What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2024-02-15 compared with 2023-02-16 · 189 added, 125 removed, 525 unchanged (37% of the section changed)

6 unchanged sentences

Our recent growth may not be indicative of our future growth and, if we continue to grow, we may not be able to manage our growth effectively.

We have experienced rapid growth in our headcount and operations.

We have also significantly increased the size of our customer base over the last several years.

We have focused on scaling our operations and growing our headcount in line with our growth plan and size of our customer base, which we have significantly increased over the last several years.

While we have expanded our operations and headcount in prior periods, it is not indicative of our future growth and we may modify our pace of hiring to align with our growth plans.

9 unchanged sentences

• Increase revenue from existing customers through increased or broader use of our platform within their organizations;

• Compete in an AI-accelerated environment;

• Further penetrate the existing industry verticals we serve and expand into other industry verticals;

3 unchanged sentences

We may not be able to scale our business quickly enough to meet our customers’ growing needs, and if we are not able to grow efficiently, our operating results could be harmed.

As usage of our platform grows and as customers use our platform for more advanced and more frequent projects, we may need to devote additional resources to improving our software architecture, integrating with third-party systems, and maintaining infrastructure performance.

In addition, we will need to appropriately scale our internal business operations as well as grow our partner services systems, including our Customer Success organization and operations, to serve our growing customer base, particularly as our customer base expands over time.

Any failure of or delay in these efforts could cause impaired system performance and reduced customer satisfaction.

Customers may use our platform for more advanced and frequent projects, resulting in usage growth for our platform.

With such growth, we may need to devote additional resources to improving our software architecture, integrating with third-party systems, and maintaining infrastructure performance.

In addition, we will need to continue to appropriately scale our internal business operations as well as grow our partner services systems, including our Customer Success organization and operations, to serve our growing customer base, particularly as our customer base expands over time.

Any failure of or delay in these efforts could cause impaired system

performance and reduced customer satisfaction.

These issues could reduce the attractiveness of our platform to customers, resulting in decreased sales to new customers, lower renewal rates by existing customers, the issuance of service credits, or requested refunds, any of which could hurt our revenue growth and our reputation.

2 unchanged sentences

Moreover, there are inherent risks associated with upgrading, improving, and expanding our information technology systems.

be sure the expansion and improvements to our infrastructure and systems will be fully or effectively implemented on a timely basis, if at all.

We cannot be sure the expansion and improvements to our infrastructure and systems will be fully or effectively implemented on a timely basis, if at all.

These efforts may reduce revenue and our margins and adversely impact our financial results.

6 unchanged sentences

• The market for low-code solutions not continuing to grow or growing more slowly than we expect;

• The introduction of products and technologies that serve as a replacement or substitute for, or represent an improvement over, our platform;

• The introduction of products and technologies (including AI technologies) that serve as a replacement or substitute for, or represent an improvement over, our platform;

• Technological innovations or new standards that our platform does not address;

3 unchanged sentences

Our sales cycle is long and unpredictable, particularly with respect to large customers, and our sales efforts require considerable time and expense, all of which may cause our operating results to fluctuate.

Our operating results may fluctuate, in part, because of the resource-intensive nature of our sales efforts, the length and variability of the sales cycle of our platform, and the difficulty we face in adjusting our short-term operating expenses.

Our operating results depend in part on sales to large customers and promotion of increasing usage by those large customers.

7 unchanged sentences

We believe our future success will depend in large part on growth in the demand for low-code platforms to drive software-enabled digital transformation.

It is difficult to predict customer demand for our platform, renewal rates, the rate at which existing customers expand their subscriptions, the size and growth rate of the market for our platform, the entry of competitive products, or the success of existing competitive products.

It is difficult to predict customer demand for our platform, renewal rates, the rate at which existing customers expand their subscriptions, the size and growth rate of the market for

our platform, the entry of competitive products, or the success of existing competitive products.

The utilization of low-code software to drive digital transformation is still relatively new.

Any expansion in our addressable market depends on a number of factors, including businesses continuing to desire to differentiate themselves through software-enabled digital transformation, increasing their reliance on low-code solutions, changes in the competitive landscape, technological changes, budgetary constraints of our customers, and changes in economic conditions.

Any expansion in our addressable market depends on a number of factors, including businesses continuing to desire to differentiate themselves through software-enabled digital transformation, increasing their reliance on low-code solutions, changes in the competitive landscape, technological changes, including due to advancements in AI, budgetary constraints of our customers, and changes in economic conditions.

If our platform does not achieve widespread adoption or there is a reduction in demand for low-code solutions caused by these factors, it could result in reduced customer purchases, reduced renewal rates, and decreased revenue, any of which will adversely affect our business, operating results, and financial condition.

4 unchanged sentences

ease of use and speed;

utilization of AI;

platform extensibility and ability to integrate with other technology infrastructures;

8 unchanged sentences

(1) providers of custom software and customer software solutions that address, or are developed to address, some of the use cases that can be addressed by applications developed on our platform;

(2) providers of low-code development platforms such as Microsoft, Salesforce.com, ServiceNow, OutSystems, and Mendix;

(2) providers of low-code development platforms;

and (3) providers of one or more automation technologies, including BPM, case management, process mining, and RPA.

Such providers include Pegasystems, Celonis, UiPath, Microsoft, SAP, and Oracle.

Some of our actual and potential competitors have advantages over us such as longer operating histories, more established relationships with current or potential customers and commercial partners, significantly greater financial, technical, marketing, or other resources, stronger brand recognition, larger intellectual property portfolios, and broader global distribution and presence.

Such competitors may make their solutions available at a low cost or no cost basis in order to enhance their overall relationships with current or potential customers.

Our competitors may also be able to respond more quickly and effectively than we can to new or changing opportunities, technologies, standards, or customer requirements.

With the introduction of new technologies and new market entrants, we expect competition to intensify in the future.

Our competitors may also be able to respond more quickly and effectively than we can to new or changing opportunities, technologies, standards, or customer requirements, including with respect to AI.

With the introduction of AI and new market entrants, we expect competition to intensify in the future.

In addition, some of our larger competitors have substantially broader offerings and can bundle competing products with other software offerings.

1 unchanged sentence

These larger competitors are also often in a better position to withstand any significant reduction in capital spending and will therefore not be as susceptible to economic downturns.

If our security measures are actually or perceived to have been breached or unauthorized access to our platform or customer data is otherwise obtained, our platform may be perceived as not being secure, customers may reduce the use of or stop using our platform, and we may incur significant liabilities.

If our security measures are actually or perceived to have been breached, or if unauthorized access to our platform or customer data occurs, our platform may be perceived as not being secure, and customers may reduce the use of or stop using our platform, and we may incur significant liabilities.

Our platform, which can be deployed in the cloud or on-premises, allows for the storage and transmission of our customers’ proprietary or confidential information, which may include trade secrets, personally identifiable information, personal health information, and payment card information.

1 unchanged sentence

While we have security measures in place designed to protect customer information and prevent data loss and other security breaches, there can be no assurance these measures will be effective in protecting against malicious unauthorized access to our platform or our customers’ information.

Similarly, if cyber incidents such as phishing attacks, viruses, denial of service attacks, supply chain attacks, malware installation, ransomware attacks, server malfunction, software or hardware failures, loss of data or other computer assets, adware, or other similar issues impair the integrity or availability of our systems by affecting our data or reducing access to or shutting down one or more of our computing systems or our IT network, we may be subject to negative treatment by our customers, our business partners, the press, and the public at large.

Further, while security tested and techniques are in place and tested by third parties, because the techniques used to obtain unauthorized access or sabotage systems change frequently and generally are not identified until they are launched against a target, we may be unable to anticipate these techniques or to implement adequate preventative measures.

Similarly, if cyber incidents such as phishing

attacks, viruses, denial of service attacks, supply chain attacks, malware installation, ransomware attacks, server malfunction, software or hardware failures, loss of data or other computer assets, adware, or other similar issues impair the integrity or availability of our systems by affecting our data or reducing access to or shutting down one or more of our computing systems or our IT network, we may be subject to negative treatment by our customers, our business partners, the press, and the public at large.

Further, even though we have security measures in place that are tested and verified by third parties, because the techniques used to obtain unauthorized access or sabotage systems change frequently and generally are not identified until they are launched against a target, we may be unable to anticipate these techniques or to implement adequate preventative measures.

Additionally, we may be subject to attacks on our networks or systems or attempts to gain unauthorized access to our proprietary or confidential information or other data we or our vendors maintain such as data about our employees.

Such attacks and other breaches of security may occur as a result of malicious attacks, human error, social engineering, or other causes.

Any actual or perceived breach of our security measures or failure to adequately protect our customers’ or our confidential or proprietary information could negatively affect our ability to attract new customers, cause existing customers to elect to not renew their subscriptions to our software, or result in reputational damage, any of which could adversely affect our operating results.

Any of the foregoing risks may be heightened by our use of AI, and the use of AI may enhance the effectiveness of any of the foregoing threat actors or their attempts to gain unauthorized access to our platform or our or our customers’ confidential, proprietary, or personal information.

Any actual or perceived breach of our security measures or failure to adequately protect our customers’ or our confidential, proprietary, or personal information could negatively affect our ability to attract new customers, cause existing customers to elect to not renew their subscriptions to our software, or result in reputational damage, any of which could adversely affect our operating results.

Further, security compromises experienced by our customers with respect to data hosted on our platform, even if caused by the customer’s own misuse or negligence, may lead to public disclosures, which could harm our reputation, erode customer confidence in the effectiveness of our security measures, negatively impact our ability to attract new customers, or cause existing customers to elect not to renew their subscriptions with us.

1 unchanged sentence

While we maintain general liability insurance coverage and coverage for errors or omissions, we cannot provide assurance such coverage will be adequate or otherwise protect us from liabilities or damages with respect to claims alleging compromises of personal data or that such coverage will continue to be available on acceptable terms or at all.

We derive a material portion of our revenue from a limited number of customers, and the loss of one or more of these customers could adversely impact our business, results of operations, and financial condition.

We derive a material portion of our revenue from a limited number of customers, and the loss of one or more of these customers could materially and adversely impact our business, results of operations, and financial condition.

Our customer base is concentrated.

3 unchanged sentences

Further, nearly 12% of our subscription customers spent more than $1 million on our software in 2023.

If we were to lose one or more of our significant customers, our revenue may significantly decline.

If we were to lose one or more of our significant customers, our revenue would significantly decline.

In addition, revenue from significant customers may vary from period to period depending on the timing of renewing existing agreements or entering into new agreements.

The loss of one or more of our significant customers could adversely affect our business, results of operations, and financial condition.

The loss of one or more of our significant customers could materially and adversely affect our business, results of operations, and financial condition.

A portion of our revenue is generated from subscriptions sold to governmental entities and heavily regulated organizations, which are subject to a number of challenges and risks.

A significant portion of our revenue is generated from subscriptions sold to governmental entities, both in the United States and internationally.

Additionally, many of our current and prospective customers such as those in the financial services, insurance, life sciences, and healthcare industries are highly regulated and may be required to comply with more stringent regulations in connection with subscribing to and implementing our platform.

Selling subscriptions to these entities can be highly competitive, expensive, and time-consuming, often requiring significant upfront time and expense without any assurance we will successfully complete a sale.

Additionally, many of our current and prospective customers such as those in the financial services, life sciences, insurance, and healthcare industries are highly regulated and may be required to comply with more stringent regulations in connection with subscribing to and implementing our platform.

Selling subscriptions to these entities can be highly competitive, expensive, and time-consuming, often requiring significant

upfront time and expense without any assurance we will successfully complete a sale.

In addition, if our software does not meet the standards of new or existing regulations, we may be in breach of our contracts with our customers, allowing them to terminate their agreements.

Governmental demand and payment for our platform may also be impacted by public sector budgetary cycles and funding authorizations, with funding reductions or delays adversely affecting public sector demand for our platform.

Governmental and highly regulated entities impose compliance requirements that are complicated, make pricing readily available, subject continued business to unpredictable competitive processes, or are otherwise time-consuming and expensive to satisfy.

The United States has previously experienced lapses in federal appropriations, and any such future lapses could negatively affect our business, results of operations, and financial condition.

In addition, governmental and highly regulated entities impose compliance requirements that are complicated, make pricing readily available, subject continued business to unpredictable competitive processes, or are otherwise time-consuming and expensive to satisfy.

In the United States, applicable federal contracting regulations change frequently, and the President may issue executive orders requiring federal contractors to adhere to new compliance requirements after a contract is signed.

If we commit to meet special standards or requirements and do not meet them, we could be subject to significant liability from our customers or regulators.

If we commit to meeting special standards or requirements and do not meet them, we could be subject to significant liability from our customers or regulators.

Even if we do meet these special standards or requirements, the additional costs associated with providing our platform to government and highly regulated customers could harm our operating results.

8 unchanged sentences

We also expect our costs to increase in future periods, which could negatively affect our future operating results if our revenue does not increase commensurately.

example, we intend to continue to expend significant funds to expand our sales and marketing operations, develop and enhance our platform, meet the increased compliance requirements associated with our operation as a public company, and expand into new markets.

For example, we intend to continue to expend significant funds to expand our sales and marketing operations, develop and enhance our platform, and expand into new markets.

Our efforts to grow our business may be more costly than we expect, and we may not be able to increase our revenue enough to offset our higher operating expenses.

1 unchanged sentence

If we are unable to achieve and sustain profitability, our stock price may significantly decrease.

AI is a disruptive set of technologies that may affect the markets for our software dramatically and in unpredictable ways.

The emerging technologies described as AI, which include machine learning, application of large language models, generative AI, machine learning models, and similar means of algorithm self-generation and other AI tools have the ability to affect the market for our software by directing what are now human-orchestrated processes into machine-orchestrated processes.

In recent years, AI technologies have been the subject of great interest to our customers and to followers of our markets, and these technologies have been showcased and subject to substantial interest among our customer base.

To the extent that we incorporate or will in the future incorporate AI into our software platform, either directly or through integration with AI technologies, we could benefit greatly from the speed and accuracy presented by those technologies, and it could improve our market position relative to our competitors.

On the other hand, should we either fail to adopt or integrate with AI technologies that show benefits to our customers, or should AI technologies for code generation or application development reduce the demand for our process automation platform, we could struggle to continue to grow our business or lose business with existing customers to such technologies, and this could negatively impact our business performance and results of operations.

We have incorporated, and may continue to incorporate, AI in our products and services, and this incorporation of AI in our business and operations may become more significant over time.

The use of generative AI, a relatively

new and emerging technology in the early stages of commercial use, exposes us to additional risks, such as damage to our reputation, competitive position, and business, legal and regulatory risks and additional costs.

For example, generative AI has been known to produce false or “hallucinatory” inferences or output, and certain generative AI uses machine learning and predictive analytics, which can create inaccurate, incomplete, or misleading content, unintended biases, and other discriminatory or unexpected results, errors or inadequacies, any of which may not be easily detectable by us or any of our related service providers.

As a result, while generative AI may help provide more tailored or personalized experiences or output, if the content, analyses, or recommendations produced by any of our products or services that use or incorporate generative AI are, or are perceived to be, deficient, inaccurate, biased, unethical or otherwise flawed, our reputation, competitive position and business may be materially and adversely affected.

In addition, new laws and regulations, or the interpretation of existing laws and regulations, in any of the jurisdictions we operate in may affect our ability to leverage AI in any of our products and services, and may expose us to government enforcement or civil suits.

As the legal and regulatory framework encompassing AI matures, it may result in increases in our operational and development expenses that impact our ability to develop, earn revenue from or utilize any products or services incorporating AI.

For more information on the legal and regulatory risks associated with the use of AI, please see our risk factor below at “—Regulatory and legislative developments related to the use of AI could adversely affect our use of such technologies in our products, services, and business.” Additionally, if any of our employees, contractors, vendors or service providers use any third-party software incorporating AI in connection with our business or the services they provide to us, it may lead to the inadvertent disclosure or incorporation of our confidential, sensitive or proprietary information into publicly available training sets which may impact our ability to realize the benefit of, or adequately maintain, protect and enforce our intellectual property or sensitive or confidential information, harming our competitive position and business.

Our ability to mitigate risks associated with disclosure of our proprietary, sensitive or confidential information, including in connection with the use of AI, will depend on our implementation, maintenance, monitoring and enforcement of appropriate technical and administrative safeguards, policies and procedures governing the use of AI in our business.

Additionally, any output created by us using generative AI may not be subject to copyright protection which may adversely affect our or our customers’ intellectual property rights in, or ability to commercialize or use, any such content.

In the U.S., a number of civil lawsuits have been initiated related to the foregoing and other concerns, any one of which may, amongst other things, require us to limit the ways in which our AI tools and technologies are trained, refined or implemented, and may affect our ability to develop products or services using or incorporating AI.

While AI-related lawsuits to date have generally focused on certain foundational AI service providers and large language models, our use of any output produced by generative AI may expose us to claims, increasing our risks of liability.

For example, the output produced by generative AI may include information subject to certain privacy or rights of publicity laws or constitute an unauthorized derivative work of the copyrighted material used in training the underlying AI model, any of which may create a risk of liability for us, or adversely affect our business or operations.

In addition, the use of AI has resulted in, and may in the future result in, cybersecurity incidents that implicate the personal data of users of our AI tools or technologies.

To the extent that we do not have sufficient rights to use any data or other material or content produced by generative AI in our business, or if we experience cybersecurity incidents in connection with our use of AI, it could adversely affect our reputation and expose us to legal liability or regulatory risk, including with respect to third-party intellectual property, privacy, publicity, contractual or other rights.

Furthermore, our competitors, customers or other third parties may incorporate AI into their products more quickly or more successfully than us, which could impair our ability to compete effectively.

If any third-party AI tools are trained using or otherwise leverage any of our proprietary data or data sets, our competitive advantage may be impaired, and our ability to commercialize our own AI tools or such data and data sets may be undermined, damaging our operations and business.

The increasing use of generative AI by third parties may also negatively impact the integrity of our own proprietary data, data sets and content databases if and to the extent that any invalid, inaccurate, biased or otherwise flawed data produced by any such AI systems may inadvertently be incorporated in our proprietary data, data sets or content databases, negatively affecting our reputation, and the value of our proprietary data, data sets or content databases.

AI also may impact our business in other ways, including with respect to hiring, employee turnover, our environmental footprint, and research and development costs.

As generative AI and other AI tools are relatively new, sophisticated and evolving quickly, we cannot predict all of the risks that may arise from our current or future use of AI in our business.

Any of the foregoing and any similar issues, whether actual or perceived, could negatively impact our customers’ experience and diminish the perceived quality and value of our products and services.

This in turn could damage our brand, reputation, competitive position, and business.

As the use of AI becomes more prevalent, including in the industries in which we operate, we anticipate that AI will continue to present new or unanticipated ethical, reputational, technical, operational, legal, competitive, and regulatory issues, among others.

We expect that our incorporation of AI in our business will require additional resources, including the incurrence of additional costs, to develop and maintain our AI-related products and services, to minimize potentially harmful or unintended consequences, to comply with applicable and emerging laws and regulations, to maintain or extend our competitive position, and to address any ethical, reputational, technical, operational, legal, competitive or regulatory issues which may arise as a result of any of the foregoing.

As a result, the challenges presented with our use of AI could adversely affect our business, financial condition and results of operations.

Regulatory and legislative developments related to the use of AI could adversely affect our use of such technologies in our products, services, and business.

We use AI, including machine learning and generative AI, throughout our business.

As the regulatory framework for machine learning technology, generative AI and automated decision making evolves, our business, financial condition, and results of operations may be adversely affected.

The regulatory framework for AI and similar technologies, and automated decision making, is changing rapidly.

It is possible that new laws and regulations will be adopted in the United States and in non-U.S.

jurisdictions, or that existing laws and regulations may be interpreted in ways that would affect the operation of our business, including our data analytics products and services and the way in which we use AI and similar technologies in our business.

For example, the European Union’s proposed Artificial Intelligence Act, if enacted in its current form or any similar form, would have a material impact on the way AI is regulated in the EU, including significant fines for violations related to offering prohibited AI systems or data governance, high-risk AI systems and for supplying incorrect, incomplete, or misleading information to EU and member state authorities.

We may not be able to adequately anticipate or respond to these evolving laws and regulations, and we may need to expend additional resources to adjust our products or services in certain jurisdictions if applicable legal frameworks are inconsistent across jurisdictions.

In addition, because these technologies are themselves highly complex and rapidly developing, it is not possible to predict all of the legal or regulatory risks that may arise relating to our use of such technologies.

Further, the cost to comply with such laws or regulations could be significant and would increase our operating expenses, which could adversely affect our business, financial condition and results of operations.

Our future results of operations may fluctuate significantly due to a wide range of factors, which makes our future results difficult to predict.

13 unchanged sentences

• Changes in customers’ budgets;

• Lapses of federal appropriations in the United States for our government customers;

• Seasonal variations related to sales and marketing and other activities such as expenses related to our customers;

3 unchanged sentences

• Unforeseen litigation and intellectual property infringement;

• Any changes in accounting principles generally accepted in the United States, or GAAP;

• Fluctuations in our effective tax rate;

• General economic and political conditions, both domestically and internationally, as well as economic conditions specifically affecting industries in which our customers operate.

our revenue, results of operations, and cash flows may not necessarily be indicative of our future performance, may cause us to miss our guidance or analyst expectations, and may cause our stock price to decline.

Any one of these or other factors discussed elsewhere in this Annual Report on Form 10-K or the cumulative effect of some of these factors may result in fluctuations in our revenue and operating results, meaning quarter-to-quarter comparisons of our revenue, results of operations, and cash flows may not necessarily be indicative of our future performance, may cause us to miss our guidance or analyst expectations, and may cause our stock price to decline.

In addition, we have historically experienced seasonality in terms of when we enter into agreements with customers.

2 unchanged sentences

Furthermore, we usually enter into a significant portion of agreements with customers during the last month, and often the last two weeks, of each quarter.

This seasonality is reflected to a much lesser extent, and sometimes is not immediately apparent, in revenue due to the fact we recognize cloud subscription revenue over the term of the subscription agreement, which is generally one to three years.

This seasonality is reflected to a much lesser extent, and sometimes is not immediately apparent, in revenue due to the fact we recognize cloud subscriptions revenue over the term of the subscription agreement, which is generally one to three years.

We expect seasonality will continue to affect our operating results in the future and may reduce our ability to predict cash flow and optimize the timing of our operating expenses.

5 unchanged sentences

Furthermore, if our publicly announced guidance of future operating results fails to meet our previously announced guidance or the expectations of securities analysts, investors, or other interested parties, the price of our common stock would decline.

If we are unable to successfully transition to new leadership in key departments, our results could suffer.

Appian has undergone change in departments directly responsible for substantially all of Appian's revenue.

While Appian believes its new leaders in these departments are highly qualified and will perform well in their roles, there can be no assurances the transition to new leadership will be executed without any disruption or effect on performance.

New leadership requires time to become familiar with Appian's product offerings and its customer base, and such transition could lead to delayed implementation of strategies, revision of key practices and policies, re-training of personnel, and other disruptions.

While we will make efforts to mitigate such risk through extensive collaboration at the executive level, the effects of this transition could have an impact on our ability to sustain our growth in revenue or our ability to retain existing talent within the organization.

We rely on the performance of highly skilled personnel, including senior management and our engineering, professional services, sales, and technology professionals;

if we are unable to retain or motivate key personnel or hire, retain, and motivate qualified personnel, our business would be harmed.

if we are unable to retain or

motivate key personnel or hire, retain, and motivate qualified personnel, our business would be harmed.

We believe our success has depended, and continues to depend, on the efforts and talents of our senior management team, particularly Matt Calkins, our founder and Chief Executive Officer, and our highly skilled team members, including our sales personnel, professional services personnel, cloud engineering and support personnel, and software engineers.

We do not maintain key man insurance on any of our executive officers or key employees.

We do not maintain key person insurance on any of our executive officers or key employees.

From time to time, there have been and may continue to be changes in our senior management team resulting from the termination or departure of our executive officers and key employees.

1 unchanged sentence

Many of our executive officers and key employees receive equity compensation as a significant portion of their overall compensation package.

A substantial decrease in the market price of our Class A common stock would effectively reduce the compensation of such persons and could increase the risk they depart from our company.

A substantial decrease in the market price of our Class A common stock would effectively reduce the compensation of such persons.

The loss of any of our senior management or key employees, particularly Mr.

2 unchanged sentences

Our ability to successfully pursue our growth strategy also depends on our ability to attract, motivate, and retain our personnel.

Competition for well-qualified employees in all aspects of our business, including sales personnel, professional services personnel, cloud engineering and support personnel, and software engineers, is intense.

Competition for highly-qualified employees in all aspects of our business, including sales personnel, professional services personnel, cloud engineering and support personnel, and software engineers, is intense.

As a result of the COVID-19 pandemic, many more employers allowed remote work, which resulted in the market for employee talent becoming more national and some employees preferring remote work.

As we have chosen to return to office-based work over time to benefit from the better culture and productivity we believe in-office work affords, we may not be able to attract and retain employees who would choose to work remotely, while we also still face hiring competition from companies with remote-based workforces who can hire without respect to office location.

Our continued ability to compete effectively depends on our ability to attract new employees and to retain and motivate existing employees.

Further, a small portion of our employees are immigrants to the United States or foreign nationals holding visas.

If immigration to the United States is further restricted by the federal government, we might lose existing employees who are unable to remain in the United States and our pool of qualified applicants might also be diminished, thereby hampering our recruiting efforts.

If we do not succeed in attracting well-qualified employees or retaining and motivating existing employees, our business would be adversely affected.

If we do not continue to innovate and provide a platform that is useful to our customers, we may not remain competitive, and our revenue and operating results could suffer.

Our success depends on continued innovation to provide features that make our platform useful for our customers, our ability to persuade existing customers to expand their use of our platform to additional use cases and additional applications, and to purchase additional software licenses to our platform.

Our success depends on continued innovation to provide features that make our platform useful for our customers, including with respect to developments in AI, our ability to persuade existing customers to expand their use of our platform to additional use cases and additional applications, and to purchase additional software licenses to our platform.

We must continue to invest significant resources in research and development in order to continually improve the speed and power of our platform.

2 unchanged sentences

We may need to reduce or change our pricing model to remain competitive.

The market for our platform is still evolving, and competitive dynamics may cause pricing levels to change as the market matures and as existing and new market participants introduce new types of solutions and different approaches to enable customers to address their needs.

As a result, we may be forced to reduce the prices we charge for software and may be required to offer terms less favorable to us for new and renewing agreements.

We generally sell our software on a per-user basis or through non-user-based single application licenses.

3 unchanged sentences

Moreover, mid- to large-size enterprises may demand substantial price discounts as part of the negotiation of sales contracts.

As a result, we may be required or choose to reduce our prices or change our pricing model, which could adversely affect our business, operating results, and financial condition.

As a result, we may be required or choose to reduce our

prices or change our pricing model, which could adversely affect our business, operating results, and financial condition.

Our business could be adversely affected if our customers are not satisfied with the deployment services provided by us or our partners.

8 unchanged sentences

For 2023, 2022, and 2021, approximately 75.6%, 72.7%, and 71.4%, respectively, of our total revenue was subscriptions revenue.

As a result, we may be forced to reduce the prices we charge for software and may be required to offer terms less favorable to us for new and renewing agreements.

In order for us to improve our operating results, it is important our customers renew their subscriptions with us when their initial term expires, as well as purchase additional subscriptions from us.

8 unchanged sentences

Such declines, however, would negatively affect our revenue, and to a lesser extent, deferred revenue balance in future periods, and the effect of significant downturns in sales and market acceptance of our platform and potential changes in our rate of renewals may not be fully reflected in our results of operations until future periods.

We may not achieve market acceptance of our pre-built solutions, which may adversely impact our financial results.

We have been developing and releasing pre-built solutions on our software platform in order to maximize the value of our platform to our customers and to reduce the sales cycles associated with software sales to new and existing customers.

Each solution requires an investment in development, marketing, sales, support, finance, and legal resources to bring the solution to market.

Although we make efforts to identify the solutions that will receive

favorable market acceptance, there can be no guarantee any solution will become the source of material revenue, and the investment in the solution may not produce a positive return.

If unsuccessful, such solutions may adversely impact our financial results to the extent our expenses increase without any increase in sales or to the extent attempted sales of such solutions reduce sales of our existing platform.

If we are not able to maintain and enhance our brand, our business and operating results may be adversely affected.

21 unchanged sentences

We also provide frequent incremental releases of software updates and functional enhancements to our platform.

Despite extensive pre-release testing, such new versions occasionally contain undetected errors when first introduced or released.

Despite extensive pre-release testing, such new versions occasionally contain undetected errors when first

introduced or released.

We have, from time to time, found errors in our software, and new errors in our existing software may be detected in the future.

7 unchanged sentences

AWS runs its own platform we access, and we are, therefore, vulnerable to service interruptions at AWS.

We may experience interruptions, delays, and outages in service and availability from time to time as a result of problems with our AWS provided infrastructure, which could render our cloud offering inaccessible to customers.

We may experience material interruptions, delays, and outages in service and availability from time to time as a result of problems with our AWS provided infrastructure, which could render our cloud offering inaccessible to customers.

Additionally, AWS has suffered outages at specific customer locations in the past, rendering the customer unable to access our offering for periods of time.

19 unchanged sentences

In 2023, 2022, and 2021, revenue generated from customers outside the United States was 35.8%, 33.5%, and 34.0%, respectively, of our total revenue.

We currently operate in Canada, Switzerland, the United Kingdom, France, Germany, the Netherlands, Italy, Australia, Spain, Singapore, Sweden, Japan, Mexico, and India.

We currently operate in Canada, Switzerland, the United Kingdom, France, Germany, the Netherlands, Italy, Australia, Spain, Singapore, Sweden, Japan, Mexico, India, and Portugal.

In the future, we may expand to other international locations.

23 unchanged sentences

If we are unable to obtain adequate financing or financing on terms satisfactory to us when we require it, our ability to continue to support our business growth and to respond to business challenges could be significantly impaired, and our business may be adversely affected.

We have obtained a substantial judgment against our competitor, Pegasystems, for willful and malicious trade secret misappropriation, and elements of our ability to obtain payment with respect to that judgment are subject to risk.

On May 9, 2022, a jury returned a verdict that Pegasystems, Inc., willfully and maliciously misappropriated trade secrets from us and awarded us $2.036 billion in damages for Pegasystems’ unjust enrichment for usage of our trade secrets.

A judge entered a final judgment on that verdict on September 15, 2022 and further granted us $23.6 million in attorney’s fees as well as statutory post-judgment interest at an annual rate of 6%, or approximately $122.0 million per year.

Pegasystems has appealed the final judgment to the Virginia Court of Appeals, and the appeal is pending.

In September 2023, we obtained a judgment preservation insurance policy that would pay us up to $500.0 million in coverage to the extent the final judgment were reversed or reduced after all appeals and further litigation are exhausted.

While we believe strongly the final judgment should be upheld, we cannot guarantee it will be upheld in its entirety or in part.

In addition, while Pegasystems has made public assurances that it could raise the funds necessary to pay the judgment, it does not currently have the cash necessary to satisfy the full amount of the final judgment, and we would be at risk of having to collect a substantial judgment as a creditor if Pegasystems is unable to raise the necessary funds when and if the final judgment becomes enforceable.

Finally, as with any insurance policy, our ability to collect judgment preservation insurance proceeds is subject to the financial soundness of the insurers underwriting our policy, as well as any denial of coverage under the policy.

While we have not included any payment from Pegasystems or insurance proceeds in our financial statements or operational planning, any failure to collect on all or a portion of the judgment or the insurance proceeds may be viewed negatively and our stock price could decline.

We maintain cash deposits in excess of federally insured limits.

Adverse developments affecting financial institutions, including bank failures, could adversely affect our liquidity and financial performance.

We regularly maintain domestic cash deposits in banks insured by the Federal Deposit Insurance Corporation (the “FDIC”) that exceed the FDIC insurance limits.

Bank failures, events involving limited liquidity, defaults, non-performance or other adverse developments that affect financial institutions, or concerns or rumors about such events, may lead to liquidity constraints.

For example, on March 10, 2023, Silicon Valley Bank (“SVB”) was closed by the California Department of Financial Protection and Innovation, and the FDIC was appointed receiver of SVB.

If other banks and financial institutions enter receivership or become insolvent in the future due to financial conditions affecting the banking system and financial markets, our ability to access our cash, cash equivalents, and investments, including transferring funds, making payments, or receiving funds may be threatened and could have a material adverse effect on our business and financial condition.

There can be no assurance our deposits in excess of the FDIC or other comparable insurance limits will be backstopped by the U.S.

government or that any bank or financial institution with which we do business will be able to obtain needed liquidity from other banks, government institutions, or by acquisition in the event of a failure or liquidity crisis.

Pursuant to the terms of our outstanding indebtedness, we may be limited in our ability to incur future debt.

In November 2022, we entered into a Senior Secured Credit Facilities Credit Agreement (as amended from time to time, the “Credit Facility”) with the several banks and other financial institutions or entities from time to time parties to the Credit Facility, as lenders, and Silicon Valley Bank, as administrative agent and collateral agent for the lenders, which provides for a five-year term loan facility in an aggregate principal amount of $120.0 million and up to $60.0 million for a revolving credit facility, including a letter of credit sub-facility in the aggregate availability amount of $15.0 million and a swingline sub-facility in the aggregate availability amount of $10.0 million (as a sublimit of the revolving loan facility).

Our obligations under the Credit Facility are secured by substantially all of our assets.

Pursuant to the terms of the Credit Facility, we are limited in our ability to incur additional indebtedness other than on the terms and conditions thereof.

In addition, a failure to comply with the covenants under the Credit Facility could result in an event of default by us and an acceleration of amounts due.

We have a Senior Secured Credit Facilities Credit Agreement (as amended from time to time, the “Credit Agreement”) with the several banks and other financial institutions or entities from time to time parties to the Credit Agreement, as lenders, and First Citizen Bank & Trust Company, as administrative agent and collateral agent for the lenders, which as of December 31, 2023, provides for a five-year term loan facility in an aggregate principal amount of $150.0 million and up to $75.0 million for a revolving credit facility, including a letter of credit sub-facility in the aggregate availability amount of $15.0 million and a swingline sub-facility in the aggregate availability amount of $10.0 million (as a sublimit of the revolving loan facility).

Our obligations under the Credit Agreement are secured by substantially all of our assets.

Pursuant to the terms of the Credit Agreement, we are limited in our ability to incur additional indebtedness other than on the terms and conditions thereof.

In addition, a failure to comply with the covenants under the Credit Agreement could result in an event of default by us and an acceleration of amounts due.

If an event of default occurs that is not waived by the lenders, and the lenders accelerate any amounts due, we may not be able to make accelerated payments, and the lender could seek to enforce their security interests in the collateral securing such indebtedness, which could have a material adverse effect on our business and results of operations.

We may not achieve market acceptance of our pre-built solutions, which may adversely impact our financial results.

Each solution requires an investment in development, marketing, sales, support, finance, and legal resources to bring the solution to market.

Although we make efforts to identify the solutions that will receive favorable market acceptance, there can be no guarantee any solution will become the source of material revenue, and the investment in the solution may not produce a positive return.

If currency exchange rates fluctuate substantially in the future, our financial results, which are reported in U.S.

3 unchanged sentences

A strengthening of the U.S.

dollar could reduce the dollar value of revenue generated by our customers outside of the United States, adversely affecting our business operations

and financial results.

dollar could reduce the dollar value of revenue generated by our customers outside of the United States, adversely affecting our business operations and financial results.

We incur expenses for employee compensation and other operating expenses at our non-U.S.

12 unchanged sentences

The functionality and attractiveness of our platform depends, in part, on our ability to integrate our platform with third-party applications and platforms, including customer relationship management, human resources information, accounting, and enterprise resource planning systems our customers use and from which they obtain data.

Third-party providers of applications and APIs may change the features of their applications and platforms, restrict our access to their applications and platforms, or alter the terms governing use of their applications and APIs and access to those applications and platforms in an adverse manner.

Third-party providers of applications and application programming interfaces, or APIs, may change the features of their applications and platforms, restrict our access to their applications and platforms, or alter the

terms governing use of their applications and APIs and access to those applications and platforms in an adverse manner.

Such changes could functionally limit or terminate our ability to use these third-party applications and platforms in conjunction with our platform, which could negatively impact our offerings and harm our business.

6 unchanged sentences

In the event of a major hurricane, earthquake, or catastrophic event such as fire, power loss, telecommunications failure, cyberattack, outbreak of regional or global pandemic diseases, war, or terrorist attack, we may be unable to continue our operations and may endure system interruptions, reputational harm, delays in our software development, lengthy interruptions in our services, breaches of data security, and loss of critical data, all of which could have an adverse effect on our future operating results.

Adverse economic conditions may negatively impact our business.

Adverse economic conditions abroad may negatively impact our business.

Our business depends on the overall demand for enterprise software and on the economic health of our current and prospective customers.

The economies of countries in Europe have been experiencing weakness associated with high sovereign debt levels, weakness in the banking sector, and uncertainties surrounding the future of the Euro zone.

The economies of countries in Europe have experienced weakness from time to time in the recent past and may experience weakness in the future.

We have operations in the United Kingdom and in Europe and current and potential new customers in Europe.

If economic conditions in Europe and other key markets for our platform continue to remain uncertain or deteriorate further, many customers may delay or reduce their information technology spending.

If economic conditions in Europe and other key markets for our platform weaken or deteriorate, many customers may delay or reduce their information technology spending.

This could result in reductions in sales of our platform, a decrease in our renewal rate, longer sales cycles, reductions in subscription duration and value, slower adoption of new technologies, and increased price competition.

24 unchanged sentences

Enforcement actions and sanctions could harm our business, reputation, results of operations, and financial condition.

Because our software could be used to collect and store personal information, domestic and international privacy and security concerns could result in additional costs and liabilities to us or inhibit sales of our software and subject us to complex and evolving federal, state, and foreign laws and regulations regarding privacy, data protection, and other related matters.

Because we collect and store personal information, domestic and international privacy and security concerns could result in additional costs and liabilities to us, inhibit sales of our software, and subject us to complex and evolving federal, state, and foreign laws and regulations regarding privacy, data protection, and other related matters.

Personal privacy has become a significant issue in the United States and in many other countries where we offer our software for sale.

The regulatory framework for privacy issues worldwide is rapidly evolving and is likely to remain uncertain for the foreseeable future.

Many federal, state, and foreign government bodies and agencies have adopted or are considering

adopting laws and regulations regarding the collection, use, storage, and disclosure of personal information and breach notification procedures.

Interpretation of these laws, rules, and regulations and their application to our software and professional services in the United States and foreign jurisdictions is ongoing and cannot be fully determined at this time.

In the United States, these include rules and regulations promulgated under the authority of the Federal Trade Commission, the Electronic Communications Privacy Act, the Computer Fraud and Abuse Act, the Health Insurance Portability and Accountability Act of 1996, the Gramm Leach Bliley Act, the California Consumer Privacy Act, or the CCPA, and other state laws relating to privacy and data security.

The CCPA, which became effective on January 1, 2020, drastically changes the ability for individuals to control the use of their personal data.

It contains detailed requirements regarding collecting and processing personal information, imposes certain limitations on how such information may be used, and provides rights to consumers that have never before been available, all of which may be imposed on us by our customers.

This could increase our costs of doing business.

Further, the California Privacy Rights Act, or CPRA, which became effective on January 1, 2023, has significantly modified the CCPA, including by expanding consumers’ rights with respect to certain sensitive personal information.

The CPRA also created a new state agency, the California Privacy Protection Agency, or CPPA, that is vested with authority to implement and enforce the CCPA and the CPRA.

An increasing number of countries and U.S.

states have enacted comprehensive privacy laws, and many are considering adopting additional laws, rules, regulations, and industry standards regarding the collection, use, storage, or other processing of data.

Interpretation of these laws, rules, and regulations and their application to our software and professional services, as well as to our corporate and marketing activities in the United States and foreign jurisdictions, is ongoing and cannot be fully determined at this time.

In the United States, these include rules and regulations promulgated under the authority of the Federal Trade Commission, the Electronic Communications Privacy Act, the Computer Fraud and Abuse Act, the Health Insurance Portability and Accountability Act of 1996, the Gramm Leach Bliley Act, the California Consumer Privacy Act (as modified by the California Privacy Rights Act), or the CCPA, and other state laws relating to privacy and data security.

The CCPA contains detailed requirements regarding collecting and processing personal information, imposes certain limitations on how such information may be used, and provides rights to consumers that have never before been available, all of which may be imposed on us by our customers.

Further, the CCPA expands consumers’ rights with respect to certain sensitive personal information.

Some state laws may be more stringent or broader in scope or offer greater individual rights with respect to confidential, sensitive, and personal information than federal, international, or other state laws, and such laws may differ from each other, which may complicate compliance efforts.

New legislation proposed or enacted in various other states will continue to shape the data privacy environment nationally.

For example, Virginia passed the Consumer Data Protection Act, which became effective on January 1, 2023 and Colorado passed the Colorado Privacy Act, which becomes effective July 1, 2023, both of which differ from the CPRA.

Some of these state laws may be more stringent or broader in scope, or offer greater individual rights, with respect to confidential, sensitive, and personal information than federal, international, or other state laws, and such laws may differ from each other, which may complicate compliance efforts.

Internationally, the European Union has adopted a comprehensive and evolving general data protection regulation, or the GDPR, which contains numerous requirements related to rights of data subjects in their personal data, including more robust obligations on data processors and heavier documentation requirements for data protection compliance programs by companies in general.

In addition, absent appropriate safeguards or other circumstances, the EU GDPR generally restricts the transfer of personal data to non-adequate countries outside of the European Economic Area, or EEA, such as the United States, which the European Commission does not consider to provide an adequate level of data privacy and security.

The European Commission released a revised set of “Standard Contractual Clauses” in June 2021 that are designed to be a valid mechanism by which entities can transfer personal data out of the EEA to jurisdictions that the European Commission has not found to provide an adequate level of protection.

Currently, these new Standard Contractual Clauses are a valid mechanism to transfer personal data outside of the EEA.

The revised Standard Contractual Clauses, however, require parties relying upon that legal mechanism to comply with additional obligations, such as conducting transfer impact assessments to determine whether additional security measures are necessary to protect the at-issue personal data.

Moreover, due to potential legal challenges, there exists some uncertainty regarding whether the new Standard Contractual Clauses will remain a valid mechanism for transfers of personal data out of the EEA.

Similarly, following Brexit, we are subject to the U.K.

General Data Protection Regulation, or U.K.

GDPR, a version of the GDPR as implemented into U.K.

law that combines the GDPR and the U.K.

Data Protection Act of 2018.

U.K.-based data exporters are required to use the International Data Transfer Agreement, or IDTA, and the International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses, or the U.K.

Addendum, as mechanisms to comply with the U.K.

GDPR when making restricted international transfers of personal data.

Virtually every jurisdiction in which we operate has established its own data security and privacy legal framework with which we or our customers must comply.

Since we are agnostic as to the data uploaded into our cloud offering by our cloud offering customers or processed by our platform in on-premises deployments, we may be hosting or otherwise processing substantial amounts of individually identifiable health information and other types of personally identifiable information.

The effects of any of this legislation, and future changes to interpretations of this legislation, could be potentially far-reaching and may require us to modify our data management practices and to incur substantial expense in an effort to comply.

In addition, absent appropriate safeguards or other circumstances, the GDPR generally restricts the transfer of personal data to non-adequate countries and/or organizations outside of the European Economic Area, or EEA, such as India, Australia, and non-certified organizations in the United States, which the European Commission does not consider to provide an adequate level of data privacy and security.

In July 2023, the new EU-US Data Privacy Framework (“EU-US DPF”), the replacement for the invalidated EU-US Privacy Shield, came into force, allowing U.S.

businesses to become certified as adequate for the purposes of data transfers from the EEA, no longer always necessitating the signature of “Standard Contractual Clauses.” The EU-US DPF, however, still requires parties relying upon that legal mechanism to comply with obligations similar to those required under the Standard Contractual Clauses such as conducting transfer impact assessments to determine whether additional security measures are necessary to protect the at-issue personal data.

Appian is currently certified under the new EU-US Data Privacy Framework.

However, due to potential legal challenges, there exists some uncertainty regarding whether the new EU-US DPF or the Standard Contractual Clauses will remain a valid mechanism for transfers of personal data out of the EEA.

Additionally, new EU legislation which came into force in 2023 such as the Digital Services Act (impacting online advertising), the Digital Markets Act (impacting those providing core platform services), the Data Governance Act (impacting public sector data), and the NIS2 Directive (cybersecurity) impact our own activities, those of our regulated and public sector customers, and those of our significant partners such as AWS.

While the U.K., following Brexit, is currently considered to hold adequacy for the purposes of data transfers from the EEA, proposed changes to U.K.

privacy legislation may impact the U.K.’s adequacy standing.

The UK’s Data Protection Act of 2018 as supplemented by the GDPR and as implemented into UK law (collectively, “UK GDPR”) imposes similar, stringent data protection requirements to the GDPR.

While the UK GDPR currently imposes substantially the same obligations as the GDPR, the UK GDPR will not automatically incorporate changes to the GDPR going forward (which would need to be specifically incorporated by the UK government).

Moreover, the UK government has publicly announced plans to reform the UK GDPR in ways that, if formalized, are likely to deviate from the GDPR, all of which creates a risk of divergent parallel regimes and related uncertainty, along with the potential for increased compliance costs and risks for affected businesses.

Virtually every jurisdiction or regulated industry in which we operate has established its own data security and privacy legal framework with which we or our customers must comply.

Since we operate across a variety of industries, we may be hosting or otherwise processing substantial amounts of sensitive or otherwise regulated personal information such as identifiable health information.

The effects of any of this legislation and future changes to interpretations of this legislation could be potentially far-reaching and will require us to modify our data management practices and to incur substantial expense in an effort to comply.

In addition to government regulation, privacy advocates and industry groups may propose new and different self-regulatory standards that may apply to us.

1 unchanged sentence

If so, in addition to the possibility of fines, lawsuits, and other claims, we could be required to fundamentally change our business activities and practices or modify our software, which could have an adverse effect on our business.

Any inability to adequately

address privacy or cybersecurity concerns, even if unfounded, or comply with applicable privacy or data protection laws, regulations, and policies, could result in additional cost and liability to us, damage our reputation, inhibit sales, and adversely affect our business.

Any inability to adequately address privacy or cybersecurity concerns, even if unfounded, or comply with applicable privacy or data protection laws, regulations, and policies could result in additional cost and liability to us, damage our reputation, inhibit sales, and adversely affect our business.

Furthermore, the costs of compliance with, and other burdens imposed by, the laws, regulations, and policies applicable to the businesses of our customers may limit the use and adoption of, and reduce the overall demand for, our platform.

14 unchanged sentences

In addition, the use of the internet as a business tool could be adversely affected due to delays in the development or adoption of new standards and protocols to handle increased demands of internet activity, security, reliability, cost, ease of use, accessibility, and quality of service.

The performance of the internet and its acceptance as a business tool have been adversely affected by viruses, worms, and similar malicious programs, along with distributed denial of service, or DDoS, and similar attacks.

As a result, the internet has experienced a variety of outages and other delays as a result of such damage to or attacks on portions of its infrastructure.

9 unchanged sentences

We can be held liable for the corrupt or other illegal activities of these third-party representatives, our employees, contractors, and other agents, even if we do not explicitly authorize such activities.

In addition, although we have

implemented policies and procedures to ensure compliance with anti-corruption laws, there can be no assurance all of our employees, representatives, contractors, or agents will comply with these laws at all times.

In addition, although we have implemented policies and procedures to ensure compliance with anti-corruption laws, there can be no assurance all of our employees, representatives, contractors, or agents will comply with these laws at all times.

Non-compliance with these laws could subject us to whistleblower complaints, investigations, sanctions, settlements, prosecution, other enforcement actions, disgorgement of profits, significant fines, damages, other civil and criminal penalties or injunctions, suspension and/or debarment from contracting with certain persons, the loss of export privileges, reputational harm, adverse media coverage, and other collateral consequences.

6 unchanged sentences

We are subject to governmental export and import controls and economic and trade sanctions that could impair our ability to conduct business in international markets and subject us to liability if we are not in compliance with applicable laws and regulations.

The United States and other countries maintain and administer export and import laws and regulations, including various economic and trade sanctions such as those administered by the Office of Foreign Assets Control, or OFAC, which apply to our business.

We are required to comply with these laws and regulations.

19 unchanged sentences

To safeguard these rights, we rely on a combination of patent, trademark, copyright, and trade secret laws and contractual protections in the United States and other jurisdictions, all of which provide only limited protection and may not now or in the future provide us with a competitive advantage.

As of December 31, 2022, we had 11 issued patents and six pending patent applications related to our platform and its technology.

As of December 31, 2023, we had 16 issued patents and nine pending patent applications related to our platform and its technology.

We have registered the “Appian” name and logo in the United States and certain other countries.

20 unchanged sentences

The litigation may involve patent holding companies or other adverse patent owners that have no relevant product revenue and against which our patents may therefore provide little or no deterrence.

In the past, we have been subject to allegations of patent infringement that were unsuccessful, and we may in the future be subject to claims we have

misappropriated, misused, or infringed other parties’ intellectual property rights, and, to the extent we gain greater market visibility or face increasing competition, we face a higher risk of being the subject of intellectual property infringement claims, which is not uncommon with respect to enterprise software companies.

In the past, we have been subject to allegations of patent infringement that were unsuccessful, and we may in the future be subject to claims we have misappropriated, misused, or infringed other parties’ intellectual property rights, and, to the extent we gain greater market visibility or face increasing competition, we face a higher risk of being the subject of intellectual property infringement claims, which is not uncommon with respect to enterprise software companies.

We also generally grant our customers ownership of any custom applications we develop for them, subject to our continued ownership of our pre-existing intellectual property rights and, in the past, a customer for whom we have developed custom applications has incorrectly alleged applications we have independently developed infringed the customer’s intellectual property rights.

12 unchanged sentences

Any of these results would adversely affect our business, results of operations, financial condition, and cash flows.

Further, our use of AI technologies internally and implemented as part of our platform may expose us to additional risks regarding our intellectual property.

For more information on the legal and regulatory risks associated with the use of AI, please see our risk factors above at “—AI is a disruptive set of technologies that may affect the markets for our software dramatically and in unpredictable ways,” and “—Regulatory and legislative developments related to the use of AI could adversely affect our use of such technologies in our products, services, and business.”

Portions of our platform utilize open source software, and any failure to comply with the terms of one or more of these open source licenses could negatively affect our business.

Our software contains software licensed to us by third parties under so-called “open source” licenses, including the GNU Lesser General Public License, the BSD License, and others.

From time to time, there have been claims against companies that distribute or use open source software in their products and services, asserting such open source software infringes the claimants’ intellectual property rights.

From time to time, there have been claims

against companies that distribute or use open source software in their products and services, asserting such open source software infringes the claimants’ intellectual property rights.

We could be subject to suits by parties claiming what we believe to be licensed open source software infringes their intellectual property rights.

7 unchanged sentences

Risks Related to Tax and Accounting Matters

If our estimates or judgments relating to our critical accounting policies prove to be incorrect, our results of operations could be adversely affected.

If our estimates or judgments relating to our critical accounting estimates prove to be incorrect, our results of operations could be adversely affected.

The preparation of consolidated financial statements in conformity with GAAP requires management to make estimates and assumptions that affect the amounts reported in the consolidated financial statements and accompanying notes.

We base our estimates on historical experience and on various other assumptions we believe to be reasonable under the circumstances, as provided in Part II, Item 7, “Management’s Discussion and Analysis of Financial Condition and Results of Operations” of this Annual Report on Form 10-K.

The results of these estimates form the basis for making judgments about the carrying values of assets, liabilities, and equity as well as the amount of revenue and expenses.

Significant assumptions and estimates used in preparing our consolidated financial statements include those related to revenue recognition, income taxes and the related valuation allowance, stock-based compensation, impairment of goodwill and long-lived assets, and business combinations.

Our results of operations may be adversely affected if our assumptions change or if actual circumstances differ from those in our assumptions, which could cause our results of operations to fall below the expectations of securities analysts and investors, resulting in a decline in the trading price of our Class A common stock.

The results of these estimates form the basis for making judgments about the amount of revenue.

Significant assumptions and estimates used in preparing our consolidated financial statements include those related to revenue recognition.

Our results of operations may be adversely affected if our assumptions change or if actual circumstances differ from those in our assumptions in our critical accounting policies, which could cause our results of operations to fall below the expectations of securities analysts and investors, resulting in a decline in the trading price of our Class A common stock.

Our operating results may be negatively affected by additional tax liabilities.

18 unchanged sentences

As of December 31, 2023, we also had gross foreign NOLs of $192.3 million, primarily at our Swiss subsidiary, Appian Software International.

We had gross foreign NOL expirations of $8.1 million in 2022, and a piece of our foreign NOLs will

continue to expire each year if unutilized.

As of December 31, 2023, we had tax-effected Swiss NOLs of $21.8 million.

We also had tax-effected Swiss NOL expirations of $1.1 million in 2023, and a piece of our foreign NOLs will continue to expire each year if unutilized.

If we are limited in our ability to use our NOLs in future years in which we have taxable income, we will pay more taxes than if we were able to fully utilize our NOLs.

This could adversely affect our operating results and the market price of our Class A common stock.

Forecasting our estimated annual effective tax rate for financial accounting purposes is complex and subject to uncertainty, and there may be material differences between our forecasted and actual tax rates.

Forecasts of our income tax position and effective tax rate for financial accounting purposes are complex and subject to uncertainty because our income tax position for each year combines the effects of a mix of profits earned and losses incurred by us in various tax jurisdictions with a broad range of income tax rates, as well as changes in the valuation of deferred tax assets and liabilities, the impact of various accounting rules and changes to these rules and tax laws, the results of examinations by various tax authorities, and the impact of any acquisition, business combination, or other reorganization or financing transaction.

To forecast our global tax rate, we estimate our pre-tax profits and losses by jurisdiction and forecast our tax expense by jurisdiction.

If the mix of profits and losses, our ability to use tax credits, or effective tax rates by jurisdiction is different than those estimated, our actual tax rate could be materially different than forecasted, which could have a material impact on our results of business, financial condition, and results of operations.

We are obligated to develop and maintain proper and effective internal controls over financial reporting, and any failure to maintain the adequacy of these internal controls may adversely affect investor confidence in our company and, as a result, the value of our Class A common stock.

8 unchanged sentences

Any failure to maintain internal control over financial reporting could severely inhibit our ability to accurately report our financial condition or results of operations.

If we are unable to conclude our internal control over financial reporting is effective, or if our independent registered public accounting firm determines we have a material weakness in our internal control over financial reporting, we could lose investor confidence in the accuracy and completeness of our financial reports, the market price of our Class A common stock could decline, and we could be subject to sanctions or investigations by the Nasdaq Stock Market, the SEC, or other regulatory authorities.

If we are unable to conclude our internal control over financial reporting is effective, or if our independent registered public accounting firm determines we have a material weakness in our internal control over financial reporting, we could lose investor confidence in the accuracy and completeness of our financial reports, the market price of our Class A common stock could decline, and we could be subject to sanctions or investigations by the Nasdaq Global Market, the SEC, or other regulatory authorities.

Failure to remedy any material weakness in our internal control over financial reporting or to implement or maintain other effective control systems required of public companies could also restrict our future access to the capital markets.

4 unchanged sentences

Given the greater number of votes per share attributed to our Class B common stock, our Class B stockholders collectively beneficially owned shares representing approximately 88% of the voting power of our outstanding capital stock as of December 31, 2023.

Calkins, our founder and Chief Executive Officer, together with his affiliates, collectively beneficially owned

shares representing approximately 81% of the voting power of our outstanding capital stock as of December 31, 2022.

Calkins, our founder and Chief Executive Officer, together with his affiliates, collectively beneficially owned shares representing approximately 81% of the voting power of our outstanding capital stock as of December 31, 2023.

Consequently, Mr.

14 unchanged sentences

We have never declared or paid any cash dividends on our common stock, and we do not intend to pay any cash dividends in the foreseeable future.

Although we paid a cash dividend in connection with the conversion of our Series A preferred stock to Class B common stock immediately prior to the closing of the IPO, which was agreed to at the time of the original issuance of the Series A preferred stock, we anticipate we will retain all of our future earnings for use in the development of our business and for general corporate purposes.

Additionally, our ability to pay dividends on our common stock is limited by restrictions under the terms of our credit agreement with Silicon Valley Bank.

We anticipate we will retain all of our future earnings for use in the development of our business and for general corporate purposes.

Additionally, our ability to pay dividends on our common stock is limited by restrictions under the terms of our Credit Agreement.

Any determination to pay dividends in the future will be at the discretion of our Board of Directors.

6 unchanged sentences

Our amended and restated certificate of incorporation designates the Court of Chancery of the State of Delaware as the exclusive forum for certain litigation that may be initiated by our stockholders, which could limit our stockholders’ ability to obtain a favorable judicial forum for disputes with us and limit the market price of our Class A common stock.

provision of the Delaware General Corporation Law, our amended and restated certificate of incorporation, or our amended and restated bylaws, or (4) any action asserting a claim governed by the internal affairs doctrine.

Pursuant to our amended and restated certificate of incorporation, unless we consent in writing to the selection of an alternative forum, the Court of Chancery of the State of Delaware will be the sole and exclusive forum for (1) any derivative action or proceeding brought on our behalf, (2) any action asserting a claim of breach of a fiduciary duty owed by any of our directors, officers, or other employees to us or our stockholders, (3) any action asserting a claim arising pursuant to any provision of the Delaware General Corporation Law, our amended and restated certificate of incorporation, or our amended and restated bylaws, or (4) any action asserting a claim governed by the internal affairs doctrine.

Our amended and restated certificate of incorporation also provides the federal district courts of the United States of America will be the exclusive forum for resolving any complaint asserting a cause of action arising under the Securities Act.

3 unchanged sentences

Unfavorable conditions in the global economy or the vertical markets we serve could limit our ability to grow our business and negatively affect our operating results.

General worldwide economic conditions have experienced significant instability due to the global economic uncertainty and financial market conditions caused by the COVID-19 pandemic and the ongoing Russia-Ukraine war.

In addition, inflation rates have recently risen to historically high levels.

General worldwide economic conditions have experienced significant instability due to the global economic uncertainty and financial market conditions caused by the ongoing Russia-Ukraine war and unrest in the Middle East.

In addition, inflation rates in the recent past rose to historically high levels.

The existence of inflation in the U.S.

3 unchanged sentences

Historically, economic downturns have resulted in overall reductions in software spending.

If macroeconomic conditions deteriorate or are characterized by uncertainty or volatility, customers may curtail or freeze spending on software in general and for software such as ours specifically, which could have an adverse impact on our business, financial condition, and operating results.

We have historically generated a majority of our revenue from customers in the financial services, government, and life sciences verticals.

While these verticals have not been affected as severely by weak economic conditions as the retail, hospitality, and entertainment industries, we cannot provide assurance these verticals will not suffer more severe losses in the future.

If macroeconomic conditions deteriorate or are characterized by uncertainty or volatility,

customers may curtail or freeze spending on software in general and for software such as ours specifically, which could have an adverse impact on our business, financial condition, and operating results.

Furthermore, we cannot predict the timing, strength, or duration of any economic slowdown or recovery.

In addition, even if the overall economy is robust, we cannot provide assurance the market for services such as ours will experience growth or that we will experience growth.

In addition, even if the overall economy is robust, we cannot provide assurances that the market for services such as ours will experience growth or that we will experience growth.

Our stock price has been volatile and may be volatile in the future.

26 unchanged sentences

Unresolved Staff Comments.

Cybersecurity.

Cybersecurity Risk Management

As part of our overall risk management system, we have established certain procedures to assess, identify, and manage material risks from cybersecurity threats.

Our cybersecurity risk management system is designed to align with industry best practices, including International Organization for Standardization, or ISO, standards, provide a framework for handling cybersecurity threats and incidents, and facilitate coordination across different departments of our company.

As part of this system, we have a formally documented information security management program and conduct regular tabletop exercises that include participation from executive officers.

In addition, we engage consultants and other third parties who are experts in the cybersecurity risk management field to review and provide testing services as well as general incident management services.

These engagements directly contribute to industry certifications and attestations that demonstrate our dedication to protecting the data that we are entrusted with by customers.

Our Governance, Risk and Compliance team within the information security management program oversees and identifies material cybersecurity risks associated with our use of these third-party service providers through a formal vendor security risk management program.

Board Governance Disclosure

One of the Board’s key functions is informed oversight of our risk management process, which includes responsibility for ensuring management has processes in place designed to identify, evaluate, manage, and mitigate cybersecurity risks to which it is exposed.

The Board receives regular updates, on at least a quarterly basis, from our senior management team on such cybersecurity risks, developments in cybersecurity, and updates to the Company’s information security management program.

The Board is also involved in strategic decisions related to the impact of these risks on our business.

Management Governance Disclosure

Our senior management team, which includes our Chief Information Security Officer, or CISO, is responsible for identifying, assessing, and managing material risks from cybersecurity threats, as well as for establishing processes to ensure such risks are monitored and mitigated, with the CISO taking the lead on such matters.

Our CISO, who joined Appian in May 2021, brings over 17 years’ experience in security and compliance initiatives, including experience in the software-as-a-service and platform-as-a-service cloud industries.

We have documented the framework and process for when and by whom senior management is informed and when such information will be reported to the other parties in our Incident Response Guide, which is regularly reviewed and updated by the information security team.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors