What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2023-02-27 compared with 2022-03-01 · 330 added, 347 removed, 733 unchanged (48% of the section changed)

16 unchanged sentences

We depend, in part, on our third-party facility providers’ ability to protect these facilities against damage or interruption from natural disasters, power or telecommunications failures, criminal acts, public health issues, such as the COVID-19 pandemic, and similar events.

In some cases, third-party cloud providers run their own platforms that we access, and we are, therefore, vulnerable to their service interruptions.

In some cases, third-party cloud providers run their own platforms that we access, and are, therefore, vulnerable to their service interruptions.

In the event that there are any defects or errors in software, failures of hardware, damages to a facility, or misconfigurations of any of our services, we may have to divert resources away from other planned work, could experience lengthy interruptions in our platform, and also incur delays and additional expenses in arranging new facilities and services.

4 unchanged sentences

Moreover, we have experienced and may in the future experience system failures or interruptions in our platform as a result of human error.

For example, in January 2021, an undiscovered bug in a software update caused a platform interruption that affected many of our customers, resulting in service level agreement claims.

In addition, on June 8, 2021, we experienced a global platform outage due to an undiscovered software bug caused by human error.

The outage was triggered by a valid customer configuration change and has resulted in customers reducing or removing traffic from our platform and service level agreement claims.

While these customers have returned traffic to our platform, not all customer traffic has returned to pre-outage levels.

Any interruptions or delays in our platform, whether caused by our products or our data centers, third-party error, our own error, natural disasters, the effects of climate change (such as drought, flooding, wildfires, increased storm severity, and sea level rise), or security breaches, or whether accidental or willful, could harm our relationships with customers, reduce customers’ usage of our platform, cause our revenue to decrease and our expenses to increase, and divert resources away from product development.

These outages have resulted and may in the future result in service level agreement claims.

Any interruptions or delays in our platform, whether caused by our products or our data centers, third-party error, our own error, natural disasters, the effects of climate change (such as drought, flooding, wildfires, increased storm severity, and sea level rise), security breaches, or whether accidental or willful, could harm our relationships with customers, reduce customers’ usage of our platform, cause our revenue to decrease and our expenses to increase, and divert resources away from product development.

Also, in the event of damage or interruption, our insurance policies may not adequately compensate us for any losses that we may incur.

These factors in turn could further

reduce our revenue, subject us to liability and cause us to issue service credits or cause customers to fail to renew their customer contracts, any of which could harm our business.

These factors in turn could further reduce our revenue, subject us to liability and cause us to issue service credits or cause customers to fail to renew their customer contracts, any of which could harm our business.

The occurrence of any defects, errors, disruptions in service, failures involving redundant data centers, or other performance problems, interruptions, or delays with our platform, whether in connection with the day-to-day operations or otherwise, could result in:

2 unchanged sentences

• lost or delayed market acceptance and sales of our products, or the failure to launch products or features on anticipated timelines;

• delays in payment to us by customers;

• delays in payment to us by our customers;

• injury to our reputation and brand;

13 unchanged sentences

If these customers do not maintain and increase their usage of our platform, our revenue may decline and our results of operations will likely be harmed.

We charge our customers based on the usage of our platform.

For some of our products, we charge our customers based on the usage of our platform.

Most of our customers, including some of our largest enterprise customers, do not have long-term contractual financial commitments to us.

In addition, most of our current customer

contracts are only one year in duration and these customers may not use our platform in a subsequent year.

In addition, most of our current customer contracts are only one year in duration and these customers may not use our platform in a subsequent year.

In order for us to maintain or improve our results of operations, it is important that our customers, in particular, our enterprise customers, use our platform in excess of their commitment levels, if any, and continue to use our platform on the same or more favorable terms.

Our ability to retain our largest customers and expand their usage could be impaired for a variety of reasons, including customer budget constraints, customer satisfaction, changes in our customers’ underlying businesses, changes in the type and size of our customers, pricing changes, competitive conditions, the acquisition of our customers by other companies, governmental actions, or the possibility thereof, and general economic conditions.

Because many of our largest customers’ minimum usage commitments for our platform are relatively low compared to their expected usage, it can be easy for certain customers to quickly reallocate usage or switch from our platform to an alternative platform altogether.

Our ability to retain our largest customers and expand their usage could be impaired for a variety of reasons, including customer budget constraints, customer satisfaction, changes in our customers’ underlying businesses, changes in the type and size of our customers, pricing changes, competitive conditions (including customers building their own CDNs), the acquisition of our customers by other companies, governmental actions, or the possibility thereof, and general economic conditions.

alternative platform altogether.

In addition, they may reduce or cease their use of our products at any time without penalty or termination charges, even after they have expanded usage in prior periods.

2 unchanged sentences

If any of these events were to occur, our business may be harmed.

In addition, many of our customers have negotiated and may continue to negotiate lower rates for their usage in exchange for an agreement to renew, expand their usage in the future, or adopt new products.

In addition, many of our customers have negotiated and may continue to negotiate lower rates in exchange for an agreement to renew, expand their usage in the future, or adopt new products.

As a result, in certain cases, even though customers have not reduced their usage of our platform, the revenue we derive from that usage has decreased.

If our usage or revenue fall significantly below the expectations of the public market, securities analysts, or investors, our business would be harmed, which could cause our stock price to decline.

Our future success also depends in part on our ability to expand our existing customer relationships, in particular, with enterprise customers, by increasing their usage of our platform and selling them additional products.

If our platform usage or revenue fall significantly below the expectations of the public market, securities analysts, or investors, our business would be harmed, which could cause our stock price to decline.

The rate at which our customers increase their usage of our platform and purchase products from us depends on a number of factors, including our ability to grow our platform and maintain the security and availability of it, develop and deliver new features and products, maintain customer satisfaction, general economic conditions and pricing and services offered by our competitors.

If our efforts to increase usage of our platform by, or sell additional products to, our enterprise customers are not successful, our business would be harmed.

If our efforts to increase usage of our platform by, or sell new and additional products to, our enterprise customers are not successful, our business would be harmed.

In addition, even if our largest customers increase their usage of our platform, we cannot guarantee that they will maintain those usage levels for any meaningful period of time.

In addition, because many of our products endeavor to deliver increased efficiency and functionality, the successful sale of an additional product to an existing customer could result in a reduction of the customer's overall usage of our platform.

If we fail to forecast our revenue accurately, or if we fail to manage our expenditures, our operating results could be adversely affected.

We cannot accurately predict customers’ usage or renewal rates given the diversity of our customer base across industries, geographies and size, and ability of customers to allocate usage, among other factors.

Accordingly, we may be unable to accurately forecast our revenues notwithstanding our substantial investments in sales and marketing, infrastructure, and research and development in anticipation of growth in our business.

If we do not realize returns on these investments in our growth, our results of operations could differ materially from our forecasts, which would adversely affect our results of operations and could disappoint analysts and investors, causing our stock price to decline.

In addition, because many of our products endeavor to deliver increased efficiency and functionality, the successful sale of a new or additional product to an existing customer could result in a reduction of the customer's overall usage of our platform.

We receive a substantial portion of our revenues from a limited number of customers from a limited number of industries, and the loss of, or a significant reduction in usage by, one or more of our major customers would result in lower revenues and could harm our business.

1 unchanged sentence

We currently receive a substantial portion of our revenues from a limited number of customers and from a limited number of industries, such as media and entertainment.

For the year ended December 31, 2021, our top ten customers accounted for approximately 34% of our revenue and our top five customers accounted for approximately 22% of our revenue.

Our 10 largest customers generated an aggregate of 35% and 33% of our revenue in the trailing 12 months ended December 31, 2022 and 2021, respectively.

Our 5 largest customers generated an aggregate of 26% and 22% of our revenue in the trailing 12 months ended December 31, 2022 and 2021, respectively.

Affiliated customers that are business units of a single company in the streaming entertainment space generated an aggregate of 11% of our revenue in both the trailing 12 months ended December 31, 2022 and 2021.

It is likely that we will continue to be dependent upon a limited number of customers for a significant portion of our revenues for the foreseeable future and, in some cases, the portion of our revenues attributable to individual customers may increase in the future.

In addition, changes to our customers’ business may cause our revenues attributable to individual customers to increase, including any impact from merger and acquisition activities, internal business reorganizations leading to operational and

decision making changes, and corporate structure changes such as subsidiary consolidation and reorganization that may arise in the future.

In addition, changes to our customers’ business may contribute to further customer concentration, including any impact from acquisition activities, internal business reorganizations leading to operational and decision making changes, and corporate structure changes such as subsidiary consolidation and reorganization that may arise in the future.

The loss of one or more key customers or a reduction in usage by any major customers would reduce our revenues.

For example, on June 8, 2021, we experienced a global platform outage due to an undiscovered software bug caused by human error.

The outage was triggered by a valid customer configuration change and resulted in customers, including some of our largest customers, reducing or removing traffic from our platform and service level agreement claims.

While these customers have returned traffic to our platform, not all customer traffic has returned to pre-outage levels.

If we fail to maintain existing customers or develop relationships with new customers and across different industries, our business would be harmed.

2 unchanged sentences

We rely on a limited number of suppliers for several components of the equipment we use to operate our network and provide products to our customers.

Our reliance on these suppliers exposes us to risks, including reduced control over production costs and constraints based on the then current availability, terms, and pricing of these components.

The ongoing COVID-19 pandemic has resulted, and we expect will continue to result, in disruptions and delays for these components and the delivery and installation of such components at our co-location facilities, in addition to pricing increases.

For example, throughout 2021, a global shortage of microchips has resulted in supply constraints for a number of electronics firms, including manufacturers that supply the components to construct our servers.

If our supply of certain components is disrupted or delayed, there can be no assurance that we will be able to obtain adequate replacements for the existing components or that supplies will be available on terms and prices that are favorable to us, if at all.

Any disruption or delay in the supply of our hardware components may limit capacity expansion or replacement of defective or obsolete equipment, or cause other constraints on our operations that could damage our customer relationships and harm our business.

Our reliance on these suppliers exposes us to risks including reduced control over production costs and constraints based on the then current availability, terms, and pricing of these components, including pricing changes as a result of inflationary pressures.

The ongoing COVID-19 pandemic has resulted, and we expect will continue to result, in disruptions and delays for these components and the delivery and installation of such components at our colocation facilities, in addition to pricing increases.

If our supply of certain components is further disrupted or delayed, there can be no assurance that we will be able to obtain adequate replacements for the existing components or that supplies will be available on terms and prices that are favorable to us, if at all.

Any disruption or delay in the supply of our hardware components has in the past and may in the future

limit capacity expansion or replacement of defective or obsolete equipment, or cause other constraints on our operations that could damage our customer relationships and harm our business.

Our limited operating history and our history of operating losses makes it difficult to evaluate our current business and prospects and may increase the risks associated with your investment.

3 unchanged sentences

If we do not address these risks successfully, our business may be harmed.

We generated a net loss of $222.7 million for the year ended December 31, 2021, and as of December 31, 2021, we had an accumulated deficit of $510.9 million.

We generated a net loss of $190.8 million for the year ended December 31, 2022 and, we had an accumulated deficit of $701.7 million.

We will need to generate and sustain increased revenue levels and manage costs in future periods in order to become profitable;

1 unchanged sentence

We intend to continue to expend significant funds to support further growth and further develop our platform, including expanding the functionality of our platform, expanding our technology infrastructure and business systems to meet the needs of our customers, expanding our direct sales force and partner ecosystem, increasing our marketing activities, and growing our international operations.

We will also face increased compliance costs associated with growth, expansion of our customer base, and the costs of being a public company.

We have in the past and will continue to face increased compliance costs associated with growth, expansion of our customer base, and the costs of being a public company.

Our efforts to grow our business may be costlier than we expect, and we may not be able to increase our revenue enough to offset our increased operating expenses.

3 unchanged sentences

As such, any predictions about our future revenue and expenses may not be as accurate as they would be if we had a longer operating history or operated in a more predictable market.

If our security measures, or those maintained on our behalf, are compromised now, or in the future, or the security, confidentiality, integrity or availability of our information technology, software, services, networks, communications or data is compromised, limited or fails, our business could experience a materially adverse impact, including significant costs and disruptions that could harm our business, financial results, and reputation.

If our information technology systems or data, or those of third parties upon which we rely, are compromised now, or in the future, or the security, confidentiality, integrity or availability of our information technology, software, services, networks, communications or data is compromised, limited or fails, our business could experience materially adverse consequences, including but not limited to regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, loss of revenue or profits, loss of customers or sales, reputational harm, and other adverse consequences.

Our business is dependent on providing our customers with fast, efficient, and reliable distribution of applications and content over the internet.

We transmit and store our customers’ information, data, and encryption keys as well as our own;

customer information and data may include personally identifiable data of and about their end-users.

In the ordinary course of our business, we and the third parties upon which we rely, collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share, proprietary, confidential, and sensitive data, including personal information, intellectual property, trade secrets, and encryption keys, including our data and data of our customers, including their end-users (collectively, sensitive information).

Maintaining the security and availability of our platform, network, and internal IT systems and the security of information we hold on behalf of our customers is a critical issue for us and our customers, and we may expend significant resources, fundamentally change our business activities and practices, or modify our operations in an effort to protect against security incidents and to mitigate, detect, and remediate actual and potential vulnerabilities.

Attacks on our customers and our own network are frequent and take a variety of forms, including DDoS attacks, infrastructure attacks, botnets, malicious file attacks, cross-site scripting, credential abuse, ransomware, bugs, viruses, worms, and malicious software programs.

For example, during 2021 we experienced DDoS attacks of increased size and severity that caused us to invest resources into improving our systems, and we expect to continue to be subject to DDoS and other forms of attacks in the future, particularly as they have become more prevalent in our industry.

Malicious actors can attempt to fraudulently induce employees or suppliers to disclose sensitive information through spamming, phishing, or other tactics.

Similarly, supply chain attacks have increased in frequency and severity, and we cannot guarantee that third parties and infrastructure in our supply chain have not been compromised or that they do not contain exploitable defects or bugs that could result in a breach of or disruption to our platform, systems and networks or the systems and networks of third parties that support us and our services.

For example, in December 2021, the Apache Software Foundation publicly disclosed a remote code execution vulnerability in its Log4j 2 product (Log4j), an open-source component widely used in Java-based software applications to log and track error messages, which affected large amounts of systems worldwide.

While we have identified and remediated all known Log4j vulnerabilities in our systems, we expect to continue to encounter vulnerabilities and potential attacks related to open source libraries integrated in our systems.

Ransomware attacks, including by organized criminal threat actors, nation-states, and nation-state-supported actors, are also becoming increasingly prevalent and severe and can lead to significant interruptions in our operations, loss of data and income, reputational harm, and diversion of funds.

Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling to make such payments, or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments.

In addition, unauthorized parties may attempt to gain physical access to our facilities in order to infiltrate our information systems.

Cyber-attacks, malicious internet-based activity, online and offline fraud, and other similar activities threaten the confidentiality, integrity, and availability of our sensitive information and information technology systems, and those of the third parties upon which we rely.

Such threats are prevalent and continue to rise, are increasingly difficult to detect, and come from a variety of sources, including threat actors, “hacktivists,” personnel (such as through theft or misuse), sophisticated nation states, and nation-state-supported actors.

Some actors now engage and are expected to continue to engage in cyber-attacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities.

We have in the past been subject to cyber-attacks from third parties, including parties who we believe are sponsored by government actors.

Since our customers share our multi-tenant architecture, an attack on any one of our customers could have a negative effect on other customers.

Since our customers share our multi-tenant architecture, cyber-attacks on any one of our customers could have a negative effect on other customers.

These attacks have significantly increased the bandwidth used on our platform and have strained our network.

If attacks like these were to occur in the future and if we do not have the systems and processes in place to respond to them, our business could be harmed.

During times of war and other major conflicts, we, the third parties upon which we rely, and our customers may be vulnerable

to a heightened risk of these attacks, including retaliatory cyber-attacks, that could materially disrupt our systems and operations, supply chain, and ability to produce, sell, and distribute our services.

We and the third parties upon which we rely are subject to a variety of evolving threats, including but not limited to social-engineering attacks (including through phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks, account takeover attacks, credential harvesting, personnel misconduct or error, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, adware, telecommunications failures, natural disasters, and other similar threats.

For example, we have experienced DDoS attacks of increased size and severity that caused us to invest resources into improving our systems, and we expect to continue to be subject to DDoS and other forms of attacks in the future, particularly as they have become more prevalent in our industry.

Similarly, we have been the target of phishing and social engineering schemes that may be designed to, among other things, improperly gain access to our confidential information or fraudulently obtain payments or funds from us.

Further, we are not immune from the possibility of a malicious insider compromising our information systems and infrastructure or misappropriating our confidential information.

In particular, severe ransomware attacks are becoming increasingly prevalent, and can lead to significant interruptions in our operations, loss of sensitive data and income, reputational harm, and diversion of funds.

Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments.

We are incorporated into the supply chain of a number of companies worldwide and, as a result, if our services are compromised, a significant number or, in some instances, all of our customers and their data could be simultaneously affected.

The potential liability and associated consequences we could suffer as a result of such a large-scale event could be catastrophic and result in irreparable harm.

Future or past business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities’ systems and technologies.

Additionally, the COVID-19 pandemic and our remote workforce poses increased risks to our information technology and network, as more of our employees work from home, utilizing network connections outside our premises.

Security incidents, whether as a result of third-party action, employee or customer error, technology impairment or failure, malfeasance or criminal activity, or hostile state actors, could result in unauthorized access to, or loss or unauthorized disclosure of, customer information or data, litigation, indemnity obligations, and other possible liabilities.

Incidents involving customer information have in the past resulted in pricing and other concessions, decreased customer usage and terminations by affected customers, and similar security incidents could occur in the future that result in pricing concessions, indemnity obligations, and other possible liabilities related to such unauthorized access, loss or disclosure, including litigation.

Further, certain of our insurance policies and the laws of some states may limit or prohibit insurance coverage for punitive or certain other types of damages or liability arising from gross negligence or intentional misconduct of us and our suppliers and we cannot assure you that we are adequately insured against the risks that we face.

In recent years, cyber-attacks have increased in size, sophistication, and complexity, increasing exposure for our customers and us.

Furthermore, we may discover security issues that were not found during due diligence of such acquired or integrated entities, and it may be difficult to integrate companies into our information technology environment and security program.

We rely on third-party service providers and technologies to operate critical business systems to process sensitive information in a variety of contexts, including, without limitation, cloud-based infrastructure, data center facilities, encryption and authentication technology, content delivery to customers, and other functions.

Like many other companies, our ability to monitor third parties’ information security practices is limited, and these third parties may not have adequate information security measures in place.

If our third-party service providers experience a security incident or other interruption, we could experience adverse consequences.

While we may be entitled to damages if our third-party service providers fail to satisfy their privacy and data security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award.

In addition, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties’ infrastructure in our supply chain or our third-party partners’ supply chains have not been compromised.

Any of the previously identified or similar threats could cause a security incident or other interruption that could result in unauthorized , unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our sensitive information or our information technology systems, or those of the third parties upon whom we rely.

A security incident or other interruption could disrupt our ability (and that of third parties upon whom we rely) to provide our platform, products and services.

In addition, as we expand our emphasis on selling security-related products, we may become a more attractive target for attacks on our infrastructure intended to destabilize, overwhelm, or shut down our platform.

For example, we have had security incidents in the past that have tested the limits of our infrastructure and impacted the performance of our platform.

The costs to us to avoid or alleviate cyber or other security problems and vulnerabilities are significant.

However, our efforts to address these problems and vulnerabilities may not be successful.

Any actual or perceived significant breach of our security measures could:

• lead to the dissemination of proprietary information or sensitive, personal, or confidential data about us, our employees, or our customers—including personally identifiable information of individuals involved with our customers and their end-users;

• lead to interruptions or degradation of performance in our platform;

• threaten our ability to provide our customers with access to our platform;

• generate negative publicity about us;

• result in litigation and increased legal liability or fines;

• lead to governmental inquiry or oversight.

Additionally, applicable data protection laws, privacy policies and data protection obligations may require us to notify relevant stakeholders of security incidents, including affected individuals, customers, regulators and credit reporting agencies.

Such disclosures are costly, and the disclosures or the failure to comply with such requirements, could lead to materially adverse impacts, including, without limitation, government enforcement (for example, investigations, fines penalties, audits, and inspections), additional reporting requirements and/or oversight, restrictions on processing sensitive information (including personal information), litigation (including class claims), indemnification obligations, monetary fund diversions, interruptions in our operations (including availability of data), financial loss, negative publicity, a loss of customer confidence in our services, breach of contract claims, and other similar harms.

The occurrence, or perceived occurrence, of any of these events could harm our business or damage our brand and reputation, lead to customer credits, loss of customers, higher expenses, and possibly impede our present and future success in retaining and attracting new customers.

A successful security breach or attack on our infrastructure would be damaging to our reputation and could harm our business.

Additionally, our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our privacy and data protection obligations.

We also cannot be sure that our insurance coverage will be adequate or sufficient to protect us from or to mitigate liabilities arising out of our privacy and security practices, that such coverage will continue to be available on commercially reasonable terms or at all, or that such coverage will pay future claims.

Similar security risks exist with respect to our business partners and the third-party vendors that we rely on for aspects of our information technology support services and administrative functions.

As a result, we are subject to the risk that cyber-attacks on our business partners and third-party vendors may adversely affect our business even if an attack or breach does not directly impact our systems.

Our ability to monitor these business partners’ and third-party vendors’ security measures is limited, and these business partners and third-party vendors may not have adequate security measures in place.

It is also possible that security breaches sustained by our competitors could result in negative publicity for our entire industry that indirectly harms our reputation and diminishes demand for our platform.

If we fail to adapt and respond effectively to rapidly changing technology, evolving industry standards, changing regulations, and changing customer needs, requirements, or preferences, our products may become less competitive.

Certain privacy and data security obligations may require us to implement and maintain specific security measures or industry-standard or reasonable security measures to protect our information technology systems and sensitive information.

While we have implemented security measures designed to protect against security incidents, there can be no assurance that these measures will be effective.

We take steps to detect and remediate vulnerabilities, but we may not be able to detect and

remediate all vulnerabilities because the threats and techniques used to exploit the vulnerability change frequently and are often sophisticated in nature.

Therefore, such vulnerabilities could be exploited but may not be detected until after a security incident has occurred.

These vulnerabilities pose material risks to our business.

Further, we may experience delays in developing and deploying remedial measures designed to address any such identified vulnerabilities.

Applicable privacy and data security obligations may require us to notify relevant stakeholders of security incidents.

Such disclosures are costly, and the disclosure or the failure to comply with such requirements could lead to adverse consequences.

If we (or a third party upon whom we rely) experience a security incident or are perceived to have experienced a security incident, we may experience adverse consequences, such as government enforcement actions (for example, investigations, fines penalties, audits, and inspections);

additional reporting requirements and/or oversight, restrictions on processing sensitive information (including personal data);

litigation (including class action claims);

indemnification obligations;

negative publicity;

reputational harm;

monetary fund diversions;

interruptions or degradation of performance in our services (including availability of data);

financial loss;

and other similar harms.

Security incidents and attendant consequences may cause customers to stop using our platform, products, and services, cause us to offer pricing and other concessions, deter new customers from using our platform, products, and services, and negatively impact our ability to grow and operate our business.

Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our privacy and data security obligations.

We cannot be sure that our insurance coverage will be adequate or sufficient to protect us from or to mitigate liabilities arising out of our privacy and data security practices, that such coverage will continue to be available on commercially reasonable terms or at all, or that such coverage will pay future claims.

If we fail to efficiently develop and sell new products and respond effectively to rapidly changing technology, evolving industry standards, changing regulations, and changing customer needs, requirements, or preferences, our products may become less competitive.

The market in which we compete is relatively new and subject to rapid technological change, evolving industry standards and regulatory changes, as well as changing customer needs, requirements, and preferences.

The success of our business will depend, in part, on our ability to adapt and respond effectively to these changes on a timely basis.

If we are unable to develop and sell new products that satisfy our customers and provide enhancements, new features, and capabilities to our platform that keep pace with rapid technological and industry change, our revenue and operating results could be adversely affected.

If we are unable to develop and sell new products that satisfy and are adopted by our customers and provide enhancements, new features, and capabilities to our platform that keep pace with rapid technological and industry change, our revenue and operating results could be adversely affected.

If new technologies emerge that enable large internet platform companies to utilize their own data centers and implement delivery approaches that limit or eliminate reliance on third-party providers like us, or that enable our competitors to deliver competitive products and applications at lower prices, more efficiently, more conveniently, or more securely, such technologies could adversely impact our ability to compete.

If our platform does not allow us or our customers to comply with the latest regulatory requirements, our existing customers may decrease their usage on our platform and new customers will be less likely to adopt our platform.

Our platform must also integrate with a variety of network, hardware, mobile, and software platforms and technologies, and we need to continuously modify and enhance our products and platform capabilities to adapt to changes and innovation in

these technologies.

If developers widely adopt new software platforms, we would have to attempt to develop new versions of our products and enhance our platform’s capabilities to work with those new platforms.

4 unchanged sentences

Potential developers may be unfamiliar or opposed to working with VCL and therefore decide to not adopt our platform, which may harm our business.

If we fail to forecast our revenue accurately, or if we fail to manage our expenditures, our operating results could be adversely affected.

Accordingly, we may be

unable to accurately forecast our revenues.

Notwithstanding our substantial investments in sales and marketing, infrastructure, and research and development in anticipation of growth in our business, i f we do not realize returns on these investments in our growth, our results of operations could differ materially from our forecasts, which would adversely affect our results of operations and could disappoint analysts and investors, causing our stock price to decline.

Failure to effectively develop and expand our marketing and sales capabilities could harm our ability to increase our customer base and achieve broader market acceptance of our platform.

2 unchanged sentences

This strategy has allowed us to build a substantial customer base and community of users who use our products and act as advocates for our brand and our platform, often within their own corporate organizations.

However, our ability to further increase our customer base and achieve broader market acceptance of our edge cloud platform will significantly depend on our ability to expand our marketing and sales operations.

However, our ability to further increase our customer base and achieve broader market acceptance of our products will significantly depend on our ability to expand our marketing and sales operations.

We plan to continue expanding our sales force and strategic partners, both domestically and internationally.

4 unchanged sentences

However, these developers may not perceive value in the additional benefits and services we offer beyond the free trial versions of our platform and may choose not to pay for those additional benefits.

Moreover, some existing paying customers may choose to convert to the free version of our platform.

Moreover, some existing paying customers may choose not to renew their commitment with us in favor of relying on the free version of our platform.

Most trial accounts do not convert to paid versions of our platform, and to date, only a few users who have converted to paying customers have gone on to generate meaningful revenue.

1 unchanged sentence

We believe that there is significant competition for sales personnel, including sales representatives, sales managers, and sales engineers, with the skills and technical knowledge that we require.

Our ability to achieve significant revenue growth will depend, in large part, on our success in recruiting, training, and retaining sufficient numbers of sales personnel to support our growth.

Our ability to achieve significant revenue growth will depend, in large part, on our success in recruiting, training, incentivizing, and retaining sufficient numbers of sales personnel to support our growth.

New hires require significant training and may take significant time before they achieve full productivity.

1 unchanged sentence

In addition, particularly if we continue to grow rapidly, new members of our sales force will have relatively little experience working with us, our platform, and our business model.

If we are unable to hire and train sufficient numbers of effective sales personnel, our sales personnel do not reach significant levels of productivity in a timely manner, or our sales personnel are not successful in acquiring new customers or expanding usage by existing customers, our business will be harmed.

If we are unable to hire and train sufficient numbers of effective sales personnel, our sales personnel do not reach significant levels of productivity in a timely manner, our sales personnel are not effectively incentivized, or our sales personnel are not successful in acquiring new customers or expanding usage by existing customers, our business will be harmed.

The markets in which we participate are competitive, and if we do not compete effectively, our business will be harmed.

1 unchanged sentence

With the introduction of new technologies and market entrants, we expect that the competitive environment in which we compete will remain intense going forward.

Legacy CDNs, such as Akamai, Limelight, EdgeCast (part of Verizon Digital Media), Level3, and Imperva (for security), and small business-focused CDNs, such as Cloudflare, StackPath, and Section.io, offer products that compete with ours.

We also compete with application and API security vendors like Akamai, Cloudflare, Imperva, Amazon Web Services and F5 (Shape), with cloud providers who are starting to offer compute functionality at the edge like Amazon’s CloudFront, AWS Lambda, and Google Cloud Platform, as well as traditional

data center and appliance vendors like F5, Citrix, A10 Networks, Cisco, Imperva, Radware, and Arbor Networks, who offer a range of on-premise solutions for load balancing, WAF, and DDoS.

Application and API security vendors like Akamai, AWS, Cloudflare, F5, and Imperva offer products that compete with ours.

We also compete with CDN providers, which now offer serverless edge compute functionality like Akamai (Linode), AWS, and Cloudflare, cloud hosting providers that have added CDN and WAF capabilities like Alphabet (Google Cloud Platform), AWS, and Microsoft (Azure), legacy CDNs, such as Akamai, Edgio, and Lumen, and niche CDN players like Section.io and StackPath, as well as traditional on-premise data center appliance vendors for load balancing, WAF, and DDoS like Citrix, F5, Imperva, and Radware.

Some of our competitors have made or may make acquisitions or may enter into partnerships or other strategic relationships that may provide more comprehensive offerings than they individually had offered.

12 unchanged sentences

• our ability to protect our intellectual property;

• our ability to identify opportunities for acquisitions and strategic relationships and successfully execute on them, including our acquisition of Signal Sciences.

• our ability to identify opportunities for acquisitions and strategic relationships and successfully execute on them.

We face substantial competition from legacy CDNs, small business-focused CDNs, cloud providers, traditional data center, and appliance vendors.

In addition, existing and potential customers may not use our platform, or may limit their use, because they pursue a “do-it-yourself” approach by putting in place equipment, software, and other technology products for content and application delivery within their internal systems;

In addition, existing and potential customers have transitioned, and may in the future transition, off of our platform, or may limit their use, because they pursue a “do-it-yourself” approach to develop their own CDN by putting in place equipment, software, and other technology products for content and application delivery within their internal systems;

enter into relationships directly with network providers instead of relying on an overlay network like ours;

13 unchanged sentences

We also believe that the importance of brand recognition will increase as competition in our market increases.

Successfully maintaining and enhancing our brand will depend largely on the effectiveness of our marketing efforts, our ability to provide reliable products that continue to meet the needs of our customers at competitive prices, our ability to maintain our customers’ trust, our ability to continue to develop new functionality and products, and our ability to successfully differentiate our platform from competitive products and services.

Successfully maintaining and enhancing our brand will depend largely on the effectiveness of our marketing efforts, our ability to provide reliable products that continue to meet the needs of

our customers at competitive prices, our ability to maintain our customers’ trust, our ability to continue to develop new functionality and products, and our ability to successfully differentiate our platform from competitive products and services.

Additionally, our brand and reputation may be affected if customers do not have a positive experience with our partners’ services.

2 unchanged sentences

Acquisitions, strategic investments, partnerships, or alliances could be difficult to identify and integrate, divert the attention of management, disrupt our business, and dilute stockholder value .

On October 1, 2020, we completed the acquisition of Signal Sciences.

We may in the future seek to acquire or invest in businesses, products, or technologies that we believe could complement or expand our platform, enhance our technical capabilities, or otherwise offer growth opportunities.

We have in the past acquired, and we may in the future seek to acquire or invest in, businesses, products, or technologies that we believe could complement or expand our platform, enhance our technical capabilities, or otherwise offer growth opportunities.

Our acquisitions of Glitch and Signal Sciences reflect this strategy.

The pursuit of potential acquisitions may divert the attention of management and cause us to incur various expenses in identifying, investigating, and pursuing acquisitions, whether or not such acquisitions are completed.

In addition, we have limited experience in acquiring other businesses and we may not successfully identify desirable acquisition targets or, when we acquire additional businesses, such as Signal Sciences, we may not be able to integrate them effectively following the acquisition.

In addition, we have limited experience in acquiring other businesses and we may not successfully identify desirable acquisition targets or, when we acquire additional businesses, we may not be able to integrate them effectively following the acquisition.

Acquisitions could also result in dilutive issuances of equity securities or the incurrence of debt, which could adversely affect our operating results, may cause unfavorable accounting treatment, may expose us to claims and disputes by third parties, including intellectual property claims, and may not generate sufficient financial returns to offset additional costs and expenses related to the acquisitions.

We may also incur significant, and sometimes unanticipated costs in connection with these acquisitions or in integration with our business.

In addition, if an acquired business, such as Signal Sciences, fails to meet our expectations or we do not realize sufficient value, our business may be harmed.

Further, it is possible that there could be a loss of our or any acquired company's key employees and customers, disruption of either company’s or both companies’ ongoing businesses or unexpected issues, higher than expected costs and an overall post-completion process that takes longer than originally anticipated.

Specifically, the following issues, among others, must be addressed in combining any company’s, including Signal Sciences’, operations with ours in order to realize the anticipated benefits of the acquisition so the combined company performs as the parties hope:

In addition, if an acquired business fails to meet our expectations or we do not realize sufficient value, our business may be harmed.

Further, it is possible that there could be a loss of our existing or any acquired company's key employees and customers, disruption of either company’s or both companies’ ongoing businesses or unexpected issues, higher than expected costs and an overall post-completion process that takes longer than originally anticipated.

Specifically, the following issues, among others, must be addressed in combining any company’s operations with ours in order to realize the anticipated benefits of the acquisition so the combined company performs as the parties hope:

• combining the companies’ corporate functions;

7 unchanged sentences

In addition, at times the attention of certain members of our management and resources may be focused on completion of the acquisition and integration planning of the businesses of the two companies and diverted from day-to-day business operations, which may disrupt our ongoing business and the business of the combined company.

For example, certain members of our management team and other personnel have spent significant time on the acquisition and integration of Signal Sciences.

For example, certain members of our management team and other personnel spent significant time on the acquisition and integration of Signal Sciences.

We have previously been and may in the future be involved in class-action lawsuits and other litigation matters that are expensive and time-consuming.

2 unchanged sentences

We anticipate that we will be a target for lawsuits in the future, as we have been in the past.

For example, on August 27, 2020 and September 15, 2020, we and certain of our officers were named as defendants in putative securities class action purportedly brought on behalf of holders of our Class A common stock.

These two securities class actions were consolidated, and on December 21, 2021, the consolidated class action was voluntarily dismissed with prejudice.

On December 28, 2020 and February 2, 2021, certain of our officers and directors were named as defendants in shareholder derivative actions.

These two shareholder derivative actions were consolidated, and on January 3, 2022, the consolidated derivative action was voluntarily dismissed without prejudice.

Any litigation to which we are a party may result in an onerous or unfavorable judgment that may not be reversed on appeal, or we may decide to settle lawsuits on similarly unfavorable terms.

2 unchanged sentences

Regardless of the final outcome, defending these claims, and associated indemnification obligations, are costly and can impose a significant burden on management and employees, and we may receive unfavorable preliminary, interim, or final rulings in the course of litigation, which could seriously harm our business.

Health epidemics, including the ongoing COVID-19 pandemic, have had, and could in the future have, an adverse impact on our business, operations, and the markets and communities in which we, our partners and customers operate.

The ongoing global COVID-19 pandemic has adversely impacted, and may continue to adversely impact, many aspects of our business.

As certain of our customers or potential customers experience downturns or uncertainty in their own business operations and revenue resulting from the spread of COVID-19, they have and may continue to decrease or delay their technology spending, request pricing concessions or payment extensions, or seek renegotiation of their contracts.

In addition, a portion of our revenue is related to usage of our platform in connection with live events, such as sporting events, that have continued to be impacted.

Usage of our platform fluctuated following the implementation of preventative measures to contain or mitigate the outbreak of COVID-19, and we cannot predict how usage levels will continue to be impacted by these preventative measures.

There is no assurance that customers will continue to use our platform, or to the same extent, as the COVID-19 pandemic begins to taper off or when it has ended.

As a result, it has been difficult to accurately forecast our revenues or financial results, especially given that the near and long term impact of the pandemic remains uncertain.

Our results of operations could be materially below our forecasts, which could adversely affect our results of operations, disappoint analysts and investors, or cause our stock price to decline.

In response to the COVID-19 pandemic, many state, local, and foreign governments have put in place restrictions in order to control the spread of the disease.

Such restrictions, or the perception that further restrictions could occur, have resulted in business closures, work stoppages, slowdowns and delays, work-from-home policies, travel restrictions, and cancellation or postponement of events, among other effects that impacted productivity and disrupted our operations and those of our partners and customers.

For example, we experienced delays in the ramping of new traffic due to travel and data center restrictions in South Asia that delayed network build outs and the timing of customer code freezes, each affected in part due to COVID-19-related issues.

In addition, our suppliers have been impacted by the COVID-19 pandemic, which has reduced the availability or resulted in delays, and may continue to reduce the availability or result in delays, of parts and components to us.

Our offices have remained temporarily closed since March 2020, and we have taken other precautionary measures, such as instituting protocols and guidelines for Fastly-related travel and shifting to hosting virtual Fastly-sponsored events in lieu of in-person events.

We may take further actions that alter our operations as may be required by federal, state, or local authorities, or which we determine are in our best interests.

While much of our operations can be performed remotely, certain activities such as expanding and maintaining our network of POPs around the world often require personnel to be on-site, and our ability to carry out these activities has been, and may continue to be, negatively impacted if our employees or local data center personnel are not able to travel.

In addition, travel restrictions have affected our ability to conduct audits of our data centers and facilities,

requiring us to use alternative procedures to the standard on-site visit.

Any inability to complete these audits could affect our compliance certifications and cause customers to reduce or cease using our services.

In addition, for activities that may be conducted remotely, there is no guarantee that we will be as effective while working remotely because our team is dispersed and many employees and their families have been negatively affected, mentally or physically, by the COVID-19 pandemic.

Decreased effectiveness and availability of our team could adversely affect our results due to slow-downs in our sales cycles and our customer ramping and onboarding process, delays in recruiting and onboarding efforts, delays in our entry into customer contracts, delays in addressing performance issues, delays in product development, delays and inefficiencies among various operational aspects of our business, including our financial organization, or other decreases in productivity that could seriously harm our business.

Moreover, our finance organization’s ability to ensure that we comply with the requirements of Section 404 may be impaired in the future, including the ability of our registered public accounting firm to issue an attestation report on management’s assessment of our internal control over financial reporting.

Furthermore, we may decide to postpone or cancel planned investments in our business in response to changes in our business as a result of the spread of COVID-19, which may impact our ability to attract and retain customers and our rate of innovation, either of which could harm our business.

In addition, while the potential impact and duration of the COVID-19 pandemic on the global economy and our business in particular may be difficult to assess or predict, the pandemic has resulted in, and may continue to result in, significant disruption of global financial markets, and may reduce our ability to access additional capital, which could negatively affect our liquidity in the future.

The ultimate duration and extent of the impact from the COVID-19 pandemic depends on future developments that cannot be accurately forecasted at this time.

These developments include the severity and transmission rate of the disease, the emergence of new variants, the actions of governments, businesses and individuals in response to the pandemic, the extent and effectiveness of containment actions and vaccines, the impact on economic activity and the impact of these and other factors.

We do not yet know how businesses, customers, or our partners will operate in a post COVID-19 environment.

There may be additional costs or impacts to our business and operations, including when we are able to return to our offices and resume in-person activities, travel, and events.

In addition, there is no guarantee that a future outbreak of this or any other widespread epidemics will not occur, or that the global economy will recover, either of which could harm our business.

We may not be able to scale our business quickly enough to meet our customers’ growing needs.

5 unchanged sentences

Even if we are able to upgrade our systems and expand our staff, any such expansion will be expensive and complex, and require the dedication of significant management time and attention.

We could also face inefficiencies or operational failures as a result of our efforts to scale our cloud infrastructure.

We could also face inefficiencies or operational failures as a result of our efforts to scale our cloud infrastructure, such as by over investing in systems and equipment to support anticipated growth in our platform.

We cannot be sure that the expansion and improvements to our cloud infrastructure will be effectively implemented on a timely basis, if at all, and such failures would harm our business.

4 unchanged sentences

In some regions, bandwidth providers have their own services that compete with us, or they may choose to develop their own services that will compete with us.

These bandwidth providers may become unwilling

to sell us adequate transmission bandwidth at fair market prices, if at all.

These bandwidth providers may become unwilling to sell us adequate transmission bandwidth at fair market prices, if at all.

This risk is heightened where market power is concentrated with one or a few major networks.

27 unchanged sentences

Some organizations may be reluctant or unwilling to use our platform for a number of reasons, including concerns about additional costs, uncertainty regarding the reliability, and security of cloud-based offerings or lack of awareness of the benefits of our platform.

Moreover, many organizations have

invested substantial personnel and financial resources to integrate traditional on-premise services into their businesses, and therefore may be reluctant or unwilling to migrate to cloud-based services.

Moreover, many organizations have invested substantial personnel and financial resources to integrate traditional on-premise services into their businesses, and therefore may be reluctant or unwilling to migrate to cloud-based services.

Our ability to expand sales of our product into new and existing markets depends on several factors, including potential customer awareness of our platform;

10 unchanged sentences

Third-party market opportunity estimates and our growth forecasts are subject to significant uncertainty and are based on assumptions and estimates that may not prove to be accurate.

The variables that go into the calculation of our market opportunity are subject to change over time, and there is no guarantee that any particular number or percentage of addressable companies or end-users covered by our market opportunity estimates will purchase our products at all or generate any particular level of revenues for us.

The variables that go into the calculation of our market

opportunity are subject to change over time, and there is no guarantee that any particular number or percentage of addressable companies or end-users covered by our market opportunity estimates will purchase our products at all or generate any particular level of revenues for us.

Even if the market in which we compete meets the size estimates and growth forecasted, our business could fail to grow for a variety of reasons, including reasons outside of our control, such as competition in our industry.

41 unchanged sentences

Furthermore, if our quarterly results of operations or our guidance fall below the expectations of investors and securities analysts who follow our stock, the price of our Class A common stock could decline substantially, and our business could be harmed.

For example, the trading price of our Class A common stock declined significantly after we provided our guidance for the first quarter and full year of 2022 on February 16, 2022 in our earnings release furnished on Form 8-K, which did not meet the expectations of securities analysts who followed our stock.

We cannot assure you that our operating results or projected operating results will meet the expectations of market analysts or our investors.

5 unchanged sentences

Moreover, if our customers use our platform in a manner that is inconsistent with how we have purchased bandwidth, servers, and colocation space, our business could be harmed.

We have limited experience with respect to determining the optimal prices for our products and, as a result, we have in the past changed our pricing model and expect that we may need to do so in the future.

In addition, we plan to roll out product packages with single price points.

We do not know whether our current or potential customers will accept these packages or the impact these packages will have on our existing usage-based pricing model.

As the market for our products matures, or as new competitors introduce new products or services that compete with ours, we may be unable to attract new customers at the same price or based on the same pricing models as we have used historically.

46 unchanged sentences

We rely on third-party hosting providers that may be difficult to replace.

We rely on third-party hosting services such as Amazon Web Services ("AWS"), Google, IBM Softlayer, Microsoft Azure, and other cloud providers that facilitate the offering of our platform.

We rely on third-party hosting services such as Amazon Web Services ("AWS"), Google, Microsoft Azure, and other cloud providers that facilitate the offering of our platform.

Some of these third-party hosting services offer competing products to ours and therefore may not continue to be available on commercially reasonable terms, or at all.

9 unchanged sentences

Most of our customer agreements contain service level commitments.

If we are unable to meet the stated service level commitments, including failure to meet the uptime and delivery requirements under our customer agreements, we have in the past and may in the future be contractually obligated to provide the affected customers with service credits which could significantly affect our revenues in the periods in which the uptime and delivery failure occurs and the credits are applied.

For example, as a result of platform interruptions in January 2021 and June 2021, certain of our affected customers with whom we have service level commitments were entitled to receive service credits.

If we are unable to meet the stated service level commitments, including failure to meet the uptime and delivery requirements under our customer agreements, we may be contractually obligated to provide the affected customers with service credits which could significantly affect our revenues in the periods in which the uptime and delivery failure occurs and the credits are applied.

In the past, as a result of degradation of service and interruptions to our platform, we have provided service credits to certain of our affected customers with whom we had service level commitments.

We could also face customer terminations with refunds of prepaid amounts, which could significantly affect both our current and future revenues.

6 unchanged sentences

Further, increased demand for customer support, without corresponding revenue, could increase costs and adversely affect our business.

In addition, as we continue to grow our operations and expand internationally, we will need to be able to provide efficient customer support that

meets our customers’ needs globally at scale and our customer support team will face additional challenges, including those associated with delivering support and documentation in multiple languages.

In addition, as we continue to grow our operations and expand internationally, we will need to be able to provide efficient customer support that meets our customers’ needs globally at scale and our customer support team will face additional challenges, including those associated with delivering support and documentation in multiple languages.

Our failure to do so could harm our business.

The ongoing global COVID-19 pandemic has adversely impacted, and may continue to adversely impact, many aspects of our business.

Usage of our platform has fluctuated during the COVID-19 pandemic, and we cannot predict how usage levels will be impacted given that the long term impact of the pandemic remains uncertain.

As a result, it has been difficult to accurately forecast our revenues or financial results, and our results of operations could be materially below our forecasts, which could adversely affect our results of operations, disappoint analysts and investors, or cause our stock price to decline.

Furthermore, we may decide to postpone or cancel planned investments in our business in response to changes in our business as a result of the

COVID-19 pandemic, which may impact our ability to attract and retain customers and our rate of innovation, either of which could harm our business.

The ultimate duration and extent of the impact from the COVID-19 pandemic depends on future developments that cannot be accurately forecasted at this time.

We do not yet know how businesses, customers, or our partners will operate in a post COVID-19 environment.

There may be additional costs or impacts to our business and operations, which could harm our business.

Investors’ expectations of our performance relating to environmental, social and governance factors may impose additional costs and expose us to new risks.

There is an increasing focus from certain investors, employees, and other stakeholders concerning corporate responsibility, specifically related to environmental, social, and governance matters (“ESG”).

Some investors may use these non-financial performance factors to guide their investment strategies and, in some cases, may choose not to invest in us if they believe our ongoing policies and actions relating to corporate responsibility are inadequate.

We may face reputational damage in the event that we do not meet the ESG standards set by various constituencies.

Furthermore, if our competitors’ corporate social responsibility performance is perceived to be better than ours, potential or current investors may elect to invest with our competitors instead.

In addition, in the event that we communicate certain initiatives and goals regarding environmental, social, and governance matters, we could fail, or be perceived to fail, in our achievement of such initiatives or goals, or we could be criticized for the scope of such initiatives or goals.

If we fail to satisfy the expectations of investors, employees and other stakeholders or our initiatives are not executed as planned, our business may be harmed.

Risks Related to Employees and Managing Our Growth

The failure to attract and retain additional qualified personnel could prevent us from executing our business strategy.

The failure to attract and retain qualified personnel could prevent us from executing our business strategy.

To execute our business strategy, we must attract and retain highly qualified personnel.

3 unchanged sentences

The market for such talented personnel is competitive.

This competitive situation has become exacerbated by the increase in employee resignations currently taking place throughout the United States, in part as a result of the COVID-19 pandemic, which is commonly referred to as the “great resignation.” We have experienced significant unwanted employee attrition which we believe has been due to such competition, and we may continue to experience unwanted employee attrition in the future.

Many of the companies with which we compete for experienced personnel have greater resources than we do and can frequently offer such personnel substantially greater compensation than we can offer, including, in some cases, large equity packages and cash incentive bonuses.

1 unchanged sentence

If the perceived value of our equity awards declines, experiences significant volatility, or increases such that prospective employees believe there is limited upside to the value of our equity awards, it may adversely affect our ability to recruit and retain key employees.

Moreover, we face significant competition in hiring and attracting qualified employees in all aspects of our business, and the recent move by companies to offer a remote or hybrid work environment may increase the competition for such employees.

In order to manage attrition, including as a result of recent stock price decreases and market volatility on the perceived value of our equity awards, we have issued, and may continue to issue, additional equity awards and increased cash compensation to attract and retain employees, which may impact our results of operations or be dilutive to stockholders.

Moreover, the increase in the number of equity awards has reduced the number of shares available for us to grant under our equity incentive plan.

We also face significant competition in hiring and attracting qualified employees in all aspects of our business, and the move by companies to offer a remote or hybrid work environment as a result of the COVID-19 pandemic may increase the competition for such employees.

If we fail to attract new personnel or fail to retain and motivate our current personnel, our ability to maintain and enhance our platform, develop and deliver new products, fix bugs, support our existing customers, attract new customers, respond to competitive pressures, and otherwise execute our business plan would be harmed.

We rely on the performance of highly skilled personnel, including our senior management and other key employees, and the loss of one or more of such personnel, or of a significant number of our team members, could harm our business.

We believe our success has depended, and continues to depend, on the efforts and talents of senior management and key personnel, including Artur Bergman, our Chief Architect and Executive Chairman and Joshua Bixby, our Chief Executive Officer.

We rely on the performance of highly skilled personnel, including our senior management and other key employees, and the loss or transition of one or more of such personnel, or of a significant number of our team members, could harm our business.

We believe that our success has depended, and continues to depend, on the efforts and talents of senior management and key employees, including Artur Bergman, our Chief Architect and Executive Chairman and Todd Nightingale, our Chief Executive Officer.

There have been, and from time to time, there may continue to be, changes in our management team resulting from the hiring or departure of executives and key employees, or the transition of executives within our business, which could disrupt our business.

Some of our executive officers and members of our management team have been with us for a short period of time and we are continuing to develop key functions within various aspects of our business.

For example, Todd Nightingale began serving as our new Chief Executive Officer, replacing Joshua Bixby, effective September 1, 2022.

Such changes in our executive management team may be disruptive to our business.

Some of our executive officers and members of our management team have been with us for a short period of time and we continue to develop key functions within various aspects of our business.

We are also dependent on the continued service of our existing software engineers because of the complexity of our platform.

Our senior management, including Mr.

Bergman and Mr.

Bixby, and key employees are employed on an at-will basis.

Nightingale and Mr.

Bergman, and key employees are employed on an at-will basis.

We cannot ensure that we will be able to retain the services of any member of our senior management or other key employees or that we would be able to timely replace members of our senior management or other key employees should any of them depart.

The loss of one or more of our senior management or other key employees could harm our business.

Our past rapid growth may not be indicative of our future growth and, if we resume growing rapidly, we may not be able to manage our growth effectively.

We have experienced substantial growth in various aspects of our business in prior periods.

For example, as of December 31, 2021, December 31, 2020, and December 31, 2019, our revenue was $354.3 million, $290.9 million, and $200.5 million, respectively.

Our past growth may not be indicative of our future growth and we may not be able to manage our growth effectively.

We have experienced growth in various aspects of our business in prior periods.

For example, for the years ended December 31, 2022, December 31, 2021, and December 31, 2020, our revenue was $432.7 million, $354.3 million and $290.9 million, respectively.

In addition, we are expanding, and expect to continue to expand in the future, our international operations.

For example, from December 31, 2021 to December 31, 2022, our edge network increased from 51 to 58 markets and from 31 to 34 countries that are outside of the United States.

We have also experienced significant growth in the number of customers, usage, and amount of data delivered across our platform.

We have also experienced growth in the number of customers, usage, and amount of data delivered across our platform.

This growth has placed, and may continue to place, significant demands on our corporate culture, operational infrastructure, and management.

Although our business has experienced significant growth

in the past, we cannot provide any assurance that our business will continue to grow at the same rate, or at all.

Although our business has experienced growth in the past, we cannot provide any assurance that our business will continue to grow at the same rate, or at all.

Overall growth of our business depends on a number of factors, including our ability to:

• address new and developing markets, such as large enterprise customers outside the United States;

• retain our existing employees in this period of "great resignation";

• recruit, hire, train, and manage additional qualified engineers and product managers;

7 unchanged sentences

• provide our customers with customer support that meets their needs;

• successfully identify and acquire or invest in businesses, products, or technologies that we believe could complement or expand our products, such as our acquisition of Signal Sciences;

• successfully identify and acquire or invest in businesses, products, or technologies that we believe could complement or expand our products;

• recruit experienced leaders and strategists to facilitate successful acquisitions and integrations.

9 unchanged sentences

There are no guarantees we will be able to grow our business in an efficient or timely manner, or at all.

If we fail to manage the growth of our business and operations effectively, the quality of our services and the efficiency of our operations could suffer,

which could adversely affect our business, financial condition, and results of operations.

If we fail to manage the growth of our business and operations effectively, the quality of our services and the efficiency of our operations could suffer, which could adversely affect our business, financial condition, and results of operations.

If we are unable to return to our prior level of growth, our business will be harmed.

6 unchanged sentences

As we grow and develop the systems and processes associated with being a public company, we may find it difficult to maintain these important aspects of our culture.

The recent increase in employee attrition we have experienced in part due to the ongoing “great resignation” has adversely affected our corporate culture, particularly now that our workforce has been fully virtual since March 2020 due to the COVID-19 pandemic.

In addition, while we have historically benefited from having a dispersed workforce, as we have grown and our resources have become more globally dispersed and our organizational management structures have become more complex, we have found it increasingly difficult to maintain these beneficial aspects of our corporate culture.

2 unchanged sentences

Risks Related to Our Financial Position and Need for Additional Capital

Our ability to timely raise capital in the future may be limited, or may be unavailable on acceptable terms, if at all, and debt or equity issued to raise additional capital may reduce the value of our Class A common stock.

We have funded our operations since inception primarily through payments received from our customers, sales of equity and debt securities, and borrowings under our credit facilities.

We cannot be certain when or if our operations will generate sufficient cash to fully fund our ongoing operations or the growth of our business, or our debt obligations.

We also intend to continue to make investments to support our business and may require additional funds to do so.

Our future capital requirements may vary materially from those currently planned and will depend on many factors, including our growth rate, market acceptance of our platform, the expansion of sales and marketing activities, strategic transactions, as well as overall economic conditions.

We may need to engage in equity or debt financings to secure additional funds, in particular if we are required to repay our outstanding convertible notes in cash.

Additional financing may not be available on favorable terms, if at all, and any additional financing will need to be in compliance with the terms of our Credit Agreement, dated as of February 16, 2021, by and among us as borrower, the lenders from time to time party thereto, and Silicon Valley Bank as a lender, the issuing lender and the swingline lender, and as administrative agent and collateral agent for the lenders ("Credit Agreement").

In addition, increases in interest rate levels could increase our cost of capital.

If adequate funds are not available on acceptable terms, we may be unable to invest in future growth opportunities, which could harm our business, operating results, and financial condition.

Furthermore, if we issue additional equity securities, stockholders will experience dilution, and the new equity securities could have rights senior to those of our Class A common stock.

Any debt financing we secure may have higher interest rates and could involve additional restrictive covenants relating to our capital raising activities and other financial and operational matters, which may make it more difficult for us to obtain additional capital and to pursue business opportunities,

including potential acquisitions.

If we were to violate such restrictive covenants, we could incur penalties, increased expenses and an acceleration of the payment terms of our outstanding debt, which could in turn harm our business.

Because our decision to issue securities in future offerings will depend on numerous considerations, including factors beyond our control, we cannot predict or estimate the amount, timing, or nature of any future issuances of debt or equity securities.

As a result, our stockholders bear the risk of future issuances of debt or equity securities reducing the value of our Class A common stock and diluting their interests.

Seasonality may cause fluctuations in our sales and operating results.

6 unchanged sentences

To the extent we experience this seasonality, it may cause fluctuations in our operating results and financial metrics, and make forecasting our future operating results and financial metrics difficult.

Additionally, we do not have sufficient experience in selling certain of our products to determine if demand for these products are or will be subject to material seasonality.

Additionally, we do not have sufficient experience in selling certain of our products to determine if demand for these products is, or will be, subject to material seasonality.

Our current operations are international in scope and we plan on further geographic expansion, creating a variety of operational challenges.

3 unchanged sentences

Additionally, we have employees located throughout the world.

We are continuing to adapt to and develop strategies to address international markets but there is no guarantee that such efforts will have the desired effect.

We continue to adapt to and develop strategies to address international markets but there is no guarantee that such efforts will have the desired effect.

As of December 31, 2022, approximately 21% of our full-time employees were located outside of the United States.

We expect that our international activities will grow over the foreseeable future as we continue to pursue opportunities in existing and new international markets, which will require significant management attention and financial resources.

In connection with such expansion, we may face difficulties including costs associated with, varying seasonality patterns, potential adverse movement of currency exchange rates, longer payment cycle difficulties in collecting accounts receivable in some countries, tariffs and trade barriers, a variety of regulatory or contractual limitations on our ability to operate, adverse tax events, reduced protection of intellectual property rights in some countries, and a geographically and culturally diverse workforce and customer base.

In connection with such expansion, we may face difficulties including costs associated with varying seasonality patterns, potential adverse movement of currency exchange rates, longer payment cycles, difficulties in collecting accounts receivable in some countries, tariffs and trade barriers, a variety of regulatory or contractual limitations on our ability to operate, adverse tax events, reduced protection of intellectual property rights in some countries, and a geographically and culturally diverse workforce and customer base.

Failure to overcome any of these difficulties could harm our business.

1 unchanged sentence

• changes in a specific country’s or region’s political or economic conditions;

• greater difficulty collecting accounts receivable and longer payment cycles;

• longer payment cycles;

• greater difficulty collecting accounts receivable;

• potential or unexpected changes in trade relations, regulations, or laws;

1 unchanged sentence

• more stringent regulations relating to privacy and data security and the unauthorized use of, or access to, commercial and personal information, particularly in Europe;

• differing labor regulations, especially in Europe and Japan, where labor laws are generally more advantageous to employees as compared to the United States., including deemed hourly wage and overtime regulations in these locations;

• differing labor regulations, especially in Europe and Japan, where labor laws are generally more advantageous to employees as compared to the United States, including deemed hourly wage and overtime regulations in these

locations, and where potential labor organizing and works council negotiations in certain of those countries could contribute to increased operational costs or otherwise disrupt our business;

• challenges inherent in efficiently managing an increased number of employees over large geographic distances, including the need to implement appropriate systems, policies, benefits, and compliance programs;

2 unchanged sentences

• increased travel, real estate, infrastructure, and legal compliance costs associated with international operations;

• currency exchange rate fluctuations and the resulting effect on our revenue and expenses, and the cost and risk of entering into hedging transactions if we chose to do so in the future;

• currency exchange rate fluctuations and the resulting effect on our revenue and expenses, and the cost and risk of entering into hedging transactions if we choose to do so in the future;

• challenges related to providing support and developing products in foreign languages;

2 unchanged sentences

• potential tariffs and trade barriers;

• limited or insufficient intellectual property protection or difficulties enforcing our intellectual property;

• political instability or terrorist activities;

• limited or insufficient intellectual property protection or difficulties enforcing our intellectual property rights;

• political instability, economic sanctions, terrorist activities, or international conflicts, including the ongoing conflict between Russia and Ukraine, which may impact the operations of our business or the businesses of our customers;

• inflationary pressures, such as those the global market is currently experiencing, labor shortages and supply chain disruptions, which may increase costs for certain services;

• exposure to liabilities under anti-corruption and anti-money laundering laws, and similar laws and regulations in other jurisdictions;

3 unchanged sentences

If we invest substantial time and resources to further expand our international operations and are unable to do so successfully and in a timely manner, our business may be harmed.

Our ability to timely raise capital in the future may be limited, or may be unavailable on acceptable terms, if at all, and our failure to raise capital when needed could harm our business, and debt or equity issued to raise additional capital may reduce the value of our Class A common stock.

We have funded our operations since inception primarily through payments received from our customers, sales of equity and debt securities, and borrowings under our credit facilities.

We cannot be certain when or if our operations will generate sufficient cash to fully fund our ongoing operations or the growth of our business.

We intend to continue to make investments to support our business and may require additional funds.

For example, on October 1, 2020 we acquired Signal Sciences for an aggregate purchase price of $759.4 million, consisting of approximately $223.0 million in cash and 6,367,709 shares of our Class A common stock, including 896,499 shares which are restricted as they are subject to revesting conditions.

The aggregate purchase price reflects the value of the net shares issued, which excludes the above mentioned shares that are restricted.

We may need to engage in equity or debt financings to secure additional funds.

Additional financing may not be available on favorable terms, if at all and any additional financing will need to be in compliance with the terms of our Credit Agreement, dated as of February 16, 2021, by and among us as borrower, the lenders from time to time party thereto, and Silicon Valley Bank as a lender, the issuing lender and the swingline lender, and as administrative agent and collateral agent for the lenders ("Credit Agreement").

If adequate funds are not available on acceptable terms, we may be unable to invest in future growth opportunities, which could harm our business, operating results, and financial condition.

Furthermore, if we issue additional equity securities, stockholders will experience dilution, and the new equity securities could have rights senior to those of our Class A common stock.

Any debt financing we secure could involve additional restrictive covenants relating to our capital raising activities and other financial and operational matters, which may make it more difficult for us to obtain additional capital and to pursue business opportunities, including potential acquisitions.

If we were to violate such restrictive covenants, we could incur penalties, increased expenses and an acceleration of the payment terms of our outstanding debt, which could in turn harm our business.

As a result, our stockholders bear the risk of future issuances of debt or equity securities reducing the value of our Class A common stock and diluting their interests.

If our estimates or judgments relating to our critical accounting policies prove to be incorrect, our results of operations could be adversely affected.

If our estimates or judgments relating to our critical accounting estimates prove to be incorrect, our results of operations could be adversely affected.

The preparation of financial statements in conformity with generally accepted accounting principles in the United States ("U.S.

GAAP") requires management to make estimates and assumptions that affect the amounts reported in the consolidated financial statements and accompanying notes.

We base our estimates on historical experience and on various other assumptions that we believe to be reasonable under the circumstances, as provided in the section titled “Management’s Discussion and Analysis of Financial Condition and Results of Operations—Critical Accounting Policies.” The results of these estimates form the basis for making judgments about the carrying values of assets, liabilities, and equity and the amount of revenue and expenses that are not readily apparent from other sources.

We base our estimates on historical experience and on various other assumptions that we believe to be reasonable under the circumstances, as provided in the section titled “Management’s Discussion and Analysis of Financial Condition and Results of Operations—Critical Accounting Estimates.” The results of these estimates form the basis for making judgments about the carrying values of assets, liabilities, and equity and the amount of revenue and

expenses that are not readily apparent from other sources.

Significant assumptions and estimates used in preparing our consolidated financial statements include, but are not limited to, those related to revenue, accounts receivable and related reserves, fair value of assets acquired and liabilities assumed for business combinations, useful lives and realizability of long-lived assets including our goodwill and intangible assets, income tax reserves, and accounting for stock-based compensation.

9 unchanged sentences

If we are unable to obtain adequate financing or financing on terms that are satisfactory to us when we require it, our ability to continue to support our business growth and to respond to business challenges could be significantly impaired, and our business may be harmed.

We have identified three material weaknesses in our internal control over financial reporting, and if we are unable to remediate and maintain effective internal control over financial reporting in the future, investors may lose confidence in the accuracy and completeness of our financial reports, and the market price of our Class A common stock may be seriously harmed.

If we are unable to maintain effective internal control over financial reporting in the future, investors may lose confidence in the accuracy and completeness of our financial reports, and the market price of our Class A common stock may be seriously harmed.

As a public company, we are required to maintain internal control over financial reporting and to report any material weaknesses in those internal controls.

3 unchanged sentences

That process is time-consuming, costly, and complicated.

As further detailed in Item 9A in this report, we and our independent registered public accounting firm identified material weaknesses in our internal control over financial reporting for the years ended December 31, 2021, 2020, 2019 and 2018, some of which were newly identified in the year ended December 31, 2021 and one was originally identified in prior years and remains partially unremediated for the year ended December 31, 2021.

The material weaknesses related to the lack of sufficient qualified accounting resources, lack of timely and complete identification of internal-use software costs for capitalization, and a system implementation of our stock plan administration system.

We previously reported a material weakness in our Annual Reports on Form 10-K for the years ended December 31, 2020 and December 31, 2019.

The process of implementing an effective financial reporting system is a continuous effort that requires us to anticipate and react to changes in our business and the economic and regulatory environments and to expand significant resources to maintain a financial reporting system that is adequate to satisfy our reporting obligations.

We previously reported and have subsequently remediated material weaknesses in our internal control over financial reporting.

We continue to evaluate and take actions to improve our internal control over financial reporting.

To remediate the material weakness related to a lack of sufficient, qualified finance and accounting resources commensurate with the complexity of the Company's operations and financial reporting requirements, we will continue to hire, retain and oversee qualified finance and accounting resources to support the Company, including external advisors when appropriate, and add enhanced quarterly reporting of the remediation measures and process to the Audit Committee of the Board of Directors.

To remediate the material weakness in internal control over financial reporting during the quarter ended September 30, 2021 related to our accounting for internal-use software costs, we will continue to enhance our process and expand our review controls to ensure complete and timely identification of internal use software costs subject to capitalization, implement additional training of finance, accounting and other Company personnel involved in this process, and work with qualified external advisors to support these efforts.

To remediate the material weakness in internal control over financial reporting during the year ended December 31, 2021 related to the design of controls for system implementations associated with a migration of our stock plan administration system, we will update the design and review of controls for system implementations, continue to leverage internal expertise in systems implementation for the design of controls, and work with qualified external advisors to support these efforts.

We cannot assure you that the measures we have taken to date and plan to take will be sufficient to remediate the material weaknesses we identified or avoid the identification of additional material weaknesses in the future.

If we fail to remediate our existing material weaknesses or identify future material weaknesses in our internal control over financial reporting, if we are unable to comply with the requirements of Section 404 or assert that our internal control over financial reporting is effective, or if our independent registered public accounting firm is unable to express an unqualified opinion or expresses a qualified or adverse opinion about the effectiveness of our internal control over financial reporting, investors may lose confidence in the accuracy and completeness of our financial reports and the market price of our Class A common stock could be negatively affected.

Moreover, any failure to remediate the material weaknesses, or the identification of new material weaknesses in our internal control over financial reporting, could result in material misstatements in our financial statements that may continue undetected and cause us to fail to meet our reporting and financial obligations or incur significant additional costs to remediate the material weaknesses, each of which could harm our ability to raise capital on favorable terms in the future or otherwise have a negative impact on our financial condition.

However, we cannot assure you that the measures we have taken to date will be sufficient to avoid the identification of material weaknesses in the future.

If we fail to identify future material weaknesses in our internal control over financial reporting, if we are unable to comply with the requirements of Section 404 or assert that our internal control over financial reporting is effective, or if our independent registered public accounting firm is unable to express an unqualified opinion or expresses a qualified or adverse opinion about the effectiveness of our internal control over financial reporting, investors may lose confidence in the accuracy and completeness of our financial reports and the market price of our Class A common stock could be negatively affected.

Moreover, any failure to identify new material weaknesses in our internal control over financial reporting, could result in material misstatements in our financial statements that may continue undetected and cause us to fail to meet our reporting and financial obligations or incur significant additional costs to remediate new material weaknesses, each of which could harm our ability to raise capital on favorable terms in the future or otherwise have a negative impact on our financial condition.

In addition, we could become subject to investigations by the New York Stock Exchange (the "NYSE"), the SEC, and other regulatory authorities, which could require additional financial and management resources.

3 unchanged sentences

For example, we may not be able to effectively monitor certain extraordinary contract requirements or provisions that are individually negotiated by our sales force as the number of transactions continues to grow.

Moreover, as we continue to improve our pricing structure, we will need to implement corresponding improvements to our systems around payment of sales commissions.

In addition, our systems and processes may not prevent or detect all errors, omissions, or fraud.

We may experience difficulties in managing improvements to our systems, processes, and controls or in connection with third-party software, which could impair our ability to offer our platform to our customers in a timely manner, causing us to lose customers, limit us to smaller deployments of our products, or increase our technical support costs.

We may experience difficulties in managing improvements to our systems, processes, and controls or in connection with third-party software, which could impair our ability to manage our business, pay sales commissions, or offer our platform to our customers in a timely manner, causing us to lose customers or employees, limit our growth, limit us to smaller deployments of our products, or increase our technical support costs.

Our financial results may be adversely affected by changes in accounting principles applicable to us.

GAAP are subject to interpretation by the Financial Accounting Standards Board ("FASB"), the SEC and other various bodies formed to promulgate and interpret appropriate accounting principles.

GAAP are subject to interpretation by the Financial Accounting Standards Board, the SEC and other various bodies formed to promulgate and interpret appropriate accounting principles.

A change in these principles or interpretations could have a significant effect on our reported financial results for periods prior to and subsequent to such change, and could affect the reporting of transactions completed before the announcement of a change.

15 unchanged sentences

As a result, we could lose the ability to contract with current or potential customers and usage of our platform may decrease by affected customers, which could harm our business and reputation.

For example, our largest customer during the year ended December 31, 2020 had strong business ties to China and significantly reduced its usage of our platform.

We believe this was in response to various actions taken by the United States and other governments against them.

Even in the absence of new restrictions or trade actions imposed by the United States or other governments, our customers that operate in China, target China as a market, or that have strong business ties to China, may take actions to reduce dependence on our platform, which could harm our business.

We are subject, or may become subject, to governmental regulation and other legal obligations, particularly those related to privacy, data protection, infrastructure, and information security, and our actual or perceived failure to comply with such obligations could harm our business, by resulting in litigation, fines, penalties, or adverse publicity and reputational damage, and other adverse consequences that may negatively affect the value of our business and decrease the price of our Class A common stock.

Compliance with such laws could also result in additional costs and liabilities to us or inhibit sales of our products.

We receive, store, process, collect, generate, use transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share personal information and other data from and about actual and prospective customers and users, in addition to our employees and service providers.

In addition, our customers use our platform to collect personally identifiable information, personal health information, and personal financial information from their end-users.

Our handling of data is subject to a variety of laws and regulations, including regulation by various government agencies, such as the United States Federal Trade Commission ("FTC"), and various state, local, and foreign agencies.

Our data handling also is subject to contractual obligations, internal and external privacy and security policies, guidance, industry standards, and other obligations that govern the processing of personal information by us and on our behalf.

Additionally, we are, or may become, subject to various other laws and regulations around the world with respect to the internet related to, among other things, content liability, security requirements, critical infrastructure designations, internet resiliency, law enforcement access to information, net neutrality, data localization requirements, and restrictions on social media or other content, any of which can have a material impact on our business.

Domestically, states have also begun to introduce more comprehensive privacy legislation, including data breach notification laws, personal information privacy laws, and consumer protection laws.

For example, the California Consumer Privacy Act of 2018 (“CCPA”) affords consumers expanded privacy protections.

The CCPA gives California residents, among other things, expanded rights to access and require deletion of their personal information, opt out of certain personal information sharing, and receive detailed information about how their personal information is used.

The CCPA also allows for statutory fines for noncompliance (up to $7,000 per violation), as well as a private right of action for data breaches that may increase data breach litigation.

It is anticipated that the CCPA will be expanded substantially on January 1, 2023, when the California Privacy Rights Act of 2020 (“CPRA”) comes into effect.

The CPRA among other things, establishes a new California Protection Agency to implement and enforce the CPRA, which could increase the risk of enforcement actions.

The CCPA marks a trend toward more stringent privacy, data protection, and information security legislation in the United States.

Privacy, data protection, and information security laws have been proposed at the federal, state, and local levels that, if passed, could increase our potential liability, increase our compliance costs and adversely affect our business.

For example, recently Virginia passed the Consumer Data Protection Act and Colorado passed the Colorado Privacy Act, both of which differ from the CPRA and become effective in 2023.

We are subject, or may become subject, to stringent and evolving U.S.

and foreign laws, governmental regulations, rules, contractual obligations, policies and other legal obligations related to privacy, infrastructure, and data security.

Our actual or perceived failure to comply with such obligations could harm our business, by resulting in regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, adverse publicity and reputational damage, loss of revenue or profits, loss of customers or sales and other adverse consequences that may negatively affect the value of our business and decrease the price of our Class A common stock.

Compliance with such obligations could also result in costs and liabilities to us or inhibit sales of our products.

We receive, store, process, collect, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share personal information and other proprietary, confidential, and sensitive data, including intellectual property, trade secrets, encryption keys, and including our data and data of our customers (including their end-users).

Our handling of data is subject to a variety of obligations related to privacy and data security, contractual obligations, internal and external privacy policies, guidance, industry standards, and other obligations that govern the processing of personal information.

Additionally, we are or may become subject to other laws and regulations around the world with respect to the internet related to, among other things, content liability, security requirements, critical infrastructure designations, internet resiliency, law enforcement access to information, net neutrality, data localization requirements, and restrictions on social media or other content.

In the United States, federal, state, and local governments have enacted numerous privacy and data security laws, including data breach notification laws, personal data privacy laws, consumer protection laws (e.g., Section 5 of the FTC Act), and other similar laws (e.g., wiretapping laws).

Domestically, states have also begun to introduce more comprehensive privacy and data security legislation, including data breach notification laws, personal information privacy laws, and consumer protection laws.

For example, the California Consumer Privacy Act of 2018 (“CCPA”) applies to personal information of consumers, business representatives, and employees, and requires businesses to provide specific disclosures in privacy notices and honor requests of California residents to exercise certain privacy rights.

The CCPA also allows for statutory fines for noncompliance (up to $7,500 per violation), as well as a private right of action for individuals affected by certain data breaches to recover significant statutory damages.

In addition, the California Privacy Rights Act of 2020 expands the CCPA's requirements, including by adding a new right for individuals to correct their personal information and establishing a new agency to implement and enforce the law.

Other states, such as Virginia, Colorado, Utah and Connecticut, have also passed comprehensive privacy and data security laws, and similar laws have been proposed at the federal, state, and local levels that, if passed, could increase our potential liability, increase our compliance costs and adversely affect our business.

Additionally, several states and localities have enacted measures related to the use of artificial intelligence (“AI") and machine learning in products and services.

The laws and regulations relating to privacy and data security are evolving, can be subject to significant change and may result in ever-increasing regulatory and public scrutiny and escalating levels of enforcement and sanctions.

In addition, the United States or foreign jurisdictions may establish new laws or regulations regarding the internet or online services.

These new laws and regulations may affect our products and infrastructure, which could cause us to incur substantial costs to comply, expose us to regulatory scrutiny, criminal or civil liability, require us to fundamentally change our products or operations, or otherwise have an adverse effect on our business.

If we become subject to new privacy, data protection, and information security laws at the state level, the risk of enforcement action against us could increase because we may become subject to additional obligations, and the number of individuals or entities that can initiate actions against us may increase (including individuals and state actors).

In addition, an increasing number of foreign laws and regulations apply to privacy, data protection, and information security.

For example, the EU GDPR, the U.K.

GDPR, Brazil’s General Data Protection Law (Lei Geral de Proteção de Dados Pessoais or “LGPD”) (Law No.

Outside of the United States, an increasing number of foreign laws and regulations apply to privacy and data security.

For example, the European Union’s General Data Protection Regulation (“EU GDPR”), the United Kingdom’s GDPR (“UK GDPR”), Brazil’s General Data Protection Law (Lei Geral de Proteção de Dados Pessoais or “LGPD”) (Law No.

13,709/2018), Canada’s Personal Information Protection and Electronic Documents Act (“PIPEDA”) and Canada’s Anti-Spam Legislation (“CASL”), and China’s Personal Information Protection Law (“PIPL”) impose strict requirements for processing the personal information of individuals.

European legislative proposals and existing laws and regulations apply to cookies and similar tracking technologies, electronic communications, and marketing.

For example, under the EU GDPR and UK GDPR, government regulators may impose restrictions or injunctions on data processing, and fines of up to 20 million euros (£17.5 million for the UK GDPR) or 4% of annual global revenue, whichever is greater.

The EU GDPR also provides for private litigation related to the processing of personal information, which can be brought by classes of data subjects or consumer protection organizations authorized by law to represent the interests of such classes.

European legislative proposals and existing laws and regulations also apply to cookies and similar tracking technologies, electronic communications, and marketing.

In the EU and the UK, regulators are increasingly focusing on compliance with requirements related to the online behavioral advertising ecosystem.

2 unchanged sentences

Furthermore, there is a proposed regulation in the EU related to AI that, if adopted, could impose onerous obligations related to the use of AI-related systems that may require us to change our business practices.

Under the EU GDPR and U.K.

GDPR, government regulators may impose restrictions or injunctions on data processing, and fines of up to 20 million euros (£17.5 million for the U.K.

GDPR) or 4% of annual global revenue, whichever is greater.

Further, individuals may initiate litigation related to our processing of their personal information.

Certain jurisdictions have enacted data localization laws and cross-border personal information transfer laws, which could make it more difficult to transfer information across jurisdictions (such as transferring or receiving personal information that originates in the EU).

Existing mechanisms that may facilitate cross-border personal information transfers may change or be invalidated.

For example, absent appropriate safeguards or other circumstances, the EU GDPR generally restricts the transfer of personal information to countries outside of the European Economic Area (“EEA”) which the European Commission does not consider as providing an adequate level of protection of personal information, such as the United States.

The European Commission recently released a set of Standard Contractual Clauses (“SCCs”) that are designed to be a valid mechanism by which entities can transfer personal information out of the EEA.

Currently, the SCCs are a valid mechanism to transfer personal information, but impose obligations onto parties relying on them such as to conduct transfer impact assessments to determine whether additional security measures are necessary to protect the transferred personal information.

Moreover, due to potential legal challenges, uncertainty exists regarding whether the SCCs will remain a valid mechanism for transfers of personal information out of the EEA.

In addition, laws in Switzerland and the UK similarly restrict transfers of personal information outside of those jurisdictions to countries such as the United States.

Certain jurisdictions have enacted data localization laws and cross-border personal information transfer laws, which could make it more difficult to transfer information across jurisdictions.

In particular, the European Economic Area (“EEA”) and the United Kingdom (“UK”) have significantly restricted the transfer of personal information to the United States and other countries whose privacy and data security laws are believed to be inadequate.

Other jurisdictions may adopt similarly stringent interpretations of their data localization and cross-border personal information transfer laws.

Although there are currently various mechanisms that may be used to lawfully transfer personal information to the United States, such as the standard

contractual clauses for transfers from the EEA and UK, these mechanisms are subject to legal challenges and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal information to the United States or elsewhere.

Certain countries outside Europe (e.g.

Russia, China, Brazil) have also passed or are considering laws requiring local data residency or otherwise impeding the transfer of personal information across borders, any of which could increase the cost and complexity of doing business.

If we cannot implement a valid compliance mechanism for cross-border data transfers, we may face increased exposure to regulatory actions, substantial fines, and injunctions against processing or transferring personal information from Europe or other foreign jurisdictions.

The inability to import personal information to the United States could significantly and negatively impact our business operations, limiting our ability to collaborate with parties that are subject to such cross-border data transfer or localization laws, or requiring us to increase our personal information processing capabilities and infrastructure in foreign jurisdictions at significant expense.

The scope and interpretation of the laws that are or may be applicable to us are often uncertain and may be conflicting as a result of the rapidly evolving regulatory framework for privacy and internet issues worldwide.

For example, laws relating to the liability of providers of online services for activities of their users and other third parties are currently being tested by a number of claims, including actions based on invasion of privacy and other torts, unfair competition, copyright and trademark infringement, and other theories based on the nature and content of the materials searched, the ads posted, or the content provided by users.

If there is no lawful manner for us to transfer personal information from the EEA, the UK or other jurisdictions to the United States or elsewhere, or if the requirements for a legally-compliant transfer are too onerous, we may face significant adverse consequences, such as the interruption or degradation of our operations, increased exposure to regulatory actions, substantial fines, injunctions against processing or transferring personal information, determinations by customers not to use our services, limited ability to collaborate with parties that are subject to cross-border data transfer or localization laws, and the need to increase or relocate our personal information processing capabilities and infrastructure in foreign jurisdictions at significant expense.

Additionally, companies that transfer personal information out of the EEA and UK to other jurisdictions, particularly to the United States, are subject to increased scrutiny from regulators, individual litigants, and activist groups.

Some European regulators have ordered certain companies to suspend or permanently cease certain transfers out of Europe for allegedly violating the EU GDPR’s cross-border data transfer limitations.

In addition to government regulation, privacy advocates, and industry groups may propose new and different self-regulatory standards that may apply to us.

We may publish privacy policies, marketing materials and other statements, such as compliance with certain certifications or self-regulatory principles, regarding privacy and data security.

If these policies, materials or statements are found to be deficient, lacking in transparency, deceptive, unfair, or misrepresentative of our practices, we may be subject to investigation, enforcement actions by regulators or other adverse consequences.

We may also be bound by contractual obligations related to privacy and data security, and our efforts to comply with such obligations may not be successful.

For example, certain privacy and data security laws, such as the EU GDPR and the CCPA, require our customers to impose specific contractual restrictions on their service providers.

Additionally, in limited circumstances, under various privacy and data security laws and other obligations, we may be required to obtain certain consents to process personal information.

Our inability or failure to do so could result in adverse consequences.

Laws relating to the liability of providers of online services for activities of their users and other third parties are currently being tested by a number of claims, including actions based on invasion of privacy and other torts, unfair competition, copyright and trademark infringement, and other theories based on the nature and content of the materials searched, the ads posted, or the content provided by users.

Moreover, our global platform outage in June 2021 has increased our public profile and resulted in more frequent interest in our company by regulators.

This outage, or any additional outages, may draw additional scrutiny or focused legislation from regulators.

As a result of the laws that are or may be applicable to us, and due to the sensitive nature of the information we collect, we have implemented policies and procedures to preserve and protect our data and our customers’ data against loss, misuse, corruption, misappropriation caused by systems failures, unauthorized access, or misuse.

If our policies, procedures, or measures relating to privacy, data protection, marketing, or customer communications fail to comply with laws, regulations, policies, legal obligations, or industry standards, we may be subject to governmental enforcement actions, litigation, regulatory investigations, fines, penalties, and negative publicity which could cause our application providers, customers, and partners to lose trust in us, and have an adverse effect on our business, operating results, and financial condition.

In addition to government regulation, privacy advocates, and industry groups may propose new and different self-regulatory standards that may apply to us.

Because the interpretation and application of privacy and data protection laws, regulations, rules, and other standards are still uncertain, it is possible that these laws, rules, regulations, and other actual or alleged legal obligations, such as contractual or self-regulatory obligations, may be interpreted and applied in a manner that is inconsistent with our existing data management practices or the functionality of our platform.

If so, in addition to the possibility of fines, lawsuits, and other claims, we could be required to fundamentally change our business activities and practices or modify our software, which could have an adverse effect on our business.

Preparing for and complying with these obligations requires significant resources and may necessitate changes to our information technologies, systems, and practices and to those of any third parties that process personal information on our behalf.

Any failure or perceived failure by us or third parties upon whom we rely to comply with laws, regulations, policies, legal, or contractual obligations, industry standards, or regulatory guidance relating to privacy or data security, may result in governmental investigations and enforcement actions (including, for example, a ban by EU Supervisory Authorities), litigation, fines and penalties, additional reporting requirements and/or oversight, orders to destroy or not use personal information or adverse publicity, and could cause our customers and partners to lose trust in us, which could have an adverse effect on our reputation and business.

Our obligation to assist our customers in their compliance with laws, regulations, and policies, like data processing and data protection requirements under the EU GDPR and U.K GDPR may also result in government enforcement actions litigation, fines and penalties, or adverse publicity.

Future laws, regulations, standards, and other obligations or any changed interpretation of existing laws or regulations could impair our ability to develop and market new functionality and maintain and grow our customer base and increase revenue.

In addition, the United States or foreign jurisdictions may establish new laws or regulations regarding the internet or online services.

Obligations relating to privacy and data security are evolving, increasingly stringent, creating regulatory uncertainty, and may result in increasing scrutiny.

Such obligations may be subject to different applications and interpretations, and which may be inconsistent and conflicting among different jurisdictions.

Preparing for and complying with these obligations require us to devote significant resources and may necessitate changes to our services, information technologies, systems, and practices and to those of any third parties that process personal information on our behalf.

Because the interpretation and application of privacy and data security related obligations are uncertain, they may be interpreted or applied in a manner that is inconsistent with our existing data management practices or the functionality of our platform.

We could be required to fundamentally change our business activities and practices or modify our software, which could have an adverse effect on our business.

Future restrictions on the collection, use, sharing, or disclosure of data or additional requirements for express or implied consent of our customers, partners, or end-users for the use and disclosure of such information could require us to incur additional costs or modify our platform, possibly in a material manner, and could limit our ability to develop new functionality.

If we are not able to comply with these laws or regulations or if we become liable under these laws or regulations, we could be directly harmed, and we may be forced to implement new measures to reduce our exposure to this liability.

This may require us to expend substantial resources or to discontinue certain products, which would negatively affect our business, financial condition, and results of operations.

In addition, the increased attention focused upon liability issues as a result of lawsuits and legislative proposals could harm our reputation or otherwise adversely affect the growth of our business.

Furthermore, any costs incurred as a result of this potential liability could harm our operating results.

We may at times fail (or be perceived to have failed) in our efforts to comply with our privacy and data security obligations.

Moreover, despite our efforts, our personnel or third parties on whom we rely may fail to comply with such obligations, which could negatively impact our business operations.

Any failure or perceived failure by us or third parties upon whom we rely to comply with obligations, relating to privacy and data security may result in significant consequences including but not limited to governmental investigations and enforcement actions (e.g., investigations, fines, penalties, audits, inspections, and similar), litigation (including class-action claims), additional reporting requirements and/or oversight, bans on processing personal data, and orders to destroy or not use personal information.

Any of these events could have a material adverse effect on our reputation, business, or financial condition, including but not limited to:

loss of customers;

interruptions or stoppages in our business operations;

inability to process personal information or to operate in certain jurisdictions;

limited ability to develop or commercialize our products;

expenditure of time and resources to defend any claim or inquiry;

adverse publicity;

or substantial changes to our business model or operations.

Our sales to highly regulated organizations and government entities are subject to a number of challenges and risks.

17 unchanged sentences

Trade associations representing internet service providers appealed the district court’s ruling denying the preliminary injunction, and the appeal was denied on January 28, 2022.

This decision could be appealed to the full court of appeals or the Supreme Court, or the parties could return to the trial court for further proceedings to determine whether a permanent injunction should be granted.

The trade associations sought rehearing with the full court of appeal, and on April 20, 2022 it declined to rehear the case.

The appellants did not appeal to the U.S.

Supreme Court.

A number of other states have adopted or are adopting or considering legislation or executive actions that would regulate the conduct of broadband providers.

For instance, a temporary injunction preventing implementation of a similar law in Vermont expired on April 20, 2022, but the challenge to that law remains pending.

We cannot predict whether the FCC order or other state initiatives will be enforced, modified, overturned, or vacated by legal action of the court, federal legislation, or the FCC.

21 unchanged sentences

• Changes in the relative amounts of income before taxes in the various jurisdictions in which we operate that have differing statutory tax rates;

• Changes in tax laws, tax treaties, and regulations or the interpretation of them, including the Tax Act;

• Changes in tax laws, tax treaties, and regulations or the interpretation of them;

• Changes to our assessment about our ability to realize our deferred tax assets that are based on estimates of our future results, the prudence and feasibility of possible tax planning strategies, and the economic and political environments in which we do business;

4 unchanged sentences

An increasing number of states have considered or adopted laws that attempt to impose tax collection obligations on out-of-state companies.

Additionally, the Supreme Court of the United States recently ruled in South Dakota v.

Additionally, the Supreme Court of the United States ruled in South Dakota v.

Wayfair, Inc.

et al ("Wayfair") that online sellers can be required to collect sales and use tax despite not having a physical presence in the buyer’s state.

et al ("Wayfair") that online sellers can be required to collect sales and use tax despite not having a physical presence in the buyer’s

In response to Wayfair, or otherwise, states or local governments may adopt, or begin to enforce, laws requiring us to calculate, collect, and remit taxes on sales in their jurisdictions.

A successful assertion by one or more states requiring us to collect taxes where we presently do not do so, or to collect more taxes in a jurisdiction in which we currently do collect some taxes, could result in substantial tax liabilities, including taxes on past sales, as well as penalties and interest.

A successful assertion by one or more jurisdictions requiring us to collect taxes where we presently do not do so, or to collect more taxes in a jurisdiction in which we currently do collect some taxes, could result in substantial tax liabilities, including taxes on past sales, as well as penalties and interest.

The imposition by state governments or local governments of sales tax collection obligations on out-of-state sellers could also create additional administrative burdens for us, put us at a competitive disadvantage if they do not impose similar obligations on our competitors and decrease our future sales, which could harm our business.

4 unchanged sentences

We operate, and are subject to taxes, in the United States and numerous other jurisdictions throughout the world.

Changes to federal, state, local, or international tax laws on income, sales, use, indirect, or other tax laws, statutes, rules, regulations, or ordinances on multinational corporations are currently being considered and have recently been proposed by the United States and other countries where we do business.

Changes to federal, state, local, or international tax laws on income, sales, use, indirect, or other tax laws, statutes, rules, regulations, or ordinances on multinational corporations are currently being considered by the United States and other countries where we do business.

These contemplated legislative initiatives include, but are not limited to, changes to transfer pricing policies and definitional changes to permanent establishment that could be applied solely or disproportionately to services provided over the internet.

2 unchanged sentences

The additional tax obligations could relate to our taxes or obligations to report or withhold on customer taxes.

We could take steps to collect customer related taxes, but if we are unsuccessful in collecting such

taxes from our customers, we could be held liable for such costs, thereby adversely impacting our operating results and cash flows.

We could take steps to collect customer related taxes, but if we are unsuccessful in collecting such taxes from our customers, we could be held liable for such costs, thereby adversely impacting our operating results and cash flows.

Further, if our customers must pay additional fines or penalties, it could adversely affect demand for our services.

On December 22, 2017, President Trump signed into law H.R.

1, “An Act to provide for reconciliation pursuant to titles II and V of the concurrent resolution on the budget for fiscal year 2018,” informally titled the Tax Act, which significantly revises the Code.

The Tax Act, among other things, reduces the corporate tax rate from a top marginal rate of 35% to a flat rate of 21%, limits the tax deduction for interest expense to 30% of adjusted taxable income (except for certain small businesses), limits the deduction for net operating losses carried forward from taxable years beginning after December 31, 2017 to 80% of current year taxable income, eliminates net operating loss carrybacks, imposes a one-time tax on offshore earnings at reduced rates regardless of whether they are repatriated, eliminates United States tax on foreign earnings (subject to certain important exceptions), allows immediate deductions for certain new investments instead of deductions for depreciation expense over time, and modifies or repeals many business deductions and credits.

Notwithstanding the reduction in the corporate income tax rate, the overall impact of the Tax Act is uncertain and our business and financial condition could be adversely affected.

In addition, it is uncertain if and to what extent various states will conform to the Tax Act.

The impact of the Tax Act on holders of our Class A common stock is also uncertain and could be adverse.

More recently, on March 18, 2020, the Families First Coronavirus Response Act ("FFCR Act"), and on March 27, 2020, the Coronavirus Aid, Relief, and Economic Security Act ("CARES Act") were each enacted in response to the COVID-19 pandemic.

The FFCR Act and the CARES Act contain numerous income tax provisions, such as relaxing limitations on the deductibility of interest and the use of net operating losses arising in taxable years beginning after December 31, 2017.

In December 2020, the Consolidated Appropriations Act, 2021 ("CAA") was signed into law.

The CAA included additional funding through tax credits as part of its economic package for 2021.

The Company evaluated these items in its tax computation and determined that the items do not have a material impact on the Company’s financial statements as of and for the year ended December 31, 2021.

Future regulatory guidance under the FFCR Act, the CARES Act, as well as under the Tax Act, or other executive or Congressional actions in the United States (including, for example, if the Made in America tax plan released in March 2021 were to become law) remain forthcoming, and such guidance could ultimately increase or lessen the impact on our business and financial condition.

It is also possible that Congress will enact additional legislation in connection with the COVID-19 pandemic, some of which could materially impact our operations and financial results.

Legislation in 2017 informally titled the “Tax Act” significantly revised the Internal Revenue Code of 1986, as amended (the “Code”).

Recently, the Inflation Reduction Act of 2022 (the "IRA") was enacted, which includes provisions that will impact the U.S.

federal income taxation of corporations, including imposing a minimum tax on the book income of certain large corporations and an excise tax on certain corporate stock repurchases that would be imposed on the corporation repurchasing such stock.

Future legislation or regulatory guidance, including under the Tax Act or the IRA, or other executive or Congressional actions in the United States may occur, and could ultimately increase or lessen the impact of such taxes on our business and financial condition.

We urge our stockholders to consult with their legal and tax advisors with respect to this legislation and the potential tax consequences of investing in or holding our Class A common stock.

1 unchanged sentence

Our net operating loss ("NOL") carryforwards could expire unused and be unavailable to offset future income tax liabilities because of their limited duration or because of restrictions under United States tax law.

Our NOLs generated in tax years ending on or prior to December 31, 2017 are only permitted to be carried forward for 20 years under applicable United States tax law.

Under the Tax Act, our federal NOLs generated in tax years ending after December 31, 2017 may be carried forward indefinitely, but the deductibility of such federal NOLs is limited.

It is uncertain if and to what extent various states will conform to the Tax Act.

In addition, under Section 382 of the United States Internal Revenue Code of 1986, as amended (the "Code"), a corporation that undergoes an "ownership change" is generally subject to limitations on its ability to utilize its pre-change NOLs to offset future taxable income.

We may have experienced ownership changes in the past and may experience ownership changes in the future as a result of subsequent shifts in our stock ownership (some of which shifts are outside our control).

federal income tax purposes, our NOLs generated in tax years beginning before January 1, 2018 are permitted to be carried forward for 20 years.

federal NOLs generated in tax years beginning after December 31, 2017 may be carried forward indefinitely, but for tax years beginning after December 31, 2020, our use of such federal NOLs generally is limited to 80% of such year's taxable income, computed without regard to the NOL deduction and certain other deductions.

It is uncertain if, and to what extent, various states will conform to these limitations on the use of federal NOLs.

In addition, under Section 382 of the Code, a corporation that undergoes an "ownership change" may be subject to limitations on its ability to utilize its pre-change NOLs to offset future taxable income.

A detailed analysis was performed through December 31, 2021 for us to determine whether an ownership change under Section 382 of the Code has occurred, and ownership changes were identified in 2013 and 2020.

As a result of this analysis, we concluded that there is no longer any limitation on our utilization of such NOLs.

A detailed analysis was performed for the period March 1, 2014 to October 1, 2020

for Signal Sciences to determine whether an ownership change under Section 382 of the Code has occurred and an ownership change was identified in 2020.

As a result of this analysis, we concluded that there is no longer any limitation on our utilization of the NOLs of Signal Sciences.

We may experience ownership changes in the future as a result of subsequent shifts in our stock ownership,some of which shifts are outside our control.

Furthermore, our ability to utilize NOLs of companies that we have acquired or may acquire in the future may be subject to limitations.

8 unchanged sentences

and our ability to operate our business in a manner consistent with our corporate structure and intercompany arrangements.

The taxing authorities of the jurisdictions in which we operate may challenge our methodologies

for pricing intercompany transactions pursuant to our intercompany arrangements or disagree with our determinations as to the income and expenses attributable to specific jurisdictions.

The taxing authorities of the jurisdictions in which we operate may challenge our methodologies for pricing intercompany transactions pursuant to our intercompany arrangements or disagree with our determinations as to the income and expenses attributable to specific jurisdictions.

If such a challenge or disagreement were to occur, and our position was not sustained, we could be required to pay additional taxes, interest, and penalties, which could result in one-time tax charges, higher effective tax rates, reduced cash flows, and lower overall profitability of our operations.

1 unchanged sentence

We are subject to governmental export and import controls that could impair our ability to compete in international markets or subject us to liability if we violate such controls.

Our products are subject to the United States export controls, including the Export Administration Regulations administered by the United States Commerce Department, and economic sanctions administered by the Office of Foreign Assets Control of the United States Treasury Department ("OFAC"), and we incorporate encryption technology into certain of our products.

Our products are subject to United States export controls, including the Export Administration Regulations administered by the United States Commerce Department, and economic sanctions administered by the Office of Foreign Assets Control of the United States Treasury Department ("OFAC").

We incorporate encryption technology into certain of our products.

These encryption products and the underlying technology may be exported outside of the United States only with the required export authorizations.

Furthermore, our activities are subject to the United States economic sanctions laws and regulations that generally prohibit the direct or indirect exportation or provision of products and services without the required export authorizations to countries, governments, and individuals and entities targeted by the United States embargoes or sanctions, except to the extent authorized by OFAC or exempt from sanctions.

Obtaining the necessary export license or other authorization for a particular sale may not always be possible, and, even if the export license is ultimately granted, the process may be time-consuming and may result in the delay or loss of sales opportunities.

Violations of the United States sanctions or export control laws can result in significant fines or penalties, and possible incarceration for responsible employees and managers could be imposed for criminal violations of these laws.

Other countries also regulate the import and export of certain encryption products and technology through import and export licensing requirements, and have enacted laws that could limit our ability to distribute our products or could limit our customers’ ability to implement our products in those countries.

Additionally, export restrictions recently imposed on Russia and Belarus in connection with the military conflict involving Ukraine specifically restrict the export of encryption software to these locations.

Furthermore, our activities are subject to United States economic sanctions laws and regulations that generally prohibit the direct or indirect exportation or provision of products and services to countries, governments, and individuals and entities targeted by United States embargoes or sanctions, except to the extent authorized by OFAC or exempt from sanctions.

For example, following Russia’s invasion of Ukraine, the United States and other countries imposed economic sanctions and severe export control restrictions against Russia and Belarus, and the United States and other countries could impose wider sanctions and export restrictions and take other actions should the conflict further escalate.

Violations of United States sanctions or export control laws can result in significant fines or penalties, and possible incarceration for responsible employees and managers could be imposed for criminal violations of these laws.

Changes in our products or future changes in export and import regulations may create delays in the introduction of our products in international markets, prevent our customers with international operations from deploying our products globally, or, in some cases, prevent the export or import of our products to certain countries, governments, or persons altogether.

6 unchanged sentences

However, a strengthening of the U.S.

dollar could increase the real cost of our platform to our customers outside of the United States, which could adversely affect our operating results.

dollar could increase the real cost of our platform to our customers outside of the United States, which could cause an increase in requests to renegotiate contracts and adversely affect our operating results.

Foreign currency exchange rates have recently been and could continue to be subject to increased volatility.

In addition, our international sales in the future could become foreign currency denominated sales, increasing our foreign currency risk.

In addition, an increasing portion of our operating expenses is incurred outside the United States.

These operating expenses are denominated in foreign currencies and are subject to fluctuations due to changes in foreign currency exchange rates.

As these expenses become more material and if there are significant fluctuations in foreign currency exchange rates, the risk of not hedging or not hedging effectively could harm our business.

As these expenses become more material and if there are significant fluctuations in foreign currency exchange rates, this could result in significant fluctuations in our operating expenses and results of operations, which could harm our business.

The phase-out of the London Interbank Offered Rate (“LIBOR”), or the replacement of LIBOR with a different reference rate, may adversely affect interest rates.

2 unchanged sentences

dollar LIBOR settings and one-week and two-month U.S.

dollar LIBOR settings, and immediately after June 30, 2023 for

the remaining U.S.

dollar LIBOR settings, and immediately after June 30, 2023 for the remaining U.S.

dollar LIBOR settings.

4 unchanged sentences

The shift to SOFR from LIBOR is complex and may adversely affect our business, financial condition, results of operations, liquidity, and cash flows.

Unfavorable conditions in our industry or the global economy or reductions in information technology spending could harm our business.

Unfavorable conditions in our industry or the global economy, including those caused by the Russian military operations and related geopolitical situation in Ukraine, rising inflation or reductions in information technology spending could harm our business.

Global economic conditions have impacted, and will likely continue to impact, businesses around the world, including ours.

Inflation and other macroeconomic pressures in the U.S.

and the global economy such as rising interest rates and recession fears are creating a complex and challenging environment for us and our customers.

Our results of operations may vary based on the impact of changes in our industry or the global economy on us or our customers and potential customers.

Current or future economic uncertainties or downturns could adversely affect our business and results of operations.

Negative conditions in the general economy both in the United States and abroad, including conditions resulting from changes in gross domestic product growth, financial and credit market fluctuations, political turmoil, natural catastrophes, warfare, public health issues, such as the COVID-19 pandemic, and terrorist attacks on the United States, Europe, the Asia Pacific region, or elsewhere, could cause a decrease in business investments, including spending on information technology, which would harm our business.

capital markets experienced and continues to experience extreme volatility following the global outbreak of the COVID-19 pandemic in 2020 and the Russian invasion of Ukraine in 2022.

While our ability to do business has not been materially affected, the Russian invasion of Ukraine and the global restrictive measures that have been taken, and could be taken in the future, have created significant global economic uncertainty that could prolong and escalate tensions and expand the geopolitical conflict, which could have a lasting impact on regional and global economies, any of which could harm our business and operating results.

Further, due to political uncertainty and military actions involving Russia, Ukraine, and surrounding regions, we and the third parties upon which we rely may be vulnerable to a heightened risk of security breaches, computer malware, social-engineering attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, and other cyber-attacks, including attacks that could materially disrupt our systems and operations, supply chain, and ability to do business .

These attacks are expected to continue to occur in the future.

Furthermore, inflation rates in the U.S.

have recently increased to levels not seen in decades, prompting the Federal Reserve to increase interest rates.

Negative conditions in the general economy both in the United States and abroad, including conditions resulting from changes in gross domestic product growth, financial and credit market fluctuations, currency and interest rate fluctuations, political turmoil, natural catastrophes, warfare, public health issues, such as the COVID-19 pandemic, and terrorist attacks on the United States, Europe, the Asia Pacific region, or elsewhere, could cause a downturn or recession and a decrease in business investments, including spending on information technology, which would harm our business.

To the extent that our platform and our products are perceived by customers and potential customers as too costly, or difficult to deploy or migrate to, our revenue may be disproportionately affected by delays or reductions in general information technology spending.

21 unchanged sentences

Litigation brought to protect and enforce our intellectual property rights could be costly, time consuming, and distracting to management and could result in the impairment or loss of portions of our intellectual property.

Furthermore, our efforts to enforce our

intellectual property rights may be met with defenses, counterclaims, and countersuits attacking the validity and enforceability of our intellectual property rights.

Furthermore, our efforts to enforce our intellectual property rights may be met with defenses, counterclaims, and countersuits attacking the validity and enforceability of our intellectual property rights.

Our inability to protect our proprietary technology against unauthorized copying or use, as well as any costly litigation or diversion of our management’s attention and resources, could delay further sales or the implementation of our platform, impair the functionality of our platform, delay introductions of new products, result in our substituting inferior or more costly technologies into our products, or injure our reputation.

10 unchanged sentences

If a third party is able to obtain an injunction preventing us from accessing such third-party intellectual property rights, or if we cannot license or develop technology for any infringing aspect of our business, we would be forced to limit or stop selling products impacted by the claim or injunction or cease business activities covered by such intellectual property, and may be unable to compete effectively.

Any inability to license third-party technology in the future would have an adverse effect on our business and operating results, and would adversely affect our ability to compete.

Any inability to license third-party technology in the

future would have an adverse effect on our business and operating results, and would adversely affect our ability to compete.

We may also be contractually obligated to indemnify our customers in the event of infringement of a third party’s intellectual property rights.

33 unchanged sentences

• the trading volume of our Class A common stock;

• potential equity or debt financings;

• changes in the anticipated future size and growth rate of our market;

• general economic, regulatory, and market conditions.

Broad market and industry fluctuations, as well as general economic, political, regulatory, and market conditions, may impact the market price of our Class A common stock.

For example, in connection with the COVID-19 pandemic, we initially experienced an increase in the usage of our platform, and as a result, the trading price of our Class A common stock significantly increased, and has since experienced significant volatility, along with the broader market.

Following the

announcement of our results for our third and fourth quarters of 2021, the trading price of our Class A common stock significantly decreased.

There are no assurances that the trading price of our Class A common stock will recover to prior levels for any period of time.

Moreover, the trading price of our Class A common stock could experience a significant decrease once the scope and impact of the ongoing COVID-19 pandemic is better understood.

• general political, social, economic, regulatory, and market conditions, in both domestic and our foreign markets, including the effects of global events like the war in Ukraine on the global economy, labor shortages, supply chain disruptions, inflation, increased interest rates and slow or negative growth of our markets.

Broad market and industry fluctuations, as well as general economic, political, social, regulatory, and market conditions, may impact the market price of our Class A common stock.

Over the past few years, our stock price has declined significantly.

There are no assurances that the trading price of our Class A common stock will recover to prior levels.

Moreover, the trading price of our Class A common stock could experience further volatility and declines.

These fluctuations could cause you to lose all or part of your investment in our Class A common stock.

In addition, extreme price and volume fluctuations in the stock markets have affected and continue to affect

many technology companies’ stock prices.

Often, their stock prices have fluctuated in ways unrelated or disproportionate

to the companies’ operating performance.

In addition, extreme price and volume fluctuations in the stock markets have affected and continue to affect many technology companies’ stock prices, including ours.

Often, their stock prices have fluctuated in ways unrelated or disproportionate to the companies’ operating performance.

In the past, companies that have experienced volatility in the market price of their securities have been subject to securities class action litigation.

We may be the target of this type of litigation in the future, which could result in substantial costs and divert our management’s attention.

Conversion of the Notes may dilute the ownership interest of our stockholders or may otherwise depress the price of our Class A common stock.

We may not have the ability to raise the funds necessary to repay or settle conversions of the Notes in whole or in part in cash or to repurchase the Notes upon a fundamental change, and our future debt may contain limitations on our ability to pay cash upon conversion or repurchase of the Notes.

In March 2021, we entered into a purchase agreement for the sale of an aggregate of $948.8 million principal amount of our 0% convertible senior notes due 2026 (the “Notes”).

The conversion of some or all of the Notes may dilute the ownership interests of our stockholders.

On May 25, 2022, we entered into separate, privately negotiated transactions with certain holders of the Notes to repurchase (the “Repurchases”) approximately $235.0 million aggregate outstanding principal amount of the Notes for an aggregate cash repurchase price of approximately $176.4 million.

The Repurchases closed on May 31, 2022.

The remaining Notes of $713.8 million will mature on March 15, 2026, unless earlier converted, redeemed or repurchased.

Holders of the Notes will have the right, subject to certain conditions and limited exceptions, to require us to repurchase all or a portion of their Notes upon the occurrence of a fundamental change at a fundamental change repurchase price equal to 100% of the principal amount of the Notes to be repurchased, plus accrued and unpaid special interest, if any, as described in the indenture governing the Notes.

If our stock price is lower than the conversion

price of the Notes on maturity, the holders of our Notes will likely not convert and we will have to repay those Notes in cash.

In addition, upon conversion of the Notes, unless we elect to deliver solely shares of our Class A common stock to settle such conversion (other than paying cash in lieu of delivering any fractional share), we will be required to make cash payments in respect of the Notes being converted as described in the indenture governing the Notes.

However, we may not have enough available cash or be able to obtain financing at the time we are required to repay or make repurchases of Notes surrendered therefor or pay cash with respect to Notes being converted.

In addition, our ability to repurchase the Notes or to pay cash upon conversions of the Notes may be limited by law, by regulatory authority or by agreements governing our future indebtedness.

Our failure to repurchase notes at a time when the repurchase is required by the indenture or to pay any cash payable on future conversions of the Notes as required by the indenture would constitute a default under the indenture.

A default under the indenture governing the Notes or the fundamental change itself could also lead to a default under agreements governing our future indebtedness.

If the repayment of the related indebtedness were to be accelerated after any applicable notice or grace periods, we may not have sufficient funds to repay the indebtedness and repurchase the Notes or make cash payments upon conversions thereof.

Such acceleration could result in our bankruptcy.

In a bankruptcy, the holders of the Notes would have a claim to our assets that is senior to the claims of our equity holders.

Conversion of the Notes may dilute the ownership interest of our stockholders or may otherwise depress the price of our Class A common stock.

The conversion of some or all of the Notes will dilute the ownership interests of our stockholders.

Upon conversion of the Notes, we have the option to pay or deliver, as the case may be, cash, shares of our Class A common stock, or a combination of cash and shares of our Class A common stock.

2 unchanged sentences

Servicing our debt requires a significant amount of cash, and we may not have sufficient cash flow from our business to pay our substantial debt.

Our ability to make scheduled payments of the principal of, to pay interest on or to refinance our indebtedness, including the Notes, depends on our future performance, which is subject to economic, financial, competitive, and other factors beyond our control.

Our ability to make scheduled payments of the principal of or to refinance our indebtedness, including the Notes, depends on our future performance, which is subject to economic, financial, competitive, and other factors beyond our control.

Our business may not generate cash flow from operations in the future sufficient to service our debt, including the Notes, and make necessary capital expenditures.

If we are unable to generate such cash flow, we may be required to adopt one or more alternatives, such as selling assets, restructuring debt or obtaining additional equity capital on terms that may be onerous or highly dilutive.

Our ability to refinance our indebtedness will depend on the capital markets and our financial condition at such time.

If we are unable to generate such cash flow, we may be required to adopt one or more alternatives, such as selling assets, refinancing or restructuring debt or obtaining additional equity capital on terms that may be onerous or highly dilutive.

Our ability to refinance or restructure our indebtedness will depend on the capital markets and our financial condition at such time, and if the financial markets become difficult or costly to access, including due to rising interest rates, fluctuations in foreign currency exchange rates or other changes in economic conditions, our ability to raise additional capital may be negatively impacted.

We may not be able to engage in any of these activities or engage in these activities on desirable terms, which could result in a default on our debt obligations.

Even if we can refinance or restructure our debt, the revised terms may harm our business.

Regulatory actions and other events may adversely affect the trading price and liquidity of the Notes.

We expect that many investors in, and potential purchasers of, the Notes will employ, or seek to employ, a convertible arbitrage strategy with respect to the Notes.

We expect that many investors in,and potential purchasers of, the Notes may employ, or seek to employ, a convertible arbitrage strategy with respect to the Notes.

Investors would typically implement such a strategy by selling short the Class A common stock underlying the Notes and dynamically adjusting their short position while continuing to hold the Notes.

5 unchanged sentences

common stock or enter into swaps on our Class A common stock could adversely affect the trading price and the liquidity of the Notes.

If our stock price is lower than the conversion price of the Notes on maturity, the holders of our Notes will not convert and we will have to repay those Notes in cash.

In addition, our ability to repurchase the Notes or to pay cash upon conversions of the Notes may be limited by law, by regulatory authority or by agreements governing our future indebtedness.

A default under the indenture governing the Notes or the fundamental change itself could also lead to a default under agreements governing our future indebtedness.

Such acceleration could result in our bankruptcy.

In a bankruptcy, the holders of the Notes would have a claim to our assets that is senior to the claims of our equity holders.

The conditional conversion feature of the Notes, if triggered, may adversely affect our financial condition and operating results.

1 unchanged sentence

If one or more holders elect to convert their Notes, unless we elect to satisfy our conversion obligation by delivering solely shares of our Class A common stock (other than paying cash in lieu of delivering any fractional share), we would be required to settle a portion or all of our conversion obligation through the payment of cash, which could adversely affect our liquidity.

In addition, even if holders do not elect to convert their Notes, we could be required under applicable accounting rules to reclassify all or a portion of the outstanding principal of the Notes as a current rather than long-term liability, which would result in a material reduction of our net working capital.

For additional information regarding the conditional conversion feature of the Notes, see Note 9, Debt Instruments.

1 unchanged sentence

Future sales and issuances of our capital stock or rights to purchase our capital stock could result in substantial dilution to our existing stockholders.

For example, we may issue approximately 9.2 million shares of our Class A common stock upon conversion of the Notes, subject to customary anti-dilution adjustments.

For example, we may issue approximately 7.3 million shares of our Class A common stock if the Notes convert, subject to customary anti-dilution adjustments.

In addition, we may need to secure additional funds for our existing debt obligations, including repayment of the Notes.

We may sell Class A common stock, convertible securities, and other equity securities in one or more transactions at prices and in a manner as we may determine from time to time.

7 unchanged sentences

Additionally, the shares of Class A common stock subject to outstanding options and restricted stock unit awards under our equity incentive plans and the shares reserved for future issuance under our equity incentive plans will become eligible for sale in the public market upon issuance, subject to applicable insider trading policies.

The Notes will also become convertible at the option of the holders, subject to certain limitations and restrictions prior to March 15, 2026.

The outstanding portion of the Notes will also become convertible at the option of the holders, subject to certain limitations and restrictions, prior to March 15, 2026.

Future sales also could cause the trading price of our Class A common stock to decline and make it more difficult for investors to sell shares of our Class A common stock.

4 unchanged sentences

We do not have any control over these analysts.

If the number of analysts that cover us declines, demand for our Class A common stock could decrease and our Class A common stock price and trading volume may decline.

If the number of analysts that cover

us declines, demand for our Class A common stock could decrease and our Class A common stock price and trading volume may decline.

Even if our Class A common stock is actively covered by analysts, we do not have any control over the analysts or the measures that analysts or investors may rely upon to forecast our future results.

12 unchanged sentences

Furthermore, the senior members of our management team do not have significant experience with operating a public company.

As a result, our management and

other personnel have to devote a substantial amount of time to compliance with these requirements.

As a result, our management and other personnel have to devote a substantial amount of time to compliance with these requirements.

Moreover, these rules and regulations increase our legal and financial compliance costs and make some activities more time-consuming and costly.

We cannot predict or estimate the amount of additional costs we will incur as a public company or the timing of such costs.

As a result of being a public company, we are obligated to develop and maintain proper and effective internal control over financial reporting and any failure to maintain the adequacy of these internal controls may adversely affect investor confidence in our company and, as a result, the value of our Class A common stock.

We are required, pursuant to Section 404 to furnish a report by management on, among other things, the effectiveness of our internal control over financial reporting.

This assessment includes disclosure of any material weaknesses identified by our management in our internal control over financial reporting.

Our independent registered public accounting firm also attests to the effectiveness of our internal control over financial reporting.

Our compliance with Section 404 requires that we incur substantial accounting expense and expend significant management efforts.

We currently have an internal audit group and have hired additional accounting and financial staff.

We may need to hire additional accounting and financial staff with appropriate public company experience and technical accounting knowledge and update the system and process documentation necessary to perform the evaluation needed to comply with Section 404.

During the evaluation and testing process of our internal controls, if we fail to remediate our existing material weaknesses in our internal controls over financial reporting or if we identify new material weaknesses, we will be unable to certify that our internal controls over financial reporting is effective.

We and our independent registered public accounting firm identified material weaknesses in our internal controls over financial reporting for the years ended December 31, 2021, 2020, 2019 and 2018, some of which were newly identified in the year ended December 31, 2021 and one was originally identified in prior years and remains partially unremediated for the year ended December 31, 2021.

The material weaknesses related to the lack of sufficient qualified accounting resources, the lack of timely and complete identification of internal-use software costs for capitalization, and system implementation of our stock plan administration system.

While we are actively working on remediating these identified weaknesses, we may discover additional material weaknesses or significant deficiencies in our internal control over financial reporting in the future.

Any failure to maintain internal control over financial reporting could severely inhibit our ability to accurately report our financial condition or results of operations.

If we are unable to conclude that our internal control over financial reporting is effective, or if our independent registered public accounting firm determines we have one or more material weaknesses or significant deficiencies in our internal control over financial reporting, we could lose investor confidence in the accuracy and completeness of our financial reports, the market price of our Class A common stock could decline and we could be subject to sanctions or investigations by the NYSE, the SEC or other regulatory authorities.

Failure to remedy any material weaknesses in our internal control over financial reporting, or to implement or maintain other effective control systems required of public companies, could also restrict our future access to the capital markets.

Anti-takeover provisions in our charter documents, the indenture governing the Notes, and under Delaware law could make an acquisition of our company more difficult, limit attempts by our stockholders to replace or remove our current management and limit the market price of our Class A common stock.

Provisions in our amended and restated certificate of incorporation and amended and restated bylaws may have the effect of delaying or preventing a change of control or changes in our management.

Anti-takeover provisions in our charter documents, the indenture governing the Notes, and under Delaware law could make an acquisition of our company more difficult, limit attempts by our stockholders to replace or remove our current board of directors or management and limit the market price of our Class A common stock.

Provisions in our amended and restated certificate of incorporation and amended and restated bylaws may have the effect of delaying or preventing a change of control or changes in board of directors or our management.

Our amended and restated certificate of incorporation and amended and restated bylaws include provisions that:

15 unchanged sentences

Our amended and restated certificate of incorporation provides that the Court of Chancery of the State of Delaware and, to the extent enforceable, the federal district courts of the United States of America will be the exclusive forums for substantially all disputes between us and our stockholders, which could limit our stockholders’ ability to obtain a favorable judicial forum for disputes with us or our directors, officers, or employees.

Our amended and restated certificate of incorporation provides that the Court of Chancery of the State of Delaware is the exclusive forum for the following types of actions or proceedings under Delaware statutory or common law for:

• any derivative action or proceeding brought on our behalf;

7 unchanged sentences

To prevent having to litigate claims in multiple jurisdictions and the threat of inconsistent or contrary rulings by different courts, among other considerations, our amended and restated certificate of incorporation provides that the federal district courts of the United States of America will be the exclusive forum for resolving any complaint asserting a cause of action arising under the Securities Act.

While the Delaware courts have determined that such choice of forum provisions are facially valid, a stockholder may nevertheless seek to bring such a claim arising under the Securities Act against us, our directors, officers, or other employees in a venue other than

in the federal district courts of the United States of America.

Delaware courts have determined that such choice of forum provisions are facially valid, and several state trial courts have enforced such provisions and required that suits asserting Securities Act claims be filed in federal court, there is no guarantee that courts of appeal will affirm the enforceability of such provisions and a stockholder may nevertheless seek to bring a claim in a venue other than those designated in the exclusive forum provisions.

In such instance, we would expect to vigorously assert the validity and enforceability of the exclusive forum provisions of our amended and restated certificate of incorporation.

This may require significant additional costs associated with resolving the dispute in other jurisdictions, and there can be no assurance that the provisions will be enforced by a court in those other jurisdictions.

These exclusive-forum provisions may limit a stockholder’s ability to bring a claim in a judicial forum that it finds favorable for disputes with us or our directors, officers, or other employees, which may discourage lawsuits against us and our directors, officers, and other employees.

This may require significant additional costs associated with resolving such action in other jurisdictions, and there can be no assurance that the provisions will be enforced by a court in those other jurisdictions.

If a court were to find either exclusive forum provision in our amended and restated certificate of incorporation to be inapplicable or unenforceable in an action, we may incur further significant additional costs associated with litigating Securities Act claims in state court, or both state and federal court, which could seriously harm our business, financial condition, results of operations, and prospects.

These forum provisions may limit a stockholder’s ability to bring a claim in a judicial forum that it finds favorable for disputes with us or our directors, officers, or other employees, which may discourage lawsuits against us and our directors, officers, and other employees.

If a court were to find either exclusive-forum provision in our amended and restated certificate of incorporation to be inapplicable or unenforceable in an action, we may incur further significant additional costs associated with resolving the dispute in other jurisdictions, all of which could harm our business.

1 unchanged sentence

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors