Form of Restricted Stock Unit Agreement under the 2012 Equity Incentive Plan, as amended and restated

Unless otherwise defined herein, the terms defined in the Qualys, Inc. 2012 Equity Incentive Plan (the “Plan”) will have the same defined meanings in this Restricted Stock Unit Agreement, including the Notice of Restricted Stock Unit Grant (the “Notice of Grant”), the Terms and Conditions of Restricted Stock Unit Grant, attached hereto as Exhibit A, and any Appendix, attached hereto as Exhibit B (all together, the “Award Agreement”).

Participant has been granted the right to receive an Award of Restricted Stock Units, subject to the terms and conditions of the Plan and this Award Agreement, as follows:

Subject to any acceleration provisions contained in the Plan or set forth below, the Restricted Stock Units will vest in accordance with the following schedule: [TBD]

1.Grant. The Company hereby grants to the individual named in the Notice of Grant (the “Participant”) under the Plan an Award of Restricted Stock Units, subject to all of the terms and conditions in this Award Agreement and the Plan, which is incorporated herein by reference. Subject to Section 18(c) of the Plan, in the event of a conflict between the terms and conditions of the Plan and the terms and conditions of this Award Agreement, the terms and conditions of the Plan will prevail.

2.Company’s Obligation to Pay. Each Restricted Stock Unit represents the right to receive a Share on the date it vests. Unless and until the Restricted Stock Units will have vested in the manner set forth in Sections 3 or 4, Participant will have no right to payment of any such Restricted Stock Units. Prior to actual payment of any vested Restricted Stock Units, such Restricted Stock Units will represent an unsecured obligation of the Company, payable (if at all) only from the general assets of the Company. Any Restricted Stock Units that vest in accordance with Sections 3 or 4 will be paid to Participant (or in the event of Participant’s death, to his or her estate) in whole Shares, subject to Participant satisfying any obligations for Tax-Related Items (as defined in Section 7). Subject to the provisions of Section 4, such vested Restricted Stock Units shall be paid in whole Shares as soon as practicable after vesting, but in each such case within the period sixty (60) days following the vesting date. In no event will Participant be permitted, directly or indirectly, to specify the taxable year of the payment of any Restricted Stock Units payable under this Award Agreement.

3.Vesting Schedule. Except as provided in Section 4, and subject to Section 5, the Restricted Stock Units awarded by this Award Agreement will vest in accordance with the vesting provisions set forth in the Notice of Grant. Restricted Stock Units scheduled to vest on a certain date or upon the occurrence of a certain condition will not vest in Participant in accordance with any of the provisions of this Award Agreement, unless Participant will have been continuously a Service Provider from the Date of Grant until the date such vesting occurs.

4.Administrator Discretion. The Administrator, in its discretion, may accelerate the vesting of the balance, or some lesser portion of the balance, of the unvested Restricted Stock Units at any time, subject to the terms of the Plan. If so accelerated, such Restricted Stock Units will be considered as having vested as of the date specified by the Administrator. The payment of Shares vesting pursuant to this Section 4 shall in all cases be paid at a time or in a manner that is exempt from, or complies with, Section 409A.

Notwithstanding anything in the Plan or this Award Agreement to the contrary, if the vesting of the balance, or some lesser portion of the balance, of the Restricted Stock Units is accelerated in connection with Participant’s termination as a Service Provider (provided that such termination is a “separation from service” within the meaning of Section 409A, as determined by the Company), other than due to death, and if (x) Participant is a “specified employee” within the meaning of Section 409A at the time of such termination as a Service Provider and (y) the payment of such accelerated Restricted Stock Units will result in the imposition of additional tax under Section 409A if paid to Participant on or within the six (6) month period following Participant’s termination as a Service Provider, then the payment of such accelerated Restricted Stock Units will not be made until the date six (6) months and one (1) day following the date of Participant’s termination as a Service Provider, unless Participant dies

following his or her termination as a Service Provider, in which case, the Restricted Stock Units will be paid in Shares to Participant’s estate as soon as practicable following his or her death. It is the intent of this Award Agreement that it and all payments and benefits hereunder be exempt from, or comply with, the requirements of Section 409A so that none of the Restricted Stock Units provided under this Award Agreement or Shares issuable thereunder will be subject to the additional tax imposed under Section 409A, and any ambiguities herein will be interpreted to be so exempt or so comply. Each payment payable under this Award Agreement is intended to constitute a separate payment for purposes of Treasury Regulation Section 1.409A-2(b)(2). For purposes of this Award Agreement, “Section 409A” means Section 409A of the Code, and any final Treasury Regulations and Internal Revenue Service guidance thereunder, as each may be amended from time to time.

5.Forfeiture upon Termination of Status as a Service Provider. Notwithstanding any contrary provision of this Award Agreement, the balance of the Restricted Stock Units that have not vested as of the time of Participant’s termination as a Service Provider for any or no reason and Participant’s right to acquire any Shares hereunder will immediately terminate. The date of Participant’s termination as a Service Provider is detailed in Section 10(h).

6.Death of Participant. Any distribution or delivery to be made to Participant under this Award Agreement will, if Participant is then deceased, be made to Participant’s designated beneficiary, or if no beneficiary survives Participant, the administrator or executor of Participant’s estate. Any such transferee must furnish the Company with (a) written notice of his or her status as transferee, and (b) evidence satisfactory to the Company to establish the validity of the transfer and compliance with any laws or regulations pertaining to said transfer.

7.Withholding of Taxes. Notwithstanding any contrary provision of this Award Agreement, no certificate representing the Shares will be issued to Participant, unless and until satisfactory arrangements (as determined by the Administrator) will have been made by Participant with respect to the payment of income, employment, social insurance, payroll tax, fringe benefit tax, payment on account or other tax-related items related to Participant’s participation in the Plan and legally applicable to Participant (“Tax-Related Items”) which the Company determines must be withheld with respect to such Shares. Prior to vesting and/or settlement of the Restricted Stock Units, Participant will pay or make adequate arrangements satisfactory to the Company and/or Participant’s employer (the “Employer”) to satisfy all withholding and payment obligations of Tax-Related Items of the Company and/or the Employer. In this regard, Participant authorizes the Company and/or the Employer to withhold any Tax-Related Items legally payable by Participant from his or her wages or other cash compensation paid to Participant by the Company and/or the Employer or from proceeds of the sale of Shares. Alternatively, or in addition, if permissible under applicable local law, the Administrator, in its sole discretion and pursuant to such procedures as it may specify from time to time, may permit or require Participant to satisfy such tax withholding obligation, in whole or in part (without limitation) by (a) paying cash, (b) electing to have the Company withhold otherwise deliverable Shares having a Fair Market Value equal to the minimum amount required to be withheld, (c) selling a sufficient number of such Shares otherwise deliverable to Participant through such means as the Company may determine in its sole discretion (whether through a broker or otherwise) equal to the amount required to be withheld, or (d) if Participant is a U.S. employee, delivering to the Company already vested and owned Shares having a Fair Market Value equal to the amount required to be withheld. To the extent determined

appropriate by the Company in its discretion, it will have the right (but not the obligation) to satisfy any obligations for Tax-Related Items by reducing the number of Shares otherwise deliverable to Participant [and, until determined otherwise by the Company, this will be the method by which such tax withholding obligations are satisfied]. Further, if Participant is subject to tax in more than one jurisdiction between the Date of Grant and a date of any relevant taxable or tax withholding event, as applicable, Participant acknowledges and agrees that the Company and/or the Employer (or former employer, as applicable) may be required to withhold or account for tax in more than one jurisdiction. If Participant fails to make satisfactory arrangements for the payment of any Tax-Related Items hereunder at the time any applicable Restricted Stock Units otherwise are scheduled to vest pursuant to Sections 3 or 4 or Tax-Related Items related to Restricted Stock Units otherwise are due, Participant will permanently forfeit such Restricted Stock Units and any right to receive Shares thereunder and the Restricted Stock Units will be returned to the Company at no cost to the Company.

8.Rights as Stockholder. Neither Participant nor any person claiming under or through Participant will have any of the rights or privileges of a stockholder of the Company in respect of any Shares deliverable hereunder unless and until certificates representing such Shares will have been issued, recorded on the records of the Company or its transfer agents or registrars, and delivered to Participant. After such issuance, recordation and delivery, Participant will have all the rights of a stockholder of the Company with respect to voting such Shares and receipt of dividends and distributions on such Shares.

9.No Guarantee of Continued Service. PARTICIPANT ACKNOWLEDGES AND AGREES THAT THE VESTING OF THE RESTRICTED STOCK UNITS PURSUANT TO THE VESTING SCHEDULE HEREOF IS EARNED ONLY BY CONTINUING AS A SERVICE PROVIDER AT THE WILL OF THE COMPANY (OR THE PARENT OR SUBSIDIARY EMPLOYING OR RETAINING PARTICIPANT) AND NOT THROUGH THE ACT OF BEING HIRED, BEING GRANTED THIS AWARD OF RESTRICTED STOCK UNITS OR ACQUIRING SHARES HEREUNDER. PARTICIPANT FURTHER ACKNOWLEDGES AND AGREES THAT THIS AWARD AGREEMENT, THE TRANSACTIONS CONTEMPLATED HEREUNDER AND THE VESTING SCHEDULE SET FORTH HEREIN DO NOT CONSTITUTE AN EXPRESS OR IMPLIED PROMISE OF CONTINUED ENGAGEMENT AS A SERVICE PROVIDER FOR THE VESTING PERIOD, FOR ANY PERIOD, OR AT ALL, AND WILL NOT INTERFERE IN ANY WAY WITH PARTICIPANT’S RIGHT OR THE RIGHT OF THE COMPANY (OR THE PARENT OR SUBSIDIARY EMPLOYING OR RETAINING PARTICIPANT) TO TERMINATE PARTICIPANT’S RELATIONSHIP AS A SERVICE PROVIDER AT ANY TIME, WITH OR WITHOUT CAUSE.

10.Nature of Grant. In accepting the grant, Participant acknowledges, understands and agrees that:

(a)the Plan is established voluntarily by the Company, it is discretionary in nature and it may be modified, amended, suspended or terminated by the Company at any time, to the extent permitted by the Plan;

(b)the grant of the Restricted Stock Units is voluntary and occasional and does not create any contractual or other right to receive future grants of Restricted Stock Units, or

benefits in lieu of Restricted Stock Units, even if Restricted Stock Units have been granted in the past;

(c)all decisions with respect to future Restricted Stock Units or other grants, if any, will be at the sole discretion of the Company;

(d)Participant is voluntarily participating in the Plan;

(e)the Restricted Stock Units and the Shares subject to the Restricted Stock Units are not intended to replace any pension rights or compensation;

(f)the Restricted Stock Units and the Shares subject to the Restricted Stock Units, and the income and value of same, are not part of normal or expected compensation for purposes of calculating any severance, resignation, termination, redundancy, dismissal, end-of-service payments, bonuses, longservice awards, pension or retirement or welfare benefits or similar payments;

(g)the future value of the underlying Shares is unknown, indeterminable and cannot be predicted with certainty;

(h)for purposes of the Restricted Stock Units, Participant’s status as a Service Provider will be considered terminated as of the date Participant is no longer actively providing services to the Company or any Parent or Subsidiary (regardless of the reason for such termination and whether or not later to be found invalid or in breach of employment laws in the jurisdiction where Participant is a Service Provider or the terms of Participant’s service agreement, if any), and unless otherwise expressly provided in this Award Agreement or determined by the Administrator, Participant’s right to vest in the Restricted Stock Units under the Plan, if any, will terminate as of such date and will not be extended by any notice period (e.g., Participant’s period of service would not include any contractual notice period or any period of “garden leave” or similar period mandated under employment laws in the jurisdiction where Participant is a Service Provider or the terms of Participant’s service agreement, if any, unless Participant is providing bona fide services during such time); the Administrator shall have the exclusive discretion to determine when Participant is no longer actively providing services for purposes of the Restricted Stock Units grant (including whether Participant may still be considered to be providing services while on a leave of absence);

(i)unless otherwise provided in the Plan or by the Company in its discretion, the Restricted Stock Units and the benefits evidenced by this Award Agreement do not create any entitlement to have the Restricted Stock Units or any such benefits transferred to, or assumed by, another company nor be exchanged, cashed out or substituted for, in connection with any corporate transaction affecting the Shares; and

(j)the following provisions apply only if Participant is providing services outside the United States:

i.the Restricted Stock Units and the Shares subject to the Restricted Stock Units are not part of normal or expected compensation or salary for any purpose;

ii.Participant acknowledges and agrees that none of the Company, the Employer, or any Parent or Subsidiary shall be liable for any foreign exchange rate fluctuation between Participant’s local currency and the United States Dollar that may affect the value of the Restricted Stock Units or of any amounts due to Participant pursuant to the settlement of the Restricted Stock Units or the subsequent sale of any Shares acquired upon settlement; and

iii.no claim or entitlement to compensation or damages shall arise from forfeiture of the Restricted Stock Units resulting from the termination of Participant’s status as a Service Provider (for any reason whatsoever whether or not later found to be invalid or in breach of employment laws in the jurisdiction where Participant is a Service Provider or the terms of Participant’s service agreement, if any), and in consideration of the grant of the Restricted Stock Units to which Participant is otherwise not entitled, Participant irrevocably agrees never to institute any claim against the Company, any Subsidiary or the Employer, waives his or her ability, if any, to bring any such claim, and releases the Company, any Parent, any Subsidiary and the Employer from any such claim; if, notwithstanding the foregoing, any such claim is allowed by a court of competent jurisdiction, then, by participating in the Plan, Participant shall be deemed irrevocably to have agreed not to pursue such claim and agrees to execute any and all documents necessary to request dismissal or withdrawal of such claim.

11.No Advice Regarding Grant. The Company is not providing any tax, legal or financial advice, nor is the Company making any recommendations regarding Participant’s participation in the Plan, or Participant’s acquisition or sale of the underlying Shares. Participant is hereby advised to consult with his or her own personal tax, legal and financial advisors regarding his or her participation in the Plan before taking any action related to the Plan.

12.Data Privacy. Participant hereby explicitly and unambiguously consents to the collection, use and transfer, in electronic or other form, of Participant’s personal data as described in this Award Agreement and any other Restricted Stock Unit grant materials by and among, as applicable, the Employer, the Company and any Parent or Subsidiary for the exclusive purpose of implementing, administering and managing Participant’s participation in the Plan.

Participant understands that Data will be transferred to a stock plan service provider as may be selected by the Company in the future, which is assisting the Company with the implementation, administration and management of the Plan. Participant understands that the recipients of the Data may be located in the United States or elsewhere, and that the recipients’ country (e.g., the United States) may have different data privacy laws and protections than Participant’s country. Participant understands that if he or she resides outside the United States, he or she may request a list with the names and addresses of any potential recipients of the Data by contacting his or her local human resources representative. Participant authorizes the Company, any stock plan service provider selected by the Company and any other possible recipients which may assist the Company (presently or in the future) with implementing, administering and managing the Plan to receive, possess, use, retain and transfer the Data, in electronic or other form, for the sole purpose of implementing, administering and managing his or her participation in the Plan. Participant understands that Data will be held only as long as is necessary to implement, administer and manage Participant’s participation in the Plan. Participant understands if he or she resides outside the United States, he or she may, at any time, view Data, request additional information about the storage and processing of Data, require any necessary amendments to Data or refuse or withdraw the consents herein, in any case without cost, by contacting in writing his or her local human resources representative. Further, Participant understands that he or she is providing the consents herein on a purely voluntary basis. If Participant does not consent, or if Participant later seeks to revoke his or her consent, his or her status as a Service Provider and career with the Employer will not be adversely affected; the only adverse consequence of refusing or withdrawing Participant’s consent is that the Company would not be able to grant Participant Restricted Stock Units or other equity awards or administer or maintain such awards. Therefore, Participant understands that refusing or withdrawing his or her consent may affect Participant’s ability to participate in the Plan. For more information on the consequences of Participant’s refusal to consent or withdrawal of consent, Participant understands that he or she may contact his or her local human resources representative.

13.Address for Notices. Any notice to be given to the Company under the terms of this Award Agreement will be addressed to the Company at Qualys, Inc., 919 E. Hillsdale Blvd., 4th Floor, Foster City, CA 94404, or at such other address as the Company may hereafter designate in writing.

14.Grant is Not Transferable. Except to the limited extent provided in Section 6, this grant and the rights and privileges conferred hereby will not be transferred, assigned, pledged or hypothecated in any way (whether by operation of law or otherwise) and will not be subject to sale under execution, attachment or similar process. Upon any attempt to transfer, assign, pledge, hypothecate or otherwise dispose of this grant, or any right or privilege conferred hereby, or upon any attempted sale under any execution, attachment or similar process, this grant and the rights and privileges conferred hereby immediately will become null and void.

15.Binding Agreement. Subject to the limitation on the transferability of this grant contained herein, this Award Agreement will be binding upon and inure to the benefit of the heirs, legatees, legal representatives, successors and assigns of the parties hereto.

16.Additional Conditions to Issuance of Stock. If at any time the Company will determine, in its discretion, that the listing, registration, qualification or rule compliance of the Shares upon any securities exchange or under any state, federal or foreign law, the tax code and related regulations or the

consent or approval of any governmental regulatory authority is necessary or desirable as a condition to the issuance of Shares to Participant (or his or her estate) hereunder, such issuance will not occur unless and until such listing, registration, qualification, rule compliance, consent or approval will have been completed, effected or obtained free of any conditions not acceptable to the Company. Where the Company determines that the delivery of the payment of any Shares will violate federal securities laws or other applicable laws, the Company will defer delivery until the earliest date at which the Company reasonably anticipates that the delivery of Shares will no longer cause such violation. The Company will make all reasonable efforts to meet the requirements of any such state, federal or foreign law or securities exchange and to obtain any such consent or approval of any such governmental authority or securities exchange.

17.Plan Governs. This Award Agreement is subject to all terms and provisions of the Plan. In the event of a conflict between one or more provisions of this Award Agreement and one or more provisions of the Plan, the provisions of the Plan will govern. Capitalized terms used and not defined in this Award Agreement will have the meaning set forth in the Plan.

18.Administrator Authority. The Administrator will have the power to interpret the Plan and this Award Agreement and to adopt such rules for the administration, interpretation and application of the Plan as are consistent therewith and to interpret or revoke any such rules (including, but not limited to, the determination of whether or not any Restricted Stock Units have vested). All actions taken and all interpretations and determinations made by the Administrator in good faith will be final and binding upon Participant, the Company and all other interested persons. No member of the Administrator will be personally liable for any action, determination or interpretation made in good faith with respect to the Plan or this Award Agreement.

19.Electronic Delivery and Acceptance. The Company may, in its sole discretion, decide to deliver any documents related to Restricted Stock Units awarded under the Plan or future Restricted Stock Units that may be awarded under the Plan by electronic means or request Participant’s consent to participate in the Plan by electronic means. Participant hereby consents to receive such documents by electronic delivery and agrees to participate in the Plan through any on-line or electronic system established and maintained by the Company or a third party designated by the Company.

20.Language. If Participant has received this Award Agreement or any other document related to the Plan translated into a language other than English and if the meaning of the translated version is different than the English version, the English version will control.

21.Captions. Captions provided herein are for convenience only and are not to serve as a basis for interpretation or construction of this Award Agreement.

22.Agreement Severable. In the event that any provision in this Award Agreement will be held invalid or unenforceable, such provision will be severable from, and such invalidity or unenforceability will not be construed to have any effect on, the remaining provisions of this Award Agreement.

23.Amendment, Suspension or Termination of the Plan. By accepting this Award, Participant expressly warrants that he or she has received an Award of Restricted Stock Units under the

Plan, and has received, read and understood a description of the Plan. Participant understands that the Plan is discretionary in nature and may be amended, suspended or terminated by the Company at any time.

24.Governing Law and Venue. This Award Agreement will be governed by the laws of California without giving effect to the conflict of law principles thereof. For purposes of litigating any dispute that arises under this Award of Restricted Stock Units or this Award Agreement, the parties hereby submit to and consent to the jurisdiction of the State of California, and agree that such litigation will be conducted in the courts of San Mateo County, California, or the federal courts for the United States for the Northern District of California, and no other courts, where this Award of Restricted Stock Units is made and/or to be performed.

25.Modifications to the Award Agreement. This Award Agreement constitutes the entire understanding of the parties on the subjects covered. Participant expressly warrants that he or she is not accepting this Award Agreement in reliance on any promises, representations, or inducements other than those contained herein. Modifications to this Award Agreement or the Plan can be made only in an express written contract executed by a duly authorized officer of the Company. Notwithstanding anything to the contrary in the Plan or this Award Agreement, the Company reserves the right to revise the Award Agreement as it deems necessary or advisable, in its sole discretion and without the consent of Participant, to comply with Section 409A or to otherwise avoid imposition of any additional tax or income recognition under Section 409A in connection to this Award of Restricted Stock.

26.Waiver. Participant acknowledges that a waiver by the Company of breach of any provision of this Award Agreement shall not operate or be construed as a waiver of any other provision of this Award Agreement, or of any subsequent breach by Participant or any other Participant.