What changed in this filing

/stocks — the workspaceLOADING

Item 1. Business

2026-02-25 compared with 2025-02-25 · 152 added, 244 removed, 152 unchanged (72% of the section changed)

We are a leading provider of security and infrastructure solutions for on-premises, hybrid cloud, and edge-cloud environments of our global enterprise, communication, cloud and web service provider customers who strive to provide business-critical applications and networks that are secure, available, and efficient.

As cyber-attacks increase in volume and complexity, we integrate security and artificial intelligence (“AI”) enabled capabilities in our solutions that enable our customers to continue to adapt to market trends in hybrid cloud, AI-ready data centers and the ever-increasing need for high performance, high availability and low latency.

This provides the foundation for our strong global footprint and leadership in application and network security and infrastructure.

In February 2025, we acquired the assets and key personnel of ThreatX Protect, which expanded our cybersecurity portfolio with web application and application programming interfaces protection (“WAAP”).

ThreatX Protect is ideally suited for securing applications and application programming interfaces (“APIs”).

Industry Trends & Market Drivers

The digitization of business has made applications and APIs a critical ingredient in network operations.

The safety and efficiency of applications can directly impact business and financial performance, and security shortfalls can impact brand value and customer retention.

The application networking and security industry is experiencing dynamic shifts in the way applications are developed, delivered, monetized and protected.

Innovation in artificial intelligence (“AI”) is driving new ways to gain application delivery efficiency and enhance protection.

Our corporate strategy and technology address these evolving trends and the needs of our customers and industry, including:

Increased Adoption of Cloud Applications .

For decades, businesses operated with applications based in physical, appliance-based data centers.

While these traditional applications remain central to businesses around the world, a new genre of cloud-based applications is emerging, presenting new opportunities and challenges that require organizations to reassess the visibility, performance and security of their applications.

Some of these challenges relate to how a business effectively manages secure application services across various data centers and cloud types, whether private, public or hybrid clouds.

Over time, more and more applications may be born or provided in the cloud, while some applications that existed in traditional data centers may migrate to clouds as well.

To address this shift, businesses will benefit from solutions that bridge both traditional and cloud-based application environments and centrally manage all secure application services holistically in this multi-cloud world.

Increased Network Complexity and New Infrastructure Paradigms.

Traditional IT vendors may want to shift from hardware-centric models to software-defined approaches across several operating environments to improve agility for critical applications, and subsequently, their business operations.

Enabling product portfolios to adapt and diversify to include newer virtualized software, container-based software and cloud-based offerings are key factors determining future market leadership and competitive landscapes.

Growing Importance of Automation, Orchestration.

As applications increasingly move to a multi-cloud environment, automation tools help enable efficient operations of security and application services.

There is a desire for increased operational efficiency and agility, improved detection and reporting of security anomalies, enhanced end-user experiences and reduced total cost of ownership (“TCO”), simplified management of distributed application services, improved capacity planning and optimized multi-cloud software lifecycle management.

By deploying newly developed secure application delivery automation and predictive analytics tools, enterprises can visualize their application performance, detect anomalous trends and automate their application delivery and network security.

The Rise of DDoS Attacks and use of Artificial Intelligence.

The cyberthreat landscape continues to plague enterprises and society as a whole.

Malicious actors and cyber criminals such as hacktivists, amateur hackers, and foreign military and intelligence organizations target data centers of every type.

Distributed Denial of Service (“DDoS”) attacks are increasing in size, frequency, complexity and notoriety.

IT defenders are faced with the increasing sophistication of adversaries who are responsible for the size and frequency of these attacks.

A DDoS attack seeks to render a target network or website unavailable by orchestrating coordinated attacks from massive worldwide networks of compromised endpoints, called botnets.

Compromised endpoints can be computing devices or “Internet of Things” driven devices like video cameras.

Any internet-connected device can be vulnerable to

hackers and utilized as part of a botnet.

Innovations in AI enable security teams to temper the rise in DDoS attack signals and apply techniques that accurately address compromised endpoints in a rapid manner.

Rapid growth of TLS, SSL, Encrypted Applications and Hidden Threats .

Many applications use Transport Layer Security (“TLS”) and Secure Sockets Layer (“SSL”) protocols.

Cyber criminals exploit the protocol to hide malicious malware within encrypted channels and carry out attacks against businesses and users.

This malicious trend drives demand for greater visibility within SSL-encrypted channels.

Businesses need a way to decrypt traffic and apply outbound security policies efficiently, and require an effective way to inspect, identify, and remediate malicious traffic, then re-encrypt traffic and deliver it quickly to its destination.

Conducting this process efficiently without placing a “security performance tax” on the user experience is a capability valued by our customers.

The Advent of 5G Networks and a Smart World .

The growing deployment of commercial 5G networks will bring massive increases in network throughput and significant new business opportunities for mobile carriers and others.

It will also require a new generation of security and internet delivery infrastructure capable of handling the growing capacity requirements and complex management needs of 5G networks.

Capacity requirements increase dramatically in 5G networks due to substantial increases in concurrent sessions, lower packet size and higher connections per second.

Operators strive to dramatically lower latency, reduce total cost of ownership, and improve efficiency which may require advanced consolidation of network functions at the core.

Meanwhile, the scope and size of DDoS attacks may also increase dramatically with the proliferation of connected devices and traffic, due in large part to the expansion of Internet of Things (“IoT”)/Machine-to-Machine traffic coming from new 5G-delivered Smart World applications.

To address these requirements, mobile and other operators want new solutions that provide hyperscale and increased performance, richer feature sets, and rich automation, analytics and threat intelligence.

Need for Advanced Multi-Cloud Secure Application Service Solutions.

To address these challenges, advanced and integrated solutions for managing secure application services across businesses’ application environments are desirable.

Of the many solution requirements, some of the more critical include:

• Ability to Centrally Manage Traditional and Cloud Environments.

As more applications are provided in the cloud, and they operate alongside traditional applications supported by on-premise and appliance-based data centers, application delivery and security solutions will be called upon to span traditional and cloud-based environments.

In doing so, solutions must centrally control and manage secure application services across any combination of traditional data centers and a myriad of different clouds.

To support data centers and different cloud types, solutions require a variety of form factors:

hardware, software (i.e., virtual, bare metal and containers) and cloud-based offerings.

• Clear Visibility and Sophisticated Analytics.

The effectiveness of application performance and security depends greatly on the level of visibility a business has into its application and API traffic.

That visibility should effectively span any number of data centers and cloud types to provide a holistic view of security threats and performance issues affecting applications.

The deeper and clearer the visibility, the better the analytics and actionable information that can be applied to enhancing application performance and protection.

Secure application service solutions should provide solid visibility and per-app analytics.

• Ability to Scale.

Performance and security at scale are highly desirable to our customers given today’s dynamic application environments.

Customers want solutions that analyze application traffic quickly and enhance performance and security in traditional and cloud-based application environments in a centrally managed manner.

With the rapid adoption of IoT devices, and the advent of 5G, we believe a solution’s ability to perform at scale will be increasingly important.

• Sophisticated Security Functionality.

Secure application service solutions must leverage machine learning and AI to rapidly detect and mitigate sophisticated cybersecurity threats, such as malicious threats hiding in encrypted traffic and DDoS attacks.

To defend against the rising volume of sophisticated cyber-attacks, customers want solutions that provide exceptional performance and scale without dramatically increasing footprint and total cost of ownership.

We are a global provider of secure application and network infrastructure solutions that enable enterprises and service providers to deliver high-performance, reliable, and protected digital services across on-premises, hybrid cloud, and distributed environments.

Our solutions are designed to operate in mission-critical environments where availability, scalability, low latency, and security are essential.

We provide integrated capabilities spanning application delivery, traffic management, distributed denial of service (“DDoS”) protection, application and application programming interfaces (“API”) security, and centralized management.

Our portfolio is built on a unified software architecture that allows customers to deploy consistent performance and security policies across physical, virtual, containerized, and cloud-native environments.

We serve customers worldwide across industries including telecommunications, technology, financial services, public sector, industrial, retail, gaming, and education.

Our service provider customers rely on our solutions to support large-scale network infrastructure and deliver connectivity and managed services.

Our enterprise customers use our solutions to secure and optimize business-critical applications, modernize hybrid architectures, and address increasingly complex cybersecurity requirements, including those associated with artificial intelligence (“AI”) enabled workloads.

We generate revenue primarily from the sale of secure networking and cybersecurity solutions and related maintenance and support services.

Our offerings are delivered through a combination of direct sales and channel partners.

Customers typically purchase maintenance and support alongside initial deployments and renew those services over time.

We are continuing to expand subscription, term-based, and software-focused offerings to support recurring revenue growth and flexible customer consumption models.

In February 2025, we acquired the assets and key personnel of ThreatX Protect, expanding our cybersecurity portfolio with cloud-delivered web application and API protection capabilities.

This acquisition supports our strategy to strengthen our position in enterprise security and application protection markets.

Industry Trends and Customer Requirements

Digital transformation continues to increase reliance on applications and APIs as core business infrastructure.

As organizations modernize their technology environments, application architectures are becoming more distributed, hybrid, and cloud-integrated.

At the same time, threat landscapes are evolving in scale and sophistication.

These dynamics are reshaping performance, security, and operational requirements across enterprise and service provider environments.

AI-Driven Infrastructure Evolution.

The rapid adoption of artificial intelligence technologies, including generative AI and large language models, is introducing new infrastructure demands.

AI-enabled applications increase traffic concurrency, intensify east-west traffic flows within data centers, and introduce new security considerations related to data exposure, prompt-based interactions, and API-driven workflows.

Organizations are seeking infrastructure capable of supporting AI workloads while maintaining performance, reliability, and policy enforcement across environments.

Hybrid and Multi-Cloud Architectures.

Enterprises and service providers increasingly operate across combinations of on-premises data centers, private clouds, and public cloud environments.

Applications may originate in traditional infrastructure and migrate to the cloud over time, while new applications are often cloud-native from inception.

This hybrid reality requires consistent traffic management, visibility, and security controls across deployment models, supported by centralized management and flexible form factors.

Escalating Cybersecurity Threats.

Cybersecurity threats continue to grow in frequency, scale, and complexity.

Distributed denial of service attacks, application-layer attacks, bot-driven abuse, API exploitation, and threats embedded in encrypted traffic require advanced detection and mitigation capabilities.

The widespread adoption of TLS and SSL encryption has improved privacy but has also increased the need for efficient inspection and policy enforcement without degrading user experience.

Organizations require solutions that combine performance and security at scale.

Operational Complexity and Automation.

As networks and application environments grow more complex, organizations are prioritizing automation, orchestration, and analytics to improve operational efficiency.

Centralized management, predictive insights, and programmable interfaces help customers simplify deployment, reduce total cost of ownership, and respond more rapidly to performance or security anomalies.

Integrated platforms that unify performance and security services are increasingly favored over point solutions.

Service Provider Network Evolution.

Service providers continue to modernize core and edge network infrastructure to support increasing bandwidth consumption, higher connection densities, IPv6 migration, and the delivery of value-added services.

As operators expand fiber and mobile networks and introduce new digital offerings, they require scalable, high-throughput infrastructure capable of supporting large session volumes while maintaining performance and security.

In addition, many service providers are increasingly embedding security capabilities into their offerings, including managed DDoS and application protection services for enterprise customers.

These dynamics create demand for solutions that combine carrier-grade scalability, traffic management, and integrated security within programmable, operationally efficient platforms.

These evolving requirements across enterprise and service provider markets are driving demand for integrated solutions that unify application delivery, infrastructure scalability, and cybersecurity within a common architecture.

Product Portfolio

Our product portfolio seeks to address many of the aforementioned challenges and solution requirements.

The portfolio consists of network infrastructure and security products.

The infrastructure portfolio powers the delivery of internet

services and applications while the security products protect applications, APIs, infrastructure and enterprises from cyber-attacks.

Our security suite is known as A10 Defend.

A10 solutions are available in a variety of form factors, such as embedded in optimized hardware appliances, as bare metal software, containerized software, virtual appliances and cloud-native software.

While our revenue to date has predominantly derived from delivery of our proprietary software on a perpetual license basis embedded in optimized hardware, this model has begun to evolve in various ways including among others, term licenses, cloud offerings, subscriptions, and software-only models.

Our comprehensive and flexible application solutions portfolio, combined with A10 Control positions us to address the growing need for shifting workloads to a mix of private clouds and public clouds.

A10 Control is built on microservices and container technologies and offers a multi-tenant, highly scalable controller architecture that incorporates real-time and predictive analytics at the application level and central management and orchestration of secure application services across hybrid environments, from physical data centers to public, private and hybrid clouds.

The following is an overview of our portfolio:

Secure infrastructure solutions:

Thunder Application Delivery Controller (“ADC”)

Thunder Carrier Grade Networking (“CGN”)

Thunder SSL Insight (“SSLi”)

Thunder Convergent Firewall (“CFW”)

Intelligent management and automation tool:

A10 Control (formerly Harmony Controller)

A10 Defend Suite of Products:

A10 Defend Threat Control

A10 Defend Orchestrator (formerly aGalaxy management system)

A10 Defend Detector

A10 Defend Mitigator (formerly Thunder TPS)

A10 Defend ThreatX Protect

The following is a further overview of our portfolio:

Secure Infrastructure Solutions

Thunder Application Delivery Controller.

Thunder ADC provides advanced server load balancing, including global server load balancing, high availability, aFleX scripting, aVCS, ADP multi-tenancy, SSL, offload, acceleration, caching and compression, next-generation web application firewall (“NG-WAF”), domain name server (“DNS”) application firewall (“DAF”) and others.

ADCs are typically deployed in front of a server farm within a data center, including web, application and database servers.

Thunder Carrier Grade Networking .

Thunder CGN extends the life of increasingly scarce IPv4 address blocks and their associated infrastructure using Carrier-Grade network address translation (“CGNAT”) and translation solutions to the IPv6 addressing standard.

Our CGN solution is typically deployed in service provider networks to provide standards-compliant address and protocol translation services between varying types of IP addresses.

It has been successfully implemented by many large service providers and enterprises around the world.

Thunder SSL Insight.

Thunder SSLi focuses on the inherent blind spots created by SSL encryption by offloading CPU-intensive SSL decryption functions that enable security devices to inspect and remove malware within encrypted traffic.

Thunder SSLi decrypts SSL-encrypted traffic and forwards it to a third-party security device, such as a firewall, for deep packet inspection (“DPI”).

Once the traffic has been analyzed and scrubbed, Thunder SSLi re-encrypts the traffic and forwards it to its intended destination.

Thunder Convergent Firewall.

Thunder CFW addresses multiple critical security capabilities in one package by consolidating multiple security and networking functions in a single appliance, helping customers significantly lower capital and operating expenses.

Its performance and scale deliver superior value to customers, all within a small form factor, and streamlines customer operations with a cloud-ready programmable platform.

Thunder CFW includes:

• A high-performance Secure Web Gateway with integrated explicit proxy, URL filtering and SSL visibility, enabling security policy enforcement for outbound HTTP/HTTPS client traffic.

Our solution includes a Cloud Access Proxy to provide scalability, performance, and security to overcome deployment and operational challenges.

• A high-performance data center firewall with integrated network denial-of-service protection and server load balancing, which provides a Layer 4 stateful firewall and Layer 7 application-level gateway functionality for protecting data center applications from emerging network and DDoS threats.

• A high-performance Gi/SGi firewall with integrated network DDoS, CGNAT, ADC and application visibility.

The Gi/SGi firewall protects the mobile operator infrastructures from Internet-based DDoS and other security threats.

• A high-performance IPsec VPN, a security product designed to strengthen security postures and protect application data.

Intelligent Management and Automation Tool

A10 Control (formerly Harmony Controller).

A10 Control provides intelligent management, automation and analytics for secure application delivery in multi-cloud environments to help simplify operations.

Infrastructure and application operations teams can centrally manage and automate configuration and application policies for our Thunder application and security services, such as load balancing, application delivery, web application firewall, SSL decryption, Gi/SGi firewall, Carrier Grade NAT and Cloud Access Proxy solutions.

Configuration and control can also be automated via API and integrated with orchestration systems used within organizations.

In addition, A10 Control provides comprehensive infrastructure and per-application metrics and analytics for performance and security monitoring, anomaly detection and faster troubleshooting.

The container-based, microservices architecture allows controller capacity to be scaled without interrupting operations.

A10 Control is available in two deployment models:

A10 managed software-as-a-service (“SaaS”), or as a self-managed, on-premise deployment.

A10 Defend Suite of Products

A10 Defend Threat Control.

A10 Defend Threat Control is a standalone SaaS platform that proactively establishes a robust first layer of defense by offering actionable analytics and blocklists.

Defend Threat Control is based on proprietary A10 research.

A10 Defend Orchestrator (formerly aGalaxy management system).

A10 Defend Orchestrator integrates with A10 Defend Detector and A10 Defend Mitigator for intelligent and automated DDoS protection, providing a centralized point of control for seamless DDoS defense management and execution.

A10 Defend Orchestrator is designed to help lower operational costs by freeing up staff from repetitive tasks while increasing precision and accuracy with centralized and automated tasks, reducing the potential for human error.

A10 Defend Orchestrator highlights included advanced workflow and automated defense capabilities.

A10 Defend Detector.

A10 Defend Detector is our high-performance Netflow, Sflow, IPFIX-based DDoS detector and is used to easily manage the scale and heterogenous nature of SP networks, resulting in a unified DDoS protection solution.

Defend Detector can be used by service providers to deliver DDoS services to their customers.

A10 Defend Mitigator (formerly Thunder TPS).

A10 Defend Mitigator is our high precision, automated, scalable, and intelligent DDoS mitigation solution that is delivered as hardware or virtual appliances ranging from 1Gbps to over 1Tbps.

A10 Defend Mitigator is typically deployed at the perimeter of the networks to protect internal network resources from large-scale, volumetric and multi-vector attacks.

In 2017, we enhanced the A10 Defend Mitigator solution with the launch of a dedicated detector function, improved workflow and automation in A10 Defend Orchestrator.

In 2018, we enhanced our detection capabilities with the One-DDoS solution, which enables

Thunder ADC, CGN, and CFW solutions to act as in-line detectors to enhance application and infrastructure detection.

We also added A10 Defend Mitigator Dynamic Attack Pattern Recognition (“DAPR”) for automatic attack learning, to identify and thwart zero-day attacks, and enhanced machine learning (“ML”) with always-on adaptive learning.

Defend Mitigator is augmented by the A10 Threat Control and software licensed from ThreatSTOP, Inc., which can block known bad connections (i.e., IP addresses) from entering protected networks.

A10 Defend ThreatX Protect.

A10 Defend ThreatX Protect is a cloud-based WAAP solution that incorporates NG-WAF, BOT protection, Layer 7 DDoS and API protection.

This solution is deployed in front of applications and APIs and uses a combination of behavioral profiling and risk scoring to identify cyber threats.

A10 Defend ThreatX Protect comes from our acquisition of the ThreatX Protect assets.

Product Form Factors

Our products are offered in a variety of form factors and payment models, including physical appliances and perpetual and subscription-based software licenses, as well as pay-as-you-go licensing models and FlexPool, a flexible consumption-based software model.

FlexPool allows businesses to flexibly allocate and re-distribute capacity across applications, multiple clouds and data centers.

Thunder Series:

ADC, CGN, TPS, SSLi, and CFW products are available on the Thunder Series family of physical appliances.

The Thunder Series products support throughput ranges from 200 Mbps to 550 Gbps.

The appliance family provides a variety of other security and performance options.

vThunder virtual appliances operate on all major hypervisor platforms, including VMware and Linux KVM.

vThunder is also available from cloud providers like Amazon Web Services (“AWS”), Microsoft Azure, Google Cloud Compute (“GCP”) and service providers.

The vThunder Series products support throughput ranges from 200 Mbps to 100 Gbps.

Thunder for Bare Metal is a software version of our ADC and CGN solutions that is designed to run on a variety of Intel x86 servers, allowing the customer to design and select their own hardware platform.

Thunder Container is software that can be deployed as a container for cCGN, cADC and cTPS on customers’ own hardware platforms and OS stacks.

Our product portfolio is designed to deliver secure, high-performance networking for enterprises and service providers operating across on-premises, hybrid cloud, and edge environments.

We focus on outcomes customers require in production environments, including low latency at scale, always-on reliability, embedded security, and operational simplicity through automation and centralized control.

Consistent with how we operate and go to market, we organize our portfolio around three core solution areas, supported by a unified control plane and common architecture.

Three Core Solution Areas

Legacy Networking

Our legacy networking solutions support large-scale service provider and enterprise environments where performance, scale, and reliability are essential.

A core capability in this area is carrier-grade address and protocol translation, which enables customers to extend IPv4 networks, support migration to IPv6, and manage subscriber or device growth while maintaining service continuity.

These solutions are commonly deployed in high-throughput networks and are designed to provide resilient, standards-based traffic processing with operational stability.

Representative capabilities include carrier-grade NAT and related translation services, high scale session management, policy controls, and visibility required to operate in complex networks.

Next-Generation Networking

Our next-generation networking solutions focus on application delivery and traffic management for modern data center, hybrid cloud, and distributed architectures.

These solutions help customers ensure application availability, optimize performance, and apply consistent traffic policies across environments as applications become more distributed and API-driven.

In many customer deployments, application delivery also serves as an enforcement point for performance and security policies in the data path, helping reduce operational complexity while maintaining low latency.

Representative capabilities include server load balancing, high availability, application traffic steering, global load distribution, SSL/TLS acceleration and offload, and application-level observability and policy controls.

Network Security (A10 Defend)

Security is embedded across our portfolio and is also delivered through dedicated security solutions designed to protect applications, APIs, and infrastructure from modern cyber threats.

Our network security capabilities support both enterprises and service providers with solutions that help defend against volumetric and application-layer DDoS

attacks, protect web applications and APIs, mitigate automated threats such as bots, and improve operational outcomes through centralized orchestration and actionable threat intelligence.

Representative capabilities include DDoS detection and mitigation, orchestration and workflow automation, threat intelligence and blocklisting, converged network security functions delivered in the data path, and cloud-delivered WAAP (web application and API) capabilities, including web application firewall, bot protection, Layer 7 DDoS protection, and API protection.

Unified Control Plane, Architecture, and Policy

Our solutions are built on a unified product architecture and are centrally managed through a control plane that provides policy management, automation, and analytics.

This common foundation is intended to help customers operate performance, availability, and security as a single system across hybrid environments and deployment models.

Product Families and Delivery Models

We deliver our capabilities through integrated product families that span secure application delivery, traffic management, and infrastructure security, as well as our A10 Defend security portfolio.

Our solutions are available in multiple form factors and deployment models, including:

• Purpose-built hardware appliances

• Software deployed on customer-selected hardware

• Virtual appliances

• Containerized software

• Cloud-native and SaaS-delivered offerings (where applicable)

Historically, a significant portion of our revenue has been derived from proprietary software embedded in optimized hardware and licensed on a perpetual basis.

As customer preferences evolve toward hybrid architectures and more flexible procurement models, we are increasingly delivering our solutions through term-based licenses, subscription offerings, software-only deployments, and cloud marketplace transactions.

We offer a range of commercial models designed to align with customer deployment preferences and budgeting cycles.

These include perpetual licenses, term licenses, subscription-based pricing, pay-as-you-go models in certain cloud environments, and flexible consumption-based arrangements that allow customers to allocate and reallocate licensed capacity across applications, clouds, and data centers.

These consumption options are intended to support operational agility while improving capacity planning and workload portability in hybrid environments.

Underlying Technology

Since our inception, our solutions have been known for their high performance and scalability in some of the largest and most demanding networks.

The value and significance of our high-performance offerings reside in our portfolio’s underlying software operating system.

Our products are built on the Advanced Core Operating System (“ACOS”) platform and leverage its performance optimization and security features.

The ACOS platform is optimized for modern 64-bit central processing units (“CPUs”), which increasingly have multiple parallel processing cores that operate within a single CPU for higher efficiency and performance scalability.

To maximize the capabilities of these increasingly dense multi-core CPUs, ACOS implements a proprietary shared memory architecture that provides all cores with simultaneous access to common memory.

This shared memory software architecture enables our products to utilize these multi-core CPUs efficiently and scale performance with increasing CPU cores.

As a result, ACOS provides customers with products that can deliver superior price performance benefits over products that lack these capabilities.

ACOS’ high-performance design enables our products to address a wide range of performance-driven networking challenges.

The flexible software design of ACOS allows us to apply our portfolio to a variety of markets for a variety of needs.

Some notable details about ACOS include:

High Performance and Intelligent Network Input/Output (“I/O”) Processing.

In order to maximize the efficiency of high density, multi-core processors, we have developed a high-performance intelligent network I/O technology that can balance application traffic flows equitably across processor cores.

Our Flexible Traffic Accelerator logic can be implemented either as software running within a standard x86 processor or a Field Programmable Gate Array (“FPGA”) semiconductor.

Our Flexible Traffic Accelerator (“FTA”) also performs certain hardware-based security checks for each packet and can isolate suspicious traffic before it can impact system performance.

Scalable and Efficient Memory Usage.

To improve the performance of the multi-core processor architecture, we have developed a shared memory technology to allow processors to share common memory and the state of the system simultaneously.

This avoids the overhead associated with Inter-Processor Communication architectures deployed in first-generation approaches.

We optimize memory to be visible to processor cores simultaneously, while minimizing communication overhead and contention among processors for allocated memory space.

All processors share a common memory pool, which dynamically allocates memory space based on application processing requirements without constraints.

Customers can achieve greater performance and scalability from memory and processor resources because configurations, policies and network databases are efficiently stored within a shared memory architecture.

Optimized Application Networking and Security.

Once data is processed and placed into a shared memory, a processor can begin to apply ACOS common services and function-specific logic.

To enable every processor utilized to perform key functions and thereby achieve greater system utilization, ACOS uses processor cores symmetrically for functions and services.

The ACOS common services perform a set of key operational functions, including configuration management, network I/O, aFleX scripting, Virtual Chassis System (“aVCS”), aXAPI for management integration, Application Delivery Partitions (“ADPs”), virtualization to enable multi-tenancy, and common resource management such as buffer, system memory, timer management and other internal system management tasks.

ACOS features a modular software design, which improves reliability by preventing modifications made to one module from causing unwanted side effects on other system functions.

Other noteworthy ACOS Technologies .

ACOS incorporates a number of other technologies to provide a rich environment for developing Layer 4-7 application networking solutions, including:

• aFleX Scripting.

aFleX scripting technology is based on industry-standard tool command language and enables customers to write custom scripts to augment the application processing.

ADP enables multi-tenancy in the ACOS common services so that multiple departments of an organization or multiple customers can share a physical/virtual appliance.

aVCS enables multiple physical/virtual appliances to be managed as a single chassis.

aXAPI is an industry standard representational state transfer (“RESTful”) program interface to enable management integration for automated management.

Support & Services

One of our founding principles is to provide excellent customer support.

Our global support team, with deep technical domain expertise, is part of our engineering organization and is trained across all products and solutions and takes complete ownership of customer issues from the beginning to the end to achieve rapid response and resolution.

Our consistent, high-quality customer service and technical support is a key factor in attracting and retaining customers of all sizes, as well as support services that include installation, phone support, repair and replacement, software updates, online tools, consulting and training services.

All customers receive standard warranty support for 90 days with the purchase of our products.

We offer four maintenance options - Basic, Basic Plus, Gold and Platinum support programs (Platinum available in select countries).

Maintenance contracts may be purchased in 12-month increments up to five years.

Since our inception, our solutions have been recognized for high performance, scalability, and reliability in large and demanding enterprise and service provider environments.

Our products are built on our proprietary Advanced Core Operating System, or ACOS, which provides a unified software foundation across our networking and security portfolio.

ACOS is designed to support integrated performance, security, automation, and analytics capabilities within a single architectural framework.

The ACOS platform is optimized for modern computing environments and is engineered to efficiently process high volumes of application and network traffic while maintaining consistent availability and low latency.

Its architecture enables scalable traffic management, embedded security enforcement, and centralized policy control across physical, virtual, containerized, and cloud deployments.

This common foundation allows us to deliver consistent functionality across deployment models and adapt to evolving infrastructure requirements, including hybrid and AI-driven environments.

Performance and Scalability Architecture.

Our platform is engineered to efficiently distribute traffic processing across multi-core processing environments, enabling horizontal and vertical scaling as customer throughput requirements grow.

The architecture is designed to minimize processing bottlenecks, optimize resource utilization, and maintain consistent application performance under varying traffic conditions.

We leverage a combination of software optimization techniques and, where appropriate, hardware acceleration technologies to enhance throughput, reduce latency, and improve overall system efficiency.

This design approach

allows our solutions to support high concurrency, large session volumes, and performance-sensitive workloads in enterprise data centers and service provider networks.

Integrated Networking and Security Services.

Our platform provides a modular and extensible software framework that supports application delivery, traffic management, and security services within a common operating environment.

By operating in the data path, our solutions can apply performance and security policies in real time without requiring separate infrastructure layers.

The platform includes capabilities that support multi-tenancy, automation, and programmability through standards-based interfaces and APIs.

This enables integration with customer orchestration systems and supports deployment across physical, virtual, containerized, and cloud-native environments.

Reliability and Operational Resilience.

Our software architecture is designed to enhance reliability and reduce operational risk.

A modular design framework isolates functional components, which helps limit the impact of updates or configuration changes and supports continuous improvement and feature expansion.

The platform supports centralized configuration management, analytics, and policy enforcement to improve visibility and operational control.

Intellectual Property.

We have developed proprietary technologies that support high-performance traffic processing, scalability, and integrated security.

We also maintain a portfolio of patents and other intellectual property protections covering aspects of our architecture and implementation.

Support and Services

Customer support and service are core components of our value proposition and have been since our founding.

We provide global technical support and maintenance services designed to help customers deploy, operate, and optimize our solutions in mission-critical environments.

Our support organization includes technical professionals with domain expertise across our networking and security portfolio and works closely with engineering to facilitate timely issue resolution and continuous product improvement.

Our support offerings include installation assistance, technical support, hardware repair and replacement, software updates, online tools, and training services.

Customers typically purchase maintenance and support in conjunction with initial product deployments and renew those services over time.

We believe the quality and responsiveness of our support organization are important factors in customer retention and long-term relationships.

All customers receive standard warranty support for 90 days following product purchase.

We offer tiered maintenance programs that provide varying levels of response times and service coverage, with contract terms generally ranging from one to five years.

The average maintenance contract term is approximately 21 months.

We invoice resellers or customers directly for maintenance contracts at the time of hardware purchase, and all maintenance contracts are non-cancellable and are generally renewed through the same channel as originally purchased.

Software updates are provided to all customers with a current maintenance contract on a when-and-if-available basis.

We maintain technical support centers in the United States, Japan, India and the Netherlands.

Thunder TPS features an enhanced support offering that includes access to the A10 DDoS Security Incident Response Team (“SIRT”).

Augmenting the standard support, the offering includes access to a dedicated team of DDoS mitigation experts specializing in DDoS prevention, offering efficient assistance for mitigating attacks, and a subscription to the A10 Threat Intelligence Service, leveraging collective intelligence to block known threats.

Our professional services team provides a full range of fee-based consulting services, including pre-sale network assessment, comprehensive network analysis and capacity planning, post-sale migration and implementation services and ongoing support.

Our customers operate in a variety of industries, including telecommunications, technology, industrial, government, retail, financial, gaming, and education.

Our customers include the top two United States wireless carriers, four of the top 10 United States cable providers, and the top four service providers in Japan, in addition to other global enterprises, gaming companies and governmental organizations.

Maintenance contracts are invoiced at the time of initial hardware purchase and are generally non-cancellable during the contract term.

Software updates are provided to customers with an active maintenance agreement on a when-and-if-available basis.

Maintenance and support services are typically renewed through the same sales channel as the original purchase.

We operate technical support centers in the United States, Japan, India, and the Netherlands to provide global coverage.

For customers requiring advanced DDoS protection support, we offer enhanced service options that include access to specialized security response resources and threat intelligence services designed to assist with rapid mitigation of active attacks and evolving threat patterns.

Our customers operate across a broad range of industries, including telecommunications, technology, financial services, public sector, industrial, retail, gaming, and education.

We support organizations that manage mission-critical applications, high-availability networks, and performance-sensitive digital services where uptime, security, and scalability are essential.

Our solutions are deployed in environments that require continuous availability and protection of business-critical traffic, including large enterprise data centers, hybrid and cloud infrastructures, and service provider networks.

Customers rely on our capabilities to help deliver resilient application experiences, manage large-scale traffic volumes, and protect infrastructure from evolving cyber threats.

During the years ended December 31, 2025, 2024, and 2023, purchases from our 10 largest end-customers accounted for approximately 40%, 38%, and 33% of our total revenue, respectively.

A substantial portion of our revenue is from sales of our products and services through distribution channels, such as resellers and distributors.

In 2024 and 2023, sales through a single distribution channel represented 20% and 19% of our total revenue, respectively.

In 2022, sales through two distribution channels represented 15% and 13% of our total revenue.

As security, 5G and cloud trends continue to gain prominence, changes in application delivery needs, cybersecurity threats, and the technology landscape result in evolving customer requirements.

These evolving demands have expanded our addressable market into cybersecurity including DDoS protection, 5G /5G-readiness and hybrid networking, where we compete with a number of companies not included among our traditional competitors of the past.

The agility and flexibility of a common management platform enables us to offer multiple product categories that are easier to manage for our customers.

Our portfolio also includes container and microservices-based versions of certain of our comprehensive set of hardware, software and cloud offerings.

During the years ended December 31, 2025, 2024 and 2023, sales through a single distribution channel represented 29%, 20% and 19% of our total revenue, respectively.

The markets in which we operate are highly competitive and continue to evolve as organizations modernize application architectures, adopt hybrid and cloud environments, expand API usage, and increase focus on cybersecurity resilience.

The growing importance of security, distributed application delivery, modernized networks, and AI-driven workloads has broadened the competitive landscape and introduced new categories of competitors.

We compete across application delivery, network infrastructure, and security markets, where customers increasingly seek integrated solutions that combine performance, availability, and protection within unified platforms.

Our ability to deliver multiple capabilities through a common architecture and centralized management framework allows customers to reduce operational complexity and streamline deployment across physical, virtual, and cloud environments.

We do not consider any of these markets to include a single dominant company, nor do we consider the markets to be fragmented.

Our main competitors fall into the following categories:

• Companies that sell network security solutions and services including DDoS protection, such as Arbor Networks Inc., a subsidiary of Netscout Systems, F5 Networks, Inc.

(“F5 Networks”) and Radware, Ltd;

• Companies that sell network security products, including Secure Web Gateways, SSL Insight/SSL Intercept, data center firewalls and Office 365 proxy solutions;

• Companies that sell Gi/SGi firewall and CGN products, which were originally designed for other networking purposes, such as edge routers and security appliances from vendors like Cisco Systems, Inc.

(“Cisco Systems”), Juniper Networks, Inc.

(“Juniper Networks”) and Fortinet, Inc.

(“Fortinet”);

• Companies that sell products in the traditional application delivery market, such as F5 Networks, NetScaler from Cloud Software Group, Inc., VMware from Broadcom (through its acquisition of Avi Networks) as well as many startups;

• Companies that sell Cloud WAAP solutions such as Imperva, Akamai, Cloudlare and Amazon Web Services (“AWS”).

The key competitive factors in our markets include:

• Ability to innovate and respond to customer needs rapidly;

• Ability to prepare for, detect and mitigate large-scale cybersecurity threats;

• Ability for products to scale to facilitate high-speed network traffic;

• Ability to address on-premise and cloud application environments in a secure, centrally managed manner;

• Ability to accommodate any IT delivery model or combination of models, regardless of form factor and customer consumption model;

• Level of customer intimacy and application know-how;

• Total cost of ownership including ease-of-use and a common platform approach for multiple products;

• Brand awareness and reputation;

• Ability to attract and retain talented employees.

• Providers of network and infrastructure security solutions, including DDoS protection and related services, such as Arbor Networks Inc, a subsidiary of NetScout Systems, Radware Ltd, and F5;

• Vendors of application delivery and traffic management solutions, including F5, NetScaler from Cloud Software Group, and VMware offerings within Broadcom;

• Network equipment and security vendors offering firewall, routing, and carrier-grade infrastructure solutions, including Cisco Systems, Hewlett Packard Enterprise (division f/k/a Juniper Networks, Inc.), and Fortinet Inc.;

• Cloud-based security and application protection providers offering WAAP and related services, including Akamai, Cloudflare, Imperva, and Amazon Web Services;

• Emerging vendors and specialized security providers addressing API protection, bot mitigation, and AI-related security use cases.

Competition in our markets is based on a number of factors, including:

• Performance, scalability, and reliability in mission-critical environments;

• Breadth and integration of networking and security capabilities;

• Effectiveness in detecting and mitigating evolving cybersecurity threats;

• Flexibility across deployment models, including on-premises, hybrid, and cloud;

• Total cost of ownership and operational simplicity;

• Quality of customer support and service;

• Brand reputation and customer relationships;

• Ability to attract and retain skilled technical and sales talent.

We believe our unified architecture, performance heritage, and integrated security capabilities position us to compete effectively across these markets.

Sales and Marketing

3 unchanged sentences

Our sales organization includes sales engineers with deep technical domain expertise who are responsible for pre-sales technical support, solutions engineering, proof-of-concept work and technical training for our distribution channels.

Our sales team is also comprised of a channel sales organization that is expanding our market reach through resellers.

Our sales team is also comprised of a channel sales organization that is

expanding our market reach through resellers.

We may continue to grow our sales headcount, including in geographies where we currently do not have a sales presence.

20 unchanged sentences

We outsource delivery to a third-party logistics provider for deliveries in Japan.

As of December 31, 2024 and 2023, we had product backlog of approximately $11.6 million and $3.8 million, respectively.

Backlog represents orders confirmed with a purchase order for products to be shipped generally within 90 days to customers with approved credit status.

Backlog represents orders confirmed with a purchase order for products to be shipped to customers with approved credit status.

Orders may be subject to cancellation, rescheduling by customers and product specification changes by customers.

Although we believe that the backlog orders are firm, purchase orders may be canceled by the customer prior to shipment without significant cost.

For this reason, we believe that our product backlog at any given date is not a reliable indicator of future revenues.

Although we believe that the backlog orders are firm, purchase orders may be canceled or rescheduled by the customer prior to shipment without significant cost.

For these reasons, we believe that our product backlog at any given date is not a reliable indicator of future revenues.

For the years ended December 31, 2025, 2024 and 2023, our total revenue was $290.6 million, $261.7 million, and $251.7 million, respectively, and our gross margin was 79.3%, 80.4%, and 80.9%, respectively.

10 unchanged sentences

In addition, the laws of some foreign countries do not protect our proprietary rights as fully as do the laws of the U.S.

Any issued patent may not preserve our proprietary position, and competitors or others may develop technologies similar to or superior to our technology.

Any issued patent may not preserve our proprietary position, and competitors or others may develop technologies similar to or superior to

our technology.

Our failure to enforce and protect our intellectual property rights could harm our business, operating results and financial condition.

20 unchanged sentences

Further, we have established standards and practices to which our Board of Directors, executives and employees are obligated to adhere, as outlined on our website under Corporate Responsibility.

Environmental, Social and Governance (“ESG”)

Environmental

Sustainability

We are committed to business practices that preserve the environment, recognizing its fundamental role in sustaining our society and economy.

20 unchanged sentences

We expect our suppliers to comply with our policy on responsible sourcing of minerals from conflict-affected and high-risk areas and to cooperate with our diligence inquiries and requests for information and certification as may be required by us to comply with reporting and disclosure obligations to which we are subject from time to time.

Diversity, Inclusion & Equal Opportunity

Workplace Standards

We are committed to providing a work environment that is free of discrimination and harassment.

We are an equal-opportunity employer.

We make employment decisions on the basis of a person’s qualifications, and our business needs.

We make employment decisions on the basis of a person’s qualifications, as well as our business needs, while complying with our statement against discrimination.

We believe in the richness and quality of a working environment that is informed by people from all walks of life and strive to create a genuinely inclusive environment.

We have implemented Diversity, Equal Opportunity, and Inclusion action planning teams focused on analysis from diversity surveys and focus groups.

We have ongoing outreach efforts to recruit a diverse candidate pool.

We are committed to ensuring our team members are treated with fairness, dignity and respect.

6 unchanged sentences

They are also given access to our Statement Against Discrimination and are expected to comply with it.

These all provide guidance on how we expect to operate in order to foster diversity, equity and inclusion across our company.

These all provide guidance on how we expect to operate in order to foster equity and inclusion across our company.

We are an equal opportunity employer and a Vietnam Era Veterans' Readjustment Assistance Act (“VEVRAA”) federal subcontractor.

1 unchanged sentence

We also comply with all applicable state and local laws governing nondiscrimination in employment.

We use as a guide the code of conduct policies set fourth by the Responsible Business Alliance, the world’s largest industry coalition dedicated to corporate social responsibility in global supply chains, and we expect all of our suppliers to do so as well.

We use as a guide the code of conduct policies set forth by the Responsible Business Alliance, the world’s largest industry coalition dedicated to corporate social responsibility in global supply chains, and we expect all of our suppliers to do so as well.

Our Code of Business Conduct and Ethics and our Statements Against Discrimination and Modern Slavery can be found on our corporate website at https://investors.A10networks.com within the “Governance - Governance Documents” section.

42 unchanged sentences

We announce material information to the public about the Company, our products and services and other matters through a variety of means, including our website ( www.A10networks.com ), the investor relations section of our website ( https://investors.A10networks.com ), press releases, filings with the Securities and Exchange Commission, public conference calls, and social media, including our corporate X (formerly Twitter) account ( @A10Networks) and our corporate Facebook page ( https://www.facebook.com/a10networks ).

Information provided includes press releases and other information about financial performance, information on environmental, social and governance and details related to the Company’s annual meeting of stockholders.

Information provided includes press releases and other information about

financial performance, information on environmental, social and governance and details related to the Company’s annual meeting of stockholders.

The contents of our website and social media contents are not intended to be incorporated by reference into this Annual Report on Form 10-K or in any other report or document we file with the SEC, and any references to our websites are intended to be inactive textual references only.

2 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1. Business