendment, Suspension or Termination of the Plan. By accepting this Award, Participant expressly warrants that he or she has received an Option under the Plan, and has received, read and understood a description of the Plan. Participant understands that the Plan is discretionary in nature and may be amended, suspended or terminated by the Company at any time.

23.Governing Law and Venue. This Agreement will be governed by the laws of California, without giving effect to the conflict of law principles thereof. For purposes of litigating any dispute that arises under this Option or this Agreement, the parties hereby submit to and consent to the exclusive jurisdiction of the State of California, and agree that such litigation will be exclusively conducted in the courts of San Mateo County, California, or the federal courts for the United States for the Northern District of California, and no other courts, where this Option is made and/or to be performed.

24.Appendix. Notwithstanding any provisions in this Agreement, the Option grant shall be subject to any special terms and conditions set forth in any appendix to this Agreement for Participant’s country (the “Appendix”). Moreover, if Participant relocates to one of the countries included in the Appendix, the special terms and conditions for such country will apply to Participant, to the extent the Company determines that the application of such terms and conditions is necessary or advisable for legal or administrative reasons. The Appendix constitutes part of this Agreement.

25.Modifications to the Agreement. This Agreement constitutes the entire understanding of the parties on the subjects covered. Participant expressly warrants that he or she is not accepting this Agreement in reliance on any promises, representations, or inducements other than those contained

herein. Modifications to this Agreement or the Plan can be made only in an express written contract executed by a duly authorized officer of the Company. Notwithstanding anything to the contrary in the Plan or this Agreement, the Company reserves the right to revise this Agreement as it deems necessary or advisable, in its sole discretion and without the consent of Participant, to comply with Code Section 409A or to otherwise avoid imposition of any additional tax or income recognition under Section 409A of the Code in connection with the Option.

26.Waiver. Participant acknowledges that a waiver by the Company of breach of any provision of this Agreement shall not operate or be construed as a waiver of any other provision of this Agreement, or of any subsequent breach by Participant or any other Participant.

27.Insider Trading Restrictions/Market Abuse Laws. Participant acknowledges that, he or she may be subject to insider trading restrictions and/or market abuse laws, which may affect Participant’s ability to acquire or sell Shares or rights to Shares (e.g., the Option) under the Plan during such times as Participant is considered to have “inside information” regarding the Company (as defined by the laws in Participant’s country). Any restrictions under these laws or regulations are separate from and in addition to any restrictions that may be imposed under any applicable Company insider trading policy. Participant is responsible for complying with any applicable restrictions and is advised to speak with his or her personal advisor on this matter.

28.Foreign Asset/Account Reporting; Exchange Control Requirements. Participant’s country may have certain foreign asset and/or foreign account reporting requirements and exchange controls which may affect Participant’s ability to acquire or hold Shares acquired under the Plan or cash received from participating in the Plan (including from any dividends paid on Shares acquired under the Plan) in a brokerage or bank account outside Participant’s country. Participant may be required to report such accounts, assets or transactions to the tax or other authorities in Participant’s country. Participant also may be required to repatriate sale proceeds or other funds received as a result of Participant’s participation in the Plan to Participant’s country through a designated bank or broker within a certain time after receipt. Participant acknowledges that he or she is responsible for complying with any applicable regulations, and that Participant is instructed to speak to his or her personal legal advisor for any details.

This Appendix to Stock Option Agreement (the “Appendix”) includes additional terms and conditions that govern the Option granted to Participant under the Plan if Participant resides and/or works in one of the countries listed below at the time of grant. Certain capitalized terms used but not defined in this Appendix have the meanings set forth in the Plan and/or the Agreement.

Notifications

This Appendix may also include information regarding exchange controls and certain other issues of which Participant should be aware with respect to participation in the Plan. The information is based on the securities, exchange control, and other laws in effect in the respective countries as of January 2021. Such laws are often complex and change frequently. As a result, the Company strongly recommends that Participant not rely on the information in this Appendix as the only source of information relating to the consequences of participation in the Plan because the information may be out of date at the time Participant exercises the Option or sells Shares acquired under the Plan.

In addition, the information contained herein is general in nature and may not apply to Participant’s particular situation, and the Company is not in a position to assure Participant of a particular result. Accordingly, Participant is advised to seek appropriate professional advice as to how the relevant laws in Participant’s country may apply to Participant’s situation.

Finally, if Participant is a citizen or resident of a country other than the one in which Participant is currently working, transfers employment or residency after the Option is granted, or is considered a resident of another country for local law purposes, the notifications contained herein may not be applicable to Participant, and the Company shall, in its discretion, determine to what extent the terms and conditions contained herein shall apply.

Exchange Control Information. Exchange control reporting is required for cash transactions exceeding AUD10,000 and for international fund transfers. If an Australian bank is assisting with the transaction, the bank will file the report on behalf of Participant.

Securities Law Information. If Participant acquires Shares under the Plan and offers the Shares for sale to a person or entity resident in Australia, the offer may be subject to disclosure requirements under Australian law. Participant should consult with his or her own legal advisor before making any such offer in Australia.

Tax Information. The Plan is a plan to which Subdivision 83A-C of the Income Tax Assessment Act 1997 (Cth) applies (subject to conditions in the Act).

Taxation of Option. The tax treatment of the Option will depend upon when Participant accepts it relative to the offer date. If Participant accepts the Option within 60 days from the offer date, Participant will be taxed at the time of offer. Based on the current interpretation of Belgian tax law by the Belgian Minister of Finance, if Participant accepts the option more than 60 days from the offer date, Participant will be taxed at the time of exercise. By accepting the Option, Participant acknowledges that neither the Employer, the Company nor any Parent or other Subsidiary may be held liable for damages, if any, that Participant may incur should the Minister of Finance’s interpretation not be upheld (with respect to taxation at exercise for options accepted more than 60 days following the offer date). Participant is advised to consult with his or her personal tax advisor prior to accepting the Option.

Foreign Asset/Account Reporting Information. Belgium residents are required to report any securities held (including Shares) or bank or brokerage accounts opened and maintained outside Belgium on their annual tax returns. In a separate report, Belgium residents are also required to provide the National Bank of Belgium with the account details of any such foreign accounts. This report, as well as additional information on how to complete it, can be found on the website of the National Bank of Belgium, www.nbb.be, under Kredietcentrales / Centrales des crédits caption. Participant should consult his or her personal advisor to ensure compliance with applicable reporting obligations.

Compliance with Law. By accepting this Option, Participant agrees to comply with applicable Brazilian laws and to report and pay any and all applicable Tax-Related Items associated with the exercise of the Option, the receipt of any dividends, and the sale of Shares acquired under the Plan.

Labor Law Acknowledgment. By accepting and/or exercising the Option, Participant agrees that (i) Participant is making an investment decision, (ii) Participant may exercise the Option only if the vesting conditions are met and (iii) the value of the underlying Shares is not fixed and may increase or decrease in value without compensation.

Exchange Control Information. If Participant is resident or domiciled in Brazil, Participant will be required to submit annually a declaration of assets and rights held outside of Brazil to the Central Bank of Brazil if the aggregate value of such assets and rights is equal to or greater than US$100,000. Assets and rights that must be reported include Shares.

Tax on Financial Transaction (IOF). Payments to foreign countries (including the payment of the exercise price) and repatriation of funds into Brazil and the conversion between BRL and USD associated with such fund transfers may be subject to the Tax on Financial Transactions. It is Participant’s responsibility to comply with any applicable Tax on Financial Transactions arising from his or her participation in the Plan. Participant should consult with his or her personal tax advisor for additional details.

Method of Payment. Due to regulatory considerations in Canada, Participant is prohibited from surrendering Shares that Participant already owns or attesting to the ownership of Shares to pay the Exercise Price or any Tax-Related Items in connection with the Option.

Termination of Continuous Service. The following provision supplements Section 9(k) of the Agreement and the Termination Period set forth in the Notice of Grant:

Participant’s active engagement as a Service Provider shall be considered terminated for vesting and other purposes as of the earlier of (a) the date that Participant receives notice of termination of Participant’s engagement as a Service Provider from the Company or the Employer; or (b) the date that Participant is no longer actively providing services to the Company or the Employer, regardless of any notice period or period of pay in lieu of such notice required under applicable employment law; the Administrator shall have the exclusive discretion to determine when Participant’s active provision of services is terminated for purposes of the Option (including whether Participant may still be considered actively employed while on a leave of absence).

Securities Law Information. Participant will not be permitted to sell or otherwise dispose of the Shares acquired upon exercise of the Option within Canada. Participant will be permitted to sell or dispose of such Shares only if such sale or disposal takes place outside of Canada through the facilities of the stock exchange on which the Shares are traded (i.e., the NASDAQ).

Foreign Asset/Account Reporting Information. If the total value of Participant’s foreign property exceeds C$100,000 at any time during the year, Participant must report all of his or her foreign property on Form T1135 (Foreign Income Verification Statement) by April 30 of the following year. Foreign property includes Shares acquired under the Plan as well as the Option itself. The Option must be reported--generally at a nil cost--if the C$100,000 cost threshold is exceeded because of other foreign property Participant holds. If Shares are acquired, their cost generally is the adjusted cost base (“ACB”) of the Shares. The ACB would normally equal the fair market value of the Shares at exercise, but if Participant owns other shares, this ACB may have to be averaged with the ACB of the other shares. Participant should speak with a personal tax advisor to determine the scope of foreign property that must be considered for purposes of this requirement.

Language Consent. The parties acknowledge that it is their express wish that the Agreement, as well as all documents, notices and legal proceedings entered into, given or instituted pursuant hereto or relating directly or indirectly hereto, be drawn up in English.

Data Privacy Notice and Consent. This provision supplements Section 11 of the Agreement:

Participant hereby authorizes the Company and the Company’s representatives to discuss with and obtain all relevant information from all personnel, professional or not, involved in the administration and operation of the Plan. Participant further authorizes the Company and any Subsidiary and the Plan administrators to disclose and discuss the Plan with their advisors and to record all relevant information and keep such information in Participant’s employee file.

Nature of the Grant. This provision supplements Section 9 of the Agreement:

Pursuant to Article 128 of the Colombian Labor Code, amended by Articile 15 Law 50, 1990, the Plan and related benefits do not constitute a component of “salary” for any legal purpose.

Notifications

Securities Law Information. The Shares are not and will not be registered with the Colombian registry of publicly traded securities (Registro Nacional de Valores y Emisores) and therefore the Shares may not be offered to the public in Colombia. Nothing in this Agreement should be construed as the making of a public offer of securities in Colombia.

Foreign Asset/Account Reporting Information. Foreign investments held abroad (including Shares received upon exercise of the Option or any dividends paid on such Shares) must be registered with the Central Bank (Banco de la República) if Participant’s aggregate investments (as of December 31 of the applicable calendar year) equal or exceed the equivalent of US$500,000. Further, upon the sale of any Shares that Participant has registered with the Central Bank, Participant must cancel the registration by March 31 of the following year.

Exchange Control Information. The Czech National Bank may require Participant to fulfill certain notification duties in relation to the acquisition of Shares and the opening and maintenance of a foreign

account. However, because exchange control regulations change frequently and without notice, Participant should consult with his or her personal legal advisor prior to the exercise of the Option and the sale of Shares acquired at exercise to ensure compliance with current regulations. It is Participant’s responsibility to comply with any applicable Czech exchange control laws.

Exchange Control Information. Cross-border payments in excess of €12,500 must be reported monthly to the German Federal Bank (Bundesbank). Participant is responsible for the reporting obligation and should file the report ("Allgemeine Meldeportal Statistik") electronically by the fifth day of the month following the month in which the payment is made. A copy of the form report can be accessed via the Bundesbank’s website at www.bundesbank.de and is available in both German and English.

Restriction on Sale of Shares. Shares received at exercise are accepted as a personal investment. Should any portion of the Option vest within six months of the Date of Grant, Participant agrees that Participant or his or her heirs or representatives will not offer to the public or otherwise dispose of the Shares acquired at exercise prior to the six-month anniversary of the Date of Grant.

Securities Law Notice. WARNING: The contents of this document have not been reviewed by any regulatory authority in Hong Kong. Participant is advised to exercise caution in relation to the offer. If Participant is in any doubt about any of the contents of this document, he or she should obtain independent professional advice. The Options offered and any Shares acquired under the Plan do not constitute a public offering of securities under Hong Kong law and are available only to employees of the Company and any Subsidiary. The Plan, the Agreement, including this Appendix, and any other incidental communication materials distributed in connection with the Plan have not been prepared in accordance with and are not intended to constitute a “prospectus” for a public offering of securities under the applicable securities legislation in Hong Kong. The Option is intended only for the personal use of Employees of the Company and any Subsidiary and may not be distributed to any other person.

Nature of Scheme. The Company specifically intends that the Plan will not be an occupational retirement scheme for purposes of the Occupational Retirement Schemes Ordinance.

Method of Exercise. Notwithstanding anything to the contrary in the Plan or the Agreement, due to legal restrictions in India, Participant will not be permitted to pay the exercise price by a “sell-to-cover”

exercise (i.e., where some of the Shares subject to the Option will be sold immediately upon exercise and the proceeds of the sale will be remitted to the Company to cover the exercise price for the purchased shares and any Tax-Related Items withholding). The Company reserves the right to permit this method of payment depending on the development of local law.

Repatriation of Proceeds of Sale. Participant agrees to repatriate to India all proceeds received from the sale of Shares within ninety (90) days of receipt and any dividends paid on such Shares within one hundred and eighty (180) days of receipt. Participant must maintain the foreign inward remittance certificate (“FIRC”) received from the bank where the foreign currency is deposited in the event that the Reserve Bank of India or the Company requests proof of repatriation. It is Participant’s responsibility to comply with applicable exchange control laws in India.

Foreign Asset/Account Reporting Information. Participant is required to declare any foreign bank accounts and any foreign financial assets (including Shares held outside India) in Participant’s annual tax return. Participant is responsible for complying with this reporting obligation and is advised to confer with his or her personal tax advisor in this regard.

Form of Exercise / Method of Payment. The following provision supplements Section 4(b) and Section 5 of the Agreement:

Notwithstanding anything to the contrary in the Agreement, Participant may pay the aggregate Exercise Price solely by consideration received by the Company under a formal cashless exercise whereby all Exercise Shares are sold immediately upon exercise (i.e. a “same-day sale”) and the sales proceeds, less the Exercise Price, any Tax-Related Items and broker’s fees or commissions, are remitted to Participant. The Company reserves the right to provide Participant with additional methods of payment in the future.

Data Privacy Notice. This provision replaces Section 11 of the Agreement in its entirety:

Plan Document Acknowledgment. In accepting the grant of the Option, Participant acknowledges that he or she has received a copy of the Plan and the Agreement, has reviewed the Plan and the Agreement, including this Appendix, in their entirety and fully understands and accepts all provisions of the Plan and the Agreement, including this Appendix.

Participant acknowledges that he or she has read and specifically and expressly approves the following Sections of the Agreement: Section 2 (Vesting Schedule); Section 4 (Exercise of Option) (as supplemented by the provision above in this Appendix); Section 6 (Tax Obligations); Section 8 (No Guarantee of Continued Service); Section 9 (Nature of Grant); Section 20 (Language); Section 23

(Governing Law and Venue); Section 27 (Insider Trading Restrictions/Market Abuse Laws); and the Data Privacy Notice for Italy, each included in this Country Addendum.

Notifications

Foreign Asset/Account Reporting Information. If Participant is an Italian resident and, during any fiscal year, holds investments or financial assets outside of Italy (e.g., cash, Shares) which may generate income taxable in Italy, Participant is required to report such investments or assets on his or her annual tax return (on UNICO Form, RW Schedule, or on a special form if Participant is not required to file a tax return). These reporting obligations will apply to Participant if he or she is the beneficial owner of foreign financial assets, even if Participant does not directly hold investments abroad or foreign assets.

Foreign Asset Tax Information. The value of the financial assets held outside of Italy by Italian residents is subject to a foreign asset tax. Such tax is currently levied at an annual rate of 2 per thousand (0.2%). The taxable amount will be the fair market value of the financial assets (e.g., Shares acquired under the Plan) assessed at the end of the calendar year. No tax payment duties arise if the amount of the foreign assets tax calculated on all financial assets held abroad does not exceed €12.

Exchange Control Information. If Participant pays more than ¥30,000,000 for the purchase of Shares in any one transaction, Participant must file an ex post facto Payment Report with the Ministry of Finance (the “MOF”) through the Bank of Japan or the bank carrying out the transaction. The precise reporting requirements vary depending on whether the relevant payment is made through a bank in Japan. If Participant intends to acquire Shares with a value in excess of ¥100,000,000 in a single transaction, Participant must also file an ex post facto Report Concerning Acquisition of Shares with the Ministry of Finance through the Bank of Japan within 20 days of acquiring the Shares. The forms to make these reports may be acquired at the Bank of Japan.

A Payment Report is required independently of a Report Concerning Acquisition of Securities. Consequently, if the total amount that you pay on a one-time basis at exercise of the Option exceeds ¥100,000,000, you must file both a Payment Report and a Report Concerning Acquisition of Securities.

Foreign Asset/Account Reporting Information. Participant is required to report details of any assets held outside of Japan (including Shares acquired under the Plan) as of December 31st, to the extent such assets have a total net fair market value exceeding ¥50 million. Such report will be due by March 15th each year. Participant should consult with his or her personal tax advisor to determine if the reporting obligation applies to Participant’s personal situation.

There are no country-specific provisions.

There are no country-specific provisions.

No Entitlement or Claims for Compensation/Policy Statement. In accepting the Option, Participant expressly recognizes that the Company, with offices at 919 E. Hillsdale Blvd., 4th Floor, Foster City, CA 94404, U.S.A., is solely responsible for the administration of the Plan and that participation in the Plan and acquisition of Shares does not constitute an employment relationship between Participant and the Company since Participant is participating in the Plan on a wholly commercial basis and Participant’s sole employer is Qualys Mexico (“Qualys-Mexico”), not the Company in the United States. Based on the foregoing, Participant expressly recognizes that the Plan and the benefits that Participant may derive from participation in the Plan do not establish any rights between Participant and the Employer, Qualys-Mexico, and do not form part of the employment conditions and/or benefits provided by Qualys-Mexico and any modification of the Plan or its termination shall not constitute a change or impairment of the terms and conditions of Participant’s employment.

Participant further understand that participation in the Plan is as a result of a unilateral and discretionary decision of the Company; therefore, the Company reserves the absolute right to amend and/or discontinue participation at any time without any liability to Participant.

Finally, Participant hereby declares that he or she does not reserve any action or right to bring any claim against the Company for any compensation or damages regarding any provision of the Plan or the benefits derived under the Plan, and Participant therefore grants a full and broad release to the Company and any Subsidiary, its shareholders, officers, agents or legal representatives with respect to any claim that may arise.

There are no country-specific provisions.

THE SECURITIES BEING OFFERED OR SOLD HAVE NOT BEEN REGISTERED WITH THE SECURITIES AND EXCHANGE COMMISSION UNDER THE SECURITIES REGULATION CODE. ANY FURTHER OFFER OR SALE THEREOF IS SUBJECT TO REGISTRATION REQUIREMENTS UNDER THE CODE UNLESS SUCH OFFER OR SALE QUALIFIES AS AN EXEMPT TRANSACTION.

For further information on risk factors impacting the Company’s business that may affect the value of the Shares, Participant may refer to the risk factors discussion in the Company's Annual Report on Form 10-K and Quarterly Reports on Form 10-Q, which are filed with the U.S. Securities and Exchange Commission and are available online at www.sec.gov, as well as on the Company's website at https://investor.qualys.com/. In addition, Participant may receive, free of charge, a copy of the Company's Annual Report, Quarterly Reports or any other reports, proxy statements or communications distributed to the Company's stockholders by contacting Investor Relations, 919 E. Hillsdale Boulevard, 4th Floor, Foster City, California 94404, USA

Participant acknowledges he or she is permitted to dispose or sell Shares acquired under the Plan provided the offer and resale of such shares takes place outside the Philippines through the facilities of a stock exchange on which the Shares are listed. The Shares are currently listed on the Nasdaq Global Select Market in the United States of America.

Exchange Control Information. Participant is required to file quarterly reports to the National Bank of Poland with information on transactions and balances regarding Participant’s rights to Shares (such as Options) and Shares if the total value (calculated individually or together with other assets and liabilities possessed abroad) exceeds PLN 7 million. Participant is also required to transfer funds through a bank account in Poland if the transferred amount in any single transaction exceeds a specified threshold (currently €15,000). Participant is required to retain documents connected with foreign exchange transactions for a period of five years from the date the exchange transaction was made.

U.S. Transaction. Participant understands that the acceptance of the Option results in an agreement between Participant and the Company that is completed in the United States and that the Agreement is governed by the laws of the State of California, without giving effect to the conflict of law principles thereof.

Securities Law Information. Participant acknowledges that the Option, the Notice of Grant, the Agreement, the Plan and all other materials that Participant may receive regarding participation in the Plan do not constitute advertising or an offering of securities in Russia. The Shares acquired pursuant to the Plan have not and will not be registered in Russia and therefore, neither the Option nor the Shares may be used for offering or public circulation in Russia. Participant acknowledges that he or she may hold Shares acquired upon exercise of the Option in an account with the Company’s third party broker/administrator in the U.S. However, in no event will Shares issued to Participant under the Plan be delivered to Participant in Russia. Further, Participant is not permitted to sell Shares directly to other Russian individuals.

Foreign Asset/Account Reporting Information. Under current exchange control regulations in Russia, Participant is required to repatriate certain cash amounts he or she receives with respect to the Options, including any dividends and proceeds from the sale of Shares that may be issued to Participant pursuant to the Shares, from his or her U.S. brokerage account to Russia as soon as Participant intends to use those cash amounts for any purpose, including reinvestment. Unless an exception exists, such funds must initially be credited to Participant through a foreign currency account at an authorized bank in Russia. After the funds are initially received in Russia, they may be further remitted to foreign banks in accordance with Russian exchange control laws.

Participant is required to report the opening, closing or change of details of any foreign bank account to Russian tax authorities within one month of opening, closing or change of details of such account. Participant also is required to report (i) the beginning and ending balances in such a foreign bank account each year and (ii) transactions related to such a foreign account during the year to the Russian tax authorities, on or before June 1 of the following year. The tax authorities can require Participant to provide appropriate supporting documents related to transactions in a foreign bank account.

Anti-Corruption Notification. Anti-corruption laws prohibit certain public servants, their spouses and their dependent children from owning any foreign source financial instruments (e.g., Shares of foreign companies such as the Company). Accordingly, Participant should inform the Company if he or she is covered by these laws because Participant should not hold Shares acquired under the Plan.

Labor Law Information. If Participant continues to hold Shares acquired at exercise of the Option after an involuntary termination of Participant’s engagement as a Service Provider, Participant will not be eligible to receive unemployment benefits in Russia.

Securities Law Information. The grant of the Option under the Plan is being made pursuant to the

“Qualifying Person” exemption” under section 273(1)(f) of the Securities and Futures Act (Chapter 289, 2006 Ed.) (“SFA”). The Plan has not been lodged or registered as a prospectus with the Monetary Authority of Singapore. Participant should note that the Option is subject to section 257 of the SFA and that Participant will not be able to make (i) any subsequent sale of the Shares in Singapore or (ii) any offer of such subsequent sale of the Shares subject to the Option in Singapore, unless such sale or offer is made (i) after six months from the Date of Grant or (ii) pursuant to the exemptions under Part XIII Division (1) Subdivision (4) (other than section 280) of the SFA (Chapter 289, 2006 Ed.).

Chief Executive Officer and Director Notification Obligation. If Participant is a chief executive officer, director, associate director or shadow director of a Subsidiary in Singapore, he or she subject to certain notification requirements under the Singapore Companies Act. Among these requirements is an obligation to notify the Singaporean corporation in writing when Participant receives an interest (e.g., an Option, Shares) in the Company or any related companies. In addition, Participant must notify the Singapore employer when Participant sells Shares or shares of any related company (including when Participant sell Shares acquired under the Plan). These notifications must be made within two business days of acquiring or disposing of any interest in the Company or any related company. In addition, a notification must be made of Participant’s interests in the Company or any related company within two business days of becoming a chief executive officer or director.

Securities Law Acknowledgement. In compliance with South African Securities Law, Participant acknowledges that he or she has been notified that the documents listed below are available for review online as follows:

1.a copy of the Company’s most recent Annual Report (Form 10-K) –

2.a copy of the Company’s most recent Plan Prospectus

Participant acknowledges that he or she may have copies of the above documents provided to him or her, at no charge, on request on the Company’s website at: https://investor.qualys.com/.

Tax Requirements. The following provisions supplement Section 6 of the Agreement:

By accepting the grant of the Option, Participant agrees to notify or the Employer of the amount of any gain realized upon the exercise of the Option. Participant understands that if he or she fails to advise the Employer of the gain realized at exercise, Participant may be liable for a fine. Participant will be responsible for paying the difference between the actual tax liability and the amount withheld.

Exchange Control Information. Under current South African exchange control policy, Participant understands that if he or she is a South African resident, Participant may invest a maximum of ZAR11,000,000 per annum in offshore investments, including in Shares. This limit does not apply to non-resident employees. The first ZAR1,000,000 annual discretionary allowance requires no prior authorization but Participant understand that he or she must obtain tax clearance for the next ZAR10,000,000. It is Participant’s responsibility to ensure that he or she does not exceed this limit and obtains the necessary tax clearance for remittances exceeding ZAR1,000,000. This limit is a cumulative allowance; therefore, Participant’s ability to remit funds for the exercise of Options will be reduced if Participant’s foreign investment limit is utilized to make a transfer of funds offshore that is unrelated to the Plan. Participant acknowledges that if the ZAR11,000,000 limit will be exceeded as a result of a purchase under the Plan, Participant may still participate in the Plan; however, Participant will be required to immediately sell the Shares purchased on his or her behalf under the Plan and repatriate the proceeds to South Africa in order to ensure that Participant does not hold assets outside South Africa with a value in excess of the permitted offshore investment allowance amount.

Nature of Grant. The following provision supplements Section 9 of the Agreement:

In accepting the grant of the Option, Participant consents to participation in the Plan and acknowledges that he or she has received a copy of the Plan.

Participant understands that the Company has unilaterally, gratuitously and discretionally decided to grant stock options under the Plan to individuals who may be employees of the Company or its Subsidiaries throughout the world. This decision is a limited decision that is entered into upon the express assumption and condition that any grant will not bind the Company or any of its Subsidiaries over and above the specific terms of the Plan. Consequently, Participant understands that the Option is granted on the assumption and condition that the Option and any Shares acquired upon exercise of the Option are not a part of any employment contract (either with the Company or any Subsidiary of the Company) and shall not be considered a mandatory benefit, salary for any purposes (including severance compensation) or any other right whatsoever.

Further, Participant understands and agrees that, unless otherwise expressly provided for by the Company or set forth in the Agreement, the Option will be cancelled without entitlement to any Shares if Participant ceases to be a Service Provider for any reason, including, but not limited to: resignation, disciplinary dismissal adjudged to be with cause, disciplinary dismissal adjudged or recognized to be without good cause (i.e., subject to a “despido improcedente”), material modification of the terms of employment under Article 41 of the Workers’ Statute, relocation under Article 40 of the Workers’ Statute, Article 50 of the Workers’ Statute, or under Article 10.3 of Royal Decree 1382/1985. The Administrator shall have the exclusive discretion to determine the date when Participant’s status as a Service Provider has terminated for purposes of the Option.

In addition, Participant understands that this grant would not be made to Participant but for the assumptions and conditions referred to above; thus, Participant acknowledges and freely accepts that should any or all of the assumptions be mistaken or should any of the conditions not be met for any reason, then any grant of, or right to, the Option shall be null and void.

Securities Law Information. No “offer of securities to the public,” as defined under Spanish law, has taken place or will take place in the Spanish territory in connection with the Option. The Agreement has not been, nor will it be, registered with the Comisión Nacional del Mercado de Valores, and does not constitute a public offering prospectus.

Exchange Control Information. Spanish residents who acquire Shares under the Plan must declare such acquisition to the Spanish Dirección General de Comercio e Inversiones (the “DGCI”), for statistical purposes. Because Participant will not purchase or sell the shares through the use of a Spanish financial institution, Participant must make the declaration himself or herself by filing a D-6 form with the DGCI. Generally, the D-6 form must be filed each January while the shares are owned.

When receiving foreign currency payments derived from the ownership of shares (i.e., cash dividends or sale proceeds) exceeding €50,000, Participant must inform the financial institution receiving the payment of the basis upon which such payment is made. Participant will need to provide the financial institution with the following information: (i) the Participant’s name, address and fiscal identification number; (ii) the name and corporate domicile of the Company; (iii) the amount of the payment; (iv) the currency used; (v) the country of origin; (vi) the reasons for the payment; and (vii) additional information that may be required. In addition, if Participant wishes to import the ownership title of any shares (i.e., share certificates) into Spain, he or she must declare the import of such securities to the DGCI.

Foreign Asset/Account Reporting Information. Spanish residents holding rights or assets (e.g., Shares, cash, etc.) in a bank or brokerage account outside of Spain with a value in excess of €50,000 per type of right or asset as of December 31 each year are required to report information on such rights and assets on his or her tax return for such year. Shares acquired under the Plan constitute securities for purposes of this requirement, but the Option (whether vested or unvested) is not considered an asset or right for purposes of this requirement.

Spanish residents are required to electronically declare to the Bank of Spain any securities accounts (including brokerage accounts held abroad), as well as the securities (including Shares acquired upon exercise of the Option) held in such accounts, and any transactions carried out with non-residents, if the value of the transactions for all such accounts during the prior tax year or the balances in such accounts as of December 31 of the prior tax year exceeds €1,000,000. More frequent reporting is required if such transaction value or account balance exceeds €100,000,000. If neither the total balances nor total transactions with non-residents during the relevant period exceed €50,000,000 a summarized form of declaration may be used.

There are no country-specific terms and conditions.

Securities Law Information. The grant of the Option is considered a private offering in Switzerland and is therefore not subject to registration in Switzerland. Neither this document nor any other material related to the Option constitutes a prospectus as such term is understood pursuant to Article 652a of the Swiss Code of Obligations, and neither this document nor any other materials related to the Option may be publicly distributed or otherwise made publicly available in Switzerland.

Securities Law Information. The Plan, the Agreement, including this Appendix, and any other incidental communication materials are intended for distribution only to Participants for the purpose of an employee incentive scheme. Participant should conduct his or her own due diligence on the Option offered pursuant to the Agreement. If Participant does not understand the contents of the Plan and/or the Agreement, Participant should consult an authorized financial adviser. The Emirates Securities and Commodities Authority and the Dubai Financial Services Authority have no responsibility for reviewing or verifying any documents in connection with the Plan. Further, the Ministry of the Economy and the Dubai Department of Economic Development have not approved the Plan or the Agreement nor taken steps to verify the information set out therein, and have no responsibility for such documents.

Joint Election for Transfer of Liability for Employer National Insurance Contributions. As a condition of participation in the Plan and the exercise of the Option and all other stock options granted under the Plan, Participant agrees to accept any liability for secondary Class 1 National Insurance contributions that may be payable by the Company, the Employer or any Subsidiary in connection with the exercise and any event giving rise to Tax-Related Items (the “Employer NICs”). Without prejudice to the foregoing, Participant agrees to execute a joint election with the Company, the form of such joint

election (the “Joint Election”) having been approved formally by Her Majesty’s Revenue and Customs (“HMRC”), and any other required consent or election prior to exercise of the Option or any other stock options granted under the Plan. Participant further agrees to execute such other joint elections as may be required between Participant and any successor to the Company, the Employer or any Subsidiary. Participant further agrees that the Company, the Employer or any Subsidiary may collect the Employer NICs from Participant by any of the means set forth in Section 6(a) of the Agreement.

If Participant does not enter into a Joint Election prior to the exercise of the Option or any other stock options granted under the Plan, he or she will not be entitled to exercise the Option or stock options unless and until he or she enters into a Joint Election, and no Shares will be issued to Participant under the Plan, without any liability to the Company, the Employer or any Subsidiary.

Withholding of Taxes. This provision supplements Section 6(a) of the Agreement:

If payment or withholding of the income tax due is not made within 90 days of the event giving rise to the liability or such other period specified in Section 222(1)(c) of the U.K. Income Tax (Earnings and Pensions) Act 2003 (the “Due Date”), the amount of any uncollected tax will constitute a loan owed by Participant to the Employer, effective on the Due Date. Participant agrees that the loan will bear interest at the then-current HMRC Official Rate, it will be immediately due and repayable, and the Company or the Employer may recover it at any time thereafter by any of the means referred to in Section 6(a) of the Agreement. Notwithstanding the foregoing, if Participant is a director or executive officer of the Company (within the meaning of Section 13(k) of the U.S. Securities Exchange Act of 1934, as amended), Participant will not be eligible for such a loan to cover the tax liability. In the event that Participant is a director or executive officer and the income tax due is not collected from or paid by Participant by the Due Date, the amount of any uncollected income tax will constitute a benefit to Participant on which additional income tax and national insurance contributions will be payable. Participant will be responsible for reporting and paying any income tax and national insurance contributions due on this additional benefit directly to HMRC under the self-assessment regime.

Qualys, Inc.

919 E. Hillsdale Blvd., 4th Floor

Foster City, CA 94404

Attention: Stock Administration

1.Exercise of Option. Effective as of today, ________________, _____, the undersigned

(“Purchaser”) hereby elects to purchase ______________ shares (the “Shares”) of the Common Stock of Qualys, Inc. (the “Company”) under and pursuant to the 2012 Equity Incentive Plan (the “Plan”) and the Stock Option Agreement, dated ________ and including the Notice of Grant, the Terms and Conditions of Stock Option Grant and the Appendix (all together, the “Agreement”). The purchase price for the Shares will be $_____________, as required by the Agreement.

2.Delivery of Payment. Purchaser herewith delivers to the Company the full purchase price of the Shares and any Tax-Related Items (as defined in Section 6(a) of the Agreement) to be paid in connection with the exercise of the Option.

3.Representations of Purchaser. Purchaser acknowledges that Purchaser has received, read and understood the Plan and the Agreement and agrees to abide by and be bound by their terms and conditions.

4.Rights as Stockholder. Until the issuance (as evidenced by the appropriate entry on the books of the Company or of a duly authorized transfer agent of the Company) of the Shares, no right to vote or receive dividends or any other rights as a stockholder will exist with respect to the Shares subject to the Option, notwithstanding the exercise of the Option. The Shares so acquired will be issued to Purchaser as soon as practicable after exercise of the Option. No adjustment will be made for a dividend or other right for which the record date is prior to the date of issuance, except as provided in Section 13 of the Plan.

5.Tax Consultation. Purchaser understands that Purchaser may suffer adverse tax consequences as a result of Purchaser’s purchase or disposition of the Shares. Purchaser represents that Purchaser has consulted with any tax consultants Purchaser deems advisable in connection with the purchase or disposition of the Shares and that Purchaser is not relying on the Company for any tax advice.

6.Entire Agreement; Governing Law. The Plan and Agreement are incorporated herein by reference. This Exercise Notice, the Plan and the Agreement constitute the entire agreement of the parties with respect to the subject matter hereof and supersede in their entirety all prior undertakings and agreements of the Company and Purchaser with respect to the subject matter hereof, and may not be

modified adversely to the Purchaser’s interest except by means of a writing signed by the Company and Purchaser. This agreement is governed by the internal substantive laws, but not the choice of law rules, of California.