What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2024-02-22 compared with 2023-02-27 · 185 added, 142 removed, 921 unchanged (26% of the section changed)

15 unchanged sentences

However, we have not developed redundancies for all aspects of our platform.

We depend, in part, on our third-party facility providers’ ability to protect these facilities against damage or interruption from natural disasters, power or telecommunications failures, criminal acts, public health issues, such as the COVID-19 pandemic, and similar events.

We depend, in part, on our third-party facility providers’ ability to protect these facilities against damage or interruption from natural disasters, power or telecommunications failures, criminal acts, armed conflict, public health issues, such as a pandemic or epidemic, and similar events.

In some cases, third-party cloud providers run their own platforms that we access, and are, therefore, vulnerable to their service interruptions.

52 unchanged sentences

Our 10 largest customers generated an aggregate of 37% and 35% of our revenue in the trailing 12 months ended December 31, 2023 and 2022, respectively.

Our 5 largest customers generated an aggregate of 26% and 22% of our revenue in the trailing 12 months ended December 31, 2022 and 2021, respectively.

Affiliated customers that are business units of a single company in the streaming entertainment space generated an aggregate of 11% of our revenue in both the trailing 12 months ended December 31, 2022 and 2021.

Affiliated customers that are business units of a single company in the streaming entertainment space generated an aggregate of 12% and 11% of our revenue in the trailing 12 months ended December 31, 2023 and 2022, respectively.

It is likely that we will continue to be dependent upon a limited number of customers for a significant portion of our revenues for the foreseeable future and, in some cases, the portion of our revenues attributable to individual customers may increase in the future.

3 unchanged sentences

Component delays, shortages or price increases could interrupt our ability to complete the construction of our servers to meet the usage needs of our customers.

Our business is dependent upon the timely supply of certain parts and components to construct our servers.

Our operating results could be materially harmed if we are unable to adequately manage our server needs.

Our business depends on the timely supply of certain parts and components to construct our servers.

We rely on a limited number of suppliers for several components of the equipment we use to operate our network and provide products to our customers.

Our reliance on these suppliers exposes us to risks including reduced control over production costs and constraints based on the then current availability, terms, and pricing of these components, including pricing changes as a result of inflationary pressures.

The ongoing COVID-19 pandemic has resulted, and we expect will continue to result, in disruptions and delays for these components and the delivery and installation of such components at our colocation facilities, in addition to pricing increases.

The COVID-19 pandemic caused disruptions and delays for these components and the delivery and installation of such components at our colocation facilities, in addition to pricing increases.

If our supply of certain components is further disrupted or delayed, there can be no assurance that we will be able to obtain adequate replacements for the existing components or that supplies will be available on terms and prices that are favorable to us, if at all.

Any disruption or delay in the supply of our hardware components has in the past and may in the future

limit capacity expansion or replacement of defective or obsolete equipment, or cause other constraints on our operations that could damage our customer relationships and harm our business.

Any disruption or delay in the supply of our hardware components has in the past and may in the future limit capacity expansion or replacement of

defective or obsolete equipment, or cause other constraints on our operations that could damage our customer relationships and harm our business.

To ensure adequate supply of parts and components, we must forecast server needs and expenses and place orders sufficiently in advance with our suppliers based on estimates of future demand for network capacity.

As we continue to experience growth, we may face challenges managing adequate server capacity due to potential component delays, shortages, price increases, hardware efficiencies gained through internal development, or any potential changes in server architecture including due to technological advances or obsolescence.

We may incur charges in future periods related to server management or incorrectly forecast our network capacity needs in future periods.

If we have excess server capacity, we have in the past and may need to continue to write-down or write-off server assets, which may materially harm our operating results.

For example, in the year ended December 31, 2023, we recognized computer and networking equipment related write-off charges of $4.3 million.

Conversely, if we underestimate network capacity needs, we may in future periods be unable to meet demand and be required to incur higher costs to secure necessary parts and components of our servers, which could adversely affect our customer relationships and harm our business.

Our limited operating history and our history of operating losses makes it difficult to evaluate our current business and prospects and may increase the risks associated with your investment.

16 unchanged sentences

In the ordinary course of our business, we and the third parties upon which we rely, collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share, proprietary, confidential, and sensitive data, including personal information, intellectual property, trade secrets, and encryption keys, including our data and data of our customers, including their end-users (collectively, sensitive information).

Maintaining the security and availability of our platform, network, and internal IT systems and the security of information we hold on behalf of our customers is a critical issue for us and our customers, and we may expend significant resources, fundamentally change our business activities and practices, or modify our operations in an effort to protect against security incidents and to mitigate, detect, and remediate actual and potential vulnerabilities.

Maintaining the security and availability of our platform, network, and internal IT systems and the security of information we hold on behalf of our customers is a critical issue for us and our customers, and we expend significant resources, and may need to fundamentally change our business activities and continue to modify our practices and operations, in an effort to protect against security incidents and to mitigate, detect, and remediate actual and potential vulnerabilities.

Cyber-attacks, malicious Internet-based activity, online and offline fraud, and other similar activities threaten the confidentiality, integrity, and availability of our sensitive information and information technology systems, and those of the third parties upon which we rely.

Such threats are prevalent and continue to rise, are increasingly difficult to detect, and come from a variety of sources, including threat actors, “hacktivists,” personnel (such as through theft or misuse), sophisticated nation states, and nation-state-supported actors.

Such threats are prevalent and continue to rise, are difficult to detect, and come from a variety of sources, including threat actors, “hacktivists,” personnel (such as through theft or misuse), sophisticated nation states, and nation-state-supported actors.

Some actors now engage and are expected to continue to engage in cyber-attacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities.

1 unchanged sentence

Since our customers share our multi-tenant architecture, cyber-attacks on any one of our customers could have a negative effect on other customers.

These attacks have significantly increased the bandwidth used on our platform and have strained our network.

During times of war and other major conflicts, we, the third parties upon which we rely, and our customers may be vulnerable

to a heightened risk of these attacks, including retaliatory cyber-attacks, that could materially disrupt our systems and operations, supply chain, and ability to produce, sell, and distribute our services.

We and the third parties upon which we rely are subject to a variety of evolving threats, including but not limited to social-engineering attacks (including through phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks, account takeover attacks, credential harvesting, personnel misconduct or error, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, adware, telecommunications failures, natural disasters, and other similar threats.

For example, we have experienced DDoS attacks of increased size and severity that caused us to invest resources into improving our systems, and we expect to continue to be subject to DDoS and other forms of attacks in the future, particularly as they have become more prevalent in our industry.

These attacks have in the past significantly increased the bandwidth used on our platform and have strained our network.

During times of war and other major conflicts, we, the third parties upon which we rely, and our customers may be vulnerable to a heightened risk of these attacks, including retaliatory cyber-attacks, that could materially disrupt our systems and operations, supply chain, and ability to produce, sell, and distribute our services.

We and the third parties upon which we rely are subject to a variety of evolving threats, including but not limited to social-engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), malicious code , malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks, account takeover attacks, credential harvesting, personnel misconduct or error, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, attacks facilitated or enhanced by artificial intelligence (“AI”), loss of data or other information technology assets, adware, telecommunications failures, natural disasters, and other similar threats.

For example, we have experienced DDoS attacks of significant size and severity that caused us to invest resources into improving our systems, and we expect to continue to be subject to DDoS and other forms of attacks in the future, particularly as they have become more prevalent in our industry.

Similarly, we have been the target of phishing and social engineering schemes that may be designed to, among other things, improperly gain access to our confidential information or fraudulently obtain payments or funds from us.

11 unchanged sentences

In addition, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties’ infrastructure in our supply chain or our third-party partners’ supply chains have not been compromised.

Any of the previously identified or similar threats could cause a security incident or other interruption that could result in unauthorized , unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our sensitive information or our information technology systems, or those of the third parties upon whom we rely.

to our sensitive information or our information technology systems, or those of the third parties upon whom we rely.

A security incident or other interruption could disrupt our ability (and that of third parties upon whom we rely) to provide our platform, products and services.

1 unchanged sentence

For example, we have had security incidents in the past that have tested the limits of our infrastructure and impacted the performance of our platform.

In addition to experiencing a security incident, third parties may gather, collect, or infer sensitive information about us from public sources, data brokers, or other means that reveals competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position.

Further, sensitive information of the Company or our customers could be leaked, disclosed, or revealed as a result of or in connection with our employees’, personnel’s, or vendors’ use of generative AI technologies.

Certain privacy and data security obligations may require us to implement and maintain specific security measures or industry-standard or reasonable security measures to protect our information technology systems and sensitive information.

While we have implemented security measures designed to protect against security incidents, there can be no assurance that these measures will be effective.

We take steps to detect and remediate vulnerabilities, but we may not be able to detect and

remediate all vulnerabilities because the threats and techniques used to exploit the vulnerability change frequently and are often sophisticated in nature.

We take steps to detect and remediate vulnerabilities, but we may not be able to detect and remediate all vulnerabilities because the threats and techniques used to exploit the vulnerability change frequently and are often sophisticated in nature.

Therefore, such vulnerabilities could be exploited but may not be detected until after a security incident has occurred.

1 unchanged sentence

Further, we may experience delays in developing and deploying remedial measures designed to address any such identified vulnerabilities.

Applicable privacy and data security obligations may require us to notify relevant stakeholders of security incidents.

Such disclosures are costly, and the disclosure or the failure to comply with such requirements could lead to adverse consequences.

Applicable privacy and data security obligations may require us to notify relevant stakeholders, including affected individuals, customers, regulators, and investors of security incidents.

For example, SEC rules require disclosure on Form 8-K of the nature, scope and timing of any material cybersecurity incident and the reasonably likely impact of such incident.

Compliance with such disclosure efforts is costly, and the disclosure or the failure to comply with such requirements could lead to adverse consequences.

If we (or a third party upon whom we rely) experience a security incident or are perceived to have experienced a security incident, we may experience adverse consequences, such as government enforcement actions (for example, investigations, fines penalties, audits, and inspections);

5 unchanged sentences

monetary fund diversions;

diversion of management attention;

interruptions or degradation of performance in our services (including availability of data);

8 unchanged sentences

If we are unable to develop and sell new products that satisfy and are adopted by our customers and provide enhancements, new features, and capabilities to our platform that keep pace with rapid technological and industry change, our revenue and operating results could be adversely affected.

If new technologies emerge that enable large internet platform companies to utilize their own data centers and implement delivery approaches that limit or eliminate reliance on third-party providers like us, or that enable our competitors to deliver competitive products and applications at lower prices, more efficiently, more conveniently, or more securely, such technologies could adversely impact our ability to compete.

Further, some of our prospective customers may require custom development of features as part of their purchase decision, or our existing customers may require us to develop custom features.

If we are unable to meet their requirements, they may look to our competitors or internal solutions that eliminate reliance on third-party providers, and our revenue and operating results could be adversely affected.

Further, prioritizing such custom features can be difficult to adapt to other customers and may require significant engineering resources.

If new technologies emerge that enable large Internet platform

companies to utilize their own data centers and implement delivery approaches that limit or eliminate reliance on third-party providers like us, or that enable our competitors to deliver competitive products and applications at lower prices, more efficiently, more conveniently, or more securely, such technologies could adversely impact our ability to compete.

If our platform does not allow us or our customers to comply with the latest regulatory requirements, our existing customers may decrease their usage on our platform and new customers will be less likely to adopt our platform.

4 unchanged sentences

If we are unable to respond to these changes in a cost-effective manner, our products may become less marketable and less competitive or obsolete, and our business may be harmed.

Moreover, our platform is highly technical and complex and, for example, our delivery products rely on knowledge of the Varnish Configuration Language ("VCL") to utilize many features of this platform.

Moreover, our platform is highly technical and complex.

For example, our delivery products rely on knowledge of the VCL to utilize many features of this platform.

Potential developers may be unfamiliar or opposed to working with VCL and therefore decide to not adopt our platform, which may harm our business.

1 unchanged sentence

We cannot accurately predict customers’ usage or renewal rates given the diversity of our customer base across industries, geographies and size, and ability of customers to allocate usage, among other factors.

Accordingly, we may be

unable to accurately forecast our revenues.

Accordingly, we may be unable to accurately forecast our revenues.

Notwithstanding our substantial investments in sales and marketing, infrastructure, and research and development in anticipation of growth in our business, i f we do not realize returns on these investments in our growth, our results of operations could differ materially from our forecasts, which would adversely affect our results of operations and could disappoint analysts and investors, causing our stock price to decline.

14 unchanged sentences

We believe that there is significant competition for sales personnel, including sales representatives, sales managers, and sales engineers, with the skills and technical knowledge that we require.

Our ability to achieve significant revenue growth will depend, in large part, on our success in recruiting, training, incentivizing, and retaining sufficient numbers of sales personnel to support our growth.

Our ability to achieve significant revenue growth will depend, in large part, on our success in recruiting, training, incentivizing, and retaining sufficient numbers of sales personnel to

support our growth.

New hires require significant training and may take significant time before they achieve full productivity.

5 unchanged sentences

With the introduction of new technologies and market entrants, we expect that the competitive environment in which we compete will remain intense going forward.

Application and API security vendors like Akamai, AWS, Cloudflare, F5, and Imperva offer products that compete with ours.

We also compete with CDN providers, which now offer serverless edge compute functionality like Akamai (Linode), AWS, and Cloudflare, cloud hosting providers that have added CDN and WAF capabilities like Alphabet (Google Cloud Platform), AWS, and Microsoft (Azure), legacy CDNs, such as Akamai, Edgio, and Lumen, and niche CDN players like Section.io and StackPath, as well as traditional on-premise data center appliance vendors for load balancing, WAF, and DDoS like Citrix, F5, Imperva, and Radware.

Application and API security vendors like Akamai, Amazon Web Services (“AWS”), Cloudflare, F5, and Thales (Imperva) offer products that compete with ours.

We also compete with CDN providers, which now offer serverless edge compute functionality like Akamai (Linode), and Cloudflare, cloud hosting providers (or public cloud providers) that have added CDN and WAF capabilities like Alphabet (Google Cloud Platform), AWS, and Microsoft (Azure), legacy CDNs, such as Akamai and Edgio, point CDN players like Bunny CDN, CDNetworks, and CDN77, and traditional on-premise data center appliance vendors for load balancing, WAF, and DDoS like F5, Thales (Imperva), NetScaler and Radware.

Some of our competitors have made or may make acquisitions or may enter into partnerships or other strategic relationships that may provide more comprehensive offerings than they individually had offered.

2 unchanged sentences

We compete on the basis of a number of factors, including:

• our platform’s functionality, scalability, performance, ease of use, reliability, security availability, and cost effectiveness relative to that of our competitors’ products and services;

• our platform’s functionality, scalability, performance, ease of use, ease of integration and programmability, reliability, security availability, and cost effectiveness relative to that of our competitors’ products and services;

• our global network coverage and availability;

• our ability to utilize new and proprietary technologies to offer services and features previously not available in the marketplace;

• our ability to support modern application development processes and utilize new and proprietary technologies to offer services and features previously not available in the marketplace;

• our ability to identify new markets, applications, and technologies;

7 unchanged sentences

We face substantial competition from legacy CDNs, small business-focused CDNs, cloud providers, traditional data center, and appliance vendors.

In addition, existing and potential customers have transitioned, and may in the future transition, off of our platform, or may limit their use, because they pursue a “do-it-yourself” approach to develop their own CDN by putting in place equipment, software, and other technology products for content and application delivery within their internal systems;

In addition, existing customers have transitioned or notified us of their intent to transition, and existing and potential customers may in the future transition, off of our platform, or may limit their use, because they pursue a “do-it-yourself” approach to develop their own CDN by putting in place equipment, software, and other technology products

for content and application delivery within their internal systems;

enter into relationships directly with network providers instead of relying on an overlay network like ours;

13 unchanged sentences

We also believe that the importance of brand recognition will increase as competition in our market increases.

Successfully maintaining and enhancing our brand will depend largely on the effectiveness of our marketing efforts, our ability to provide reliable products that continue to meet the needs of

our customers at competitive prices, our ability to maintain our customers’ trust, our ability to continue to develop new functionality and products, and our ability to successfully differentiate our platform from competitive products and services.

Successfully maintaining and enhancing our brand will depend largely on the effectiveness of our marketing efforts, our ability to provide reliable products that continue to meet the needs of our customers at competitive prices, our ability to maintain our customers’ trust, our ability to continue to develop new functionality and products, and our ability to successfully differentiate our platform from competitive products and services.

Additionally, our brand and reputation may be affected if customers do not have a positive experience with our partners’ services.

65 unchanged sentences

If those partnerships do not provide these benefits or if our partners are unable to serve our customers effectively, we may need to allocate resources internally to provide these services or our customers may not realize the full value of our platform, which could harm our business.

Moreover, our partners’ business partners may not completely align with our core values and therefore may do business with companies that we otherwise would not.

Moreover, our partners’ business partners may not completely align with our core values and therefore may do business with companies that we otherwise would not do business with.

Our association with these companies could damage our brand and reputation and potentially harm our business.

1 unchanged sentence

If our market does not grow as we expect, or if we cannot expand our services to meet the demands of this market, our revenue may decline, or fail to grow, and we may incur operating losses.

The market for edge computing is in an early stage of development.

The market for edge computing is still developing.

There is considerable uncertainty over the size and rate at which this market will grow, as well as whether our platform will be widely adopted.

Our success will depend, to a substantial extent, on the widespread adoption of our platform as an alternative to other solutions, such as legacy CDNs, enterprise data centers, central cloud, and small business-focused CDNs.

Our success will depend, to a substantial extent, on the widespread adoption of our platform as an alternative to other solutions, such as legacy CDNs, and CDNs focused on enterprise data centers, central cloud, and small businesses.

Some organizations may be reluctant or unwilling to use our platform for a number of reasons, including concerns about additional costs, uncertainty regarding the reliability, and security of cloud-based offerings or lack of awareness of the benefits of our platform.

12 unchanged sentences

Third-party market opportunity estimates and our growth forecasts are subject to significant uncertainty and are based on assumptions and estimates that may not prove to be accurate.

The variables that go into the calculation of our market

opportunity are subject to change over time, and there is no guarantee that any particular number or percentage of addressable companies or end-users covered by our market opportunity estimates will purchase our products at all or generate any particular level of revenues for us.

The variables that go into the calculation of our market opportunity are subject to change over time, and there is no guarantee that any particular number or percentage of addressable companies or end-users covered by our market opportunity estimates will purchase our products at all or generate any particular level of revenues for us.

Even if the market in which we compete meets the size estimates and growth forecasted, our business could fail to grow for a variety of reasons, including reasons outside of our control, such as competition in our industry.

Usage of our platform accounts for substantially all of our revenue.

Usage of our platform accounts for substantially all of our revenue, and as a result, our operating results could suffer from a reduction in usage.

We expect that we will be substantially dependent on our edge cloud platform to generate revenue for the foreseeable future.

22 unchanged sentences

• timing of new functionality of our existing platform;

• our ability to control costs, including our operating expenses;

• our ability to control costs, including our operating expenses and transmission bandwidth pricing;

• the amount and timing of payment for operating expenses, particularly research and development and sales and marketing expenses, including commissions;

22 unchanged sentences

We have limited experience with respect to determining the optimal prices for our products and, as a result, we have in the past changed our pricing model and expect that we may need to do so in the future, including as a result of inflationary pressures.

In addition, we plan to roll out product packages with single price points.

In addition, during 2023 we introduced the option for customers to purchase product packages with single price points and set limits on usage.

We do not charge for overages on these single price point product packages.

We do not know whether our current or potential customers will accept these packages or the impact these packages will have on our existing usage-based pricing model.

7 unchanged sentences

The length of our sales cycle for these customers, from initial evaluation to payment, can range from several months to well over a year and can vary substantially from customer to customer.

Similarly, the onboarding and ramping process with new enterprise customers, or with existing customers that are moving additional traffic onto our platform, can take several months.

Similarly, the onboarding and ramping process with new enterprise customers, or with existing customers that are

moving additional traffic onto our platform, can take several months.

As the purchase of our products can be dependent upon customer initiatives, our sales cycle can extend to even longer periods of time.

37 unchanged sentences

We rely on third-party hosting providers that may be difficult to replace.

We rely on third-party hosting services such as Amazon Web Services ("AWS"), Google, Microsoft Azure, and other cloud providers that facilitate the offering of our platform.

We rely on third-party hosting services such as AWS, Google Cloud Platform, Microsoft (Azure), and other cloud providers that facilitate the offering of our platform.

Some of these third-party hosting services offer competing products to ours and therefore may not continue to be available on commercially reasonable terms, or at all.

21 unchanged sentences

Our failure to do so could harm our business.

Health epidemics, including the ongoing COVID-19 pandemic, have had, and could in the future have, an adverse impact on our business, operations, and the markets and communities in which we, our partners and customers operate.

The ongoing global COVID-19 pandemic has adversely impacted, and may continue to adversely impact, many aspects of our business.

Usage of our platform has fluctuated during the COVID-19 pandemic, and we cannot predict how usage levels will be impacted given that the long term impact of the pandemic remains uncertain.

As a result, it has been difficult to accurately forecast our revenues or financial results, and our results of operations could be materially below our forecasts, which could adversely affect our results of operations, disappoint analysts and investors, or cause our stock price to decline.

In addition, our suppliers have been impacted by the COVID-19 pandemic, which has reduced the availability or resulted in delays, and may continue to reduce the availability or result in delays, of parts and components to us.

Furthermore, we may decide to postpone or cancel planned investments in our business in response to changes in our business as a result of the

COVID-19 pandemic, which may impact our ability to attract and retain customers and our rate of innovation, either of which could harm our business.

The ultimate duration and extent of the impact from the COVID-19 pandemic depends on future developments that cannot be accurately forecasted at this time.

We do not yet know how businesses, customers, or our partners will operate in a post COVID-19 environment.

There may be additional costs or impacts to our business and operations, which could harm our business.

Investors’ expectations of our performance relating to environmental, social and governance factors may impose additional costs and expose us to new risks.

17 unchanged sentences

Moreover, the increase in the number of equity awards has reduced the number of shares available for us to grant under our equity incentive plan.

We also face significant competition in hiring and attracting qualified employees in all aspects of our business, and the move by companies to offer a remote or hybrid work environment as a result of the COVID-19 pandemic may increase the competition for such employees.

If we fail to attract new personnel or fail to retain and motivate our current personnel, our ability to maintain and enhance our platform, develop and deliver new products, fix bugs, support our existing customers, attract new customers, respond to competitive pressures, and otherwise execute our business plan would be harmed.

We rely on the performance of highly skilled personnel, including our senior management and other key employees, and the loss or transition of one or more of such personnel, or of a significant number of our team members, could harm our business.

We believe that our success has depended, and continues to depend, on the efforts and talents of senior management and key employees, including Artur Bergman, our Chief Architect and Executive Chairman and Todd Nightingale, our Chief Executive Officer.

There have been, and from time to time, there may continue to be, changes in our management team resulting from the hiring or departure of executives and key employees, or the transition of executives within our business, which could disrupt our business.

For example, Todd Nightingale began serving as our new Chief Executive Officer, replacing Joshua Bixby, effective September 1, 2022.

For example, Todd Nightingale began serving as our new Chief Executive Officer, effective September 1, 2022.

Such changes in our executive management team may be disruptive to our business.

8 unchanged sentences

We have experienced growth in various aspects of our business in prior periods.

For example, for the years ended December 31, 2022, December 31, 2021, and December 31, 2020, our revenue was $432.7 million, $354.3 million and $290.9 million, respectively.

For example, for the years ended December 31, 2023, 2022, and 2021, our revenue was $506.0 million, $432.7 million and $354.3 million, respectively.

In addition, we are expanding, and expect to continue to expand in the future, our international operations.

For example, from December 31, 2021 to December 31, 2022, our edge network increased from 51 to 58 markets and from 31 to 34 countries that are outside of the United States.

We have also experienced growth in the number of customers, usage, and amount of data delivered across our platform.

21 unchanged sentences

• international expansion;

• general administration, including increased legal and accounting expenses associated with being a public company.

• general administration, including legal and accounting expenses associated with being a public company.

These activities will require significant investments and allocation of valuable management and employee resources, and our growth will continue to place significant demands on our management and our operational and financial infrastructure.

17 unchanged sentences

We also intend to continue to make investments to support our business and may require additional funds to do so.

Our future capital requirements may vary materially from those currently planned and will depend on many factors, including our growth rate, market acceptance of our platform, the expansion of sales and marketing activities, strategic transactions, as well as overall economic conditions.

Our future capital requirements may vary materially from those currently planned and will depend on many factors, including our growth rate, our operating cash flow, market acceptance of our platform, the expansion of sales and marketing activities, strategic transactions, as well as overall economic conditions.

We may need to engage in equity or debt financings to secure additional funds, in particular if we are required to repay our outstanding convertible notes in cash.

Additional financing may not be available on favorable terms, if at all, and any additional financing will need to be in compliance with the terms of our Credit Agreement, dated as of February 16, 2021, by and among us as borrower, the lenders from time to time party thereto, and Silicon Valley Bank as a lender, the issuing lender and the swingline lender, and as administrative agent and collateral agent for the lenders ("Credit Agreement").

In addition, increases in interest rate levels could increase our cost of capital.

Additional financing may not be available on favorable terms, if at all, and any additional financing will need to be in compliance with the terms of our Credit Agreement with the lenders from time to time party thereto and First-Citizens Bank & Trust Company (successor by purchase to the Federal Deposit Insurance Corporation as

Receiver for Silicon Valley Bridge Bank, N.A.

(as successor to Silicon Valley Bank) (as amended, restated, amended and restated, supplemented, restructured, or otherwise modified from time to time, the “Credit Agreement”).

We originally entered into our Credit Agreement with Silicon Valley Bank in 2021.

On March 10, 2023, Silicon Valley Bank was announced as closed by the California Department of Financial Protection and Innovation, and the Federal Deposit Insurance Corporation (the “FDIC”) was appointed as a receiver.

On March 26, 2023, it was announced that First-Citizens Bank & Trust Company would assume all of Silicon Valley Bank’s deposits and loans as of March 27, 2023.

Following that transaction, the credit facility remains available subject to the same terms and conditions as before.

However, there can be no assurances that the closure of Silicon Valley Bank or any related impacts across the financial services industry will not adversely affect our ability to access the funds available under the Credit Agreement.

If adequate funds are not available on acceptable terms, we may be unable to invest in future growth opportunities, which could harm our business, operating results, and financial condition.

Furthermore, if we issue additional equity securities, stockholders will experience dilution, and the new equity securities could have rights senior to those of our Class A common stock.

Any debt financing we secure may have higher interest rates and could involve additional restrictive covenants relating to our capital raising activities and other financial and operational matters, which may make it more difficult for us to obtain additional capital and to pursue business opportunities,

including potential acquisitions.

If we were to violate such restrictive covenants, we could incur penalties, increased expenses and an acceleration of the payment terms of our outstanding debt, which could in turn harm our business.

5 unchanged sentences

For example, we have some customers who increase their usage and requests when they need more capacity during busy periods, especially in the fourth quarter of the year, and then subsequently scale back.

We also host certain large-scale events, such as major elections or sporting events, that may be seasonal or one-time which can cause revenue to fluctuate between the periods in which these events occur and subsequent periods.

Our customers host certain large-scale events, such as sporting events or coverage of major elections, increasing their usage on a seasonal or one-time basis which can cause revenue to fluctuate between the periods in which these events occur and subsequent periods.

Since we have built our network to handle seasonal capacity fluctuations, we may not be able to reduce our capacity in a timely manner, and as such sustain more costs.

19 unchanged sentences

• more stringent regulations relating to privacy and data security and the unauthorized use of, or access to, commercial and personal information, particularly in Europe;

locations, and where potential labor organizing and works council negotiations in certain of those countries could contribute to increased operational costs or otherwise disrupt our business;

• differing labor regulations, especially in Europe and Japan, where labor laws are generally more advantageous to employees as compared to the United States, including deemed hourly wage and overtime regulations in these locations, and where potential labor organizing and works council negotiations in certain of those countries could contribute to increased operational costs or otherwise disrupt our business;

• challenges inherent in efficiently managing an increased number of employees over large geographic distances, including the need to implement appropriate systems, policies, benefits, and compliance programs;

8 unchanged sentences

• limited or insufficient intellectual property protection or difficulties enforcing our intellectual property rights;

• political instability, economic sanctions, terrorist activities, or international conflicts, including the ongoing conflict between Russia and Ukraine, which may impact the operations of our business or the businesses of our customers;

• political instability, economic sanctions, terrorist activities, or international conflicts, including ongoing conflicts between Russia and Ukraine and Hamas and Israel, which may impact the operations of our business or the businesses of our customers;

• inflationary pressures, such as those the global market is currently experiencing, labor shortages and supply chain disruptions, which may increase costs for certain services;

7 unchanged sentences

GAAP”) requires management to make estimates and assumptions that affect the amounts reported in the consolidated financial statements and accompanying notes.

We base our estimates on historical experience and on various other assumptions that we believe to be reasonable under the circumstances, as provided in the section titled “Management’s Discussion and Analysis of Financial Condition and Results of Operations—Critical Accounting Estimates.” The results of these estimates form the basis for making judgments about the carrying values of assets, liabilities, and equity and the amount of revenue and

expenses that are not readily apparent from other sources.

Significant assumptions and estimates used in preparing our consolidated financial statements include, but are not limited to, those related to revenue, accounts receivable and related reserves, fair value of assets acquired and liabilities assumed for business combinations, useful lives and realizability of long-lived assets including our goodwill and intangible assets, income tax reserves, and accounting for stock-based compensation.

1 unchanged sentence

Current and future indebtedness could restrict our operations, particularly our ability to respond to changes in our business or to take specified actions.

Our Credit Agreement with SVB contains, and any future indebtedness would likely contain, a number of restrictive covenants that impose significant operating and financial restrictions on us, including restrictions on our ability to incur additional indebtedness, grant liens, pay dividends and make distributions, transfer property, make investments, and take other actions that may otherwise be in our best interests.

Our Credit Agreement contains, and any future indebtedness would likely contain, a number of restrictive covenants that impose significant operating and financial restrictions on us, including restrictions on our ability to incur additional indebtedness, grant liens, pay dividends and make distributions, transfer property, make investments, and take other actions that may otherwise be in our best interests.

In addition, our Credit Agreement contains a financial covenant that requires us to maintain a consolidated adjusted quick ratio of at least 1:25 to 1:00 tested on a quarterly basis as well as a springing revenue growth covenant for certain periods if our consolidated adjusted quick ratio falls below 1:75 to 1:00 on the last day of any fiscal quarter.

13 unchanged sentences

We continue to evaluate and take actions to improve our internal control over financial reporting.

However, we cannot assure you that the measures we have taken to date will be sufficient to avoid the identification of material weaknesses in the future.

cannot assure you that the measures we have taken to date will be sufficient to avoid the identification of material weaknesses in the future.

If we fail to identify future material weaknesses in our internal control over financial reporting, if we are unable to comply with the requirements of Section 404 or assert that our internal control over financial reporting is effective, or if our independent registered public accounting firm is unable to express an unqualified opinion or expresses a qualified or adverse opinion about the effectiveness of our internal control over financial reporting, investors may lose confidence in the accuracy and completeness of our financial reports and the market price of our Class A common stock could be negatively affected.

29 unchanged sentences

We are subject, or may become subject, to stringent and evolving U.S.

and foreign laws, governmental regulations, rules, contractual obligations, policies and other legal obligations related to privacy, infrastructure, and data security.

and foreign laws, governmental regulations and rules, and contractual obligations, industry standards, policies and other obligations related to privacy, infrastructure, and data security.

Our actual or perceived failure to comply with such obligations could harm our business, by resulting in regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, adverse publicity and reputational damage, loss of revenue or profits, loss of customers or sales and other adverse consequences that may negatively affect the value of our business and decrease the price of our Class A common stock.

5 unchanged sentences

Domestically, states have also begun to introduce more comprehensive privacy and data security legislation, including data breach notification laws, personal information privacy laws, and consumer protection laws.

For example, the California Consumer Privacy Act of 2018 (“CCPA”) applies to personal information of consumers, business representatives, and employees, and requires businesses to provide specific disclosures in privacy notices and honor requests of California residents to exercise certain privacy rights.

The CCPA also allows for statutory fines for noncompliance (up to $7,500 per violation), as well as a private right of action for individuals affected by certain data breaches to recover significant statutory damages.

In addition, the California Privacy Rights Act of 2020 expands the CCPA's requirements, including by adding a new right for individuals to correct their personal information and establishing a new agency to implement and enforce the law.

Other states, such as Virginia, Colorado, Utah and Connecticut, have also passed comprehensive privacy and data security laws, and similar laws have been proposed at the federal, state, and local levels that, if passed, could increase our potential liability, increase our compliance costs and adversely affect our business.

Additionally, several states and localities have enacted measures related to the use of artificial intelligence (“AI") and machine learning in products and services.

In the past few years, numerous U.S.

states—including California, Virginia, Colorado, Connecticut, and Utah—have enacted comprehensive privacy and data security laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal information.

As applicable, such rights may include the right to access, correct, or delete certain personal information, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making.

The exercise of these rights may impact our business and ability to provide our products and services.

Certain states also impose stricter requirements for processing certain personal information, including sensitive information, such as conducting data privacy impact assessments.

These state laws allow for statutory fines for noncompliance.

For example, the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (“CPRA”), collectively ("CCPA") applies to personal information of consumers, business representatives, and employees who are California residents, and requires businesses to provide specific disclosures in privacy notices and honor requests of such individuals to exercise certain privacy rights related to their personal information.

The CCPA allows for statutory fines for noncompliance (up to $7,500 per violation), as well as a private right of action for individuals affected by certain data breaches to recover significant statutory damages.

Similar laws have been proposed in several other states and at the federal and local levels, and we expect more states to pass similar laws in the future, which could increase our compliance costs and adversely affect our business.

Our customers may deploy AI models or technologies using our platform, and our employees and personnel may use AI to perform their work.

Governments have passed and are likely to pass additional laws regulating AI.

Our use of this technology could result in additional compliance costs, regulatory investigations and actions, and lawsuits.

If we are unable to use AI, it could make our business less efficient and result in competitive disadvantages.

Due to inaccuracies or flaws in the inputs, outputs, or logic of the AI, the model could be biased and could lead us to make decisions that could bias certain individuals (or classes of individuals), and adversely impact their rights, employment, and ability to obtain certain pricing, products, services, or benefits.

Several jurisdictions around the globe, including Europe and certain U.S.

states, have proposed, enacted, or are considering laws governing the development, deployment and use of AI, such as the EU’s AI Act.

We expect other jurisdictions will adopt similar laws.

These obligations may make it harder for us to conduct our business using AI, lead to regulatory fines or penalties, require us to change our business practices, retrain our AI, or prevent or limit our use of AI.

If we cannot use or are restricted in using AI technologies, or deployment of AI by our customers using our platform is affected, our business may be less efficient, or we may be at a competitive disadvantage.

Outside of the United States, an increasing number of foreign laws and regulations apply to privacy and data security.

For example, the European Union’s General Data Protection Regulation (“EU GDPR”), the United Kingdom’s GDPR (“UK GDPR”), Brazil’s General Data Protection Law (Lei Geral de Proteção de Dados Pessoais or “LGPD”) (Law No.

For example, the European Union’s General Data Protection Regulation (“EU GDPR”), the United Kingdom’s GDPR (“UK GDPR”), (collectively “GDPR”) Brazil’s General Data Protection Law (Lei Geral de Proteção de Dados Pessoais or “LGPD”) (Law No.

13,709/2018), Canada’s Personal Information Protection and Electronic Documents Act (“PIPEDA”) and Canada’s Anti-Spam Legislation (“CASL”), and China’s Personal Information Protection Law (“PIPL”) impose strict requirements for processing the personal information of individuals.

For example, under the EU GDPR and UK GDPR, government regulators may impose restrictions or injunctions on data processing, and fines of up to 20 million euros (£17.5 million for the UK GDPR) or 4% of annual global revenue, whichever is greater.

The EU GDPR also provides for private litigation related to the processing of personal information, which can be brought by classes of data subjects or consumer protection organizations authorized by law to represent the interests of such classes.

For example, under the GDPR, government regulators may impose restrictions or injunctions on data processing, and fines of up to 20 million euros (£17.5 million) or 4% of annual global revenue, whichever is greater.

The GDPR also provides for private litigation related to the processing of personal information, which can be brought by classes of data subjects or consumer protection organizations authorized by law to represent the interests of such classes.

European legislative proposals and existing laws and regulations also apply to cookies and similar tracking technologies, electronic communications, and marketing.

2 unchanged sentences

Compliance with these laws may require us to make significant operational changes, limit the effectiveness of our marketing activities, divert the attention of our technology personnel, adversely affect our margins, and subject us to liabilities.

Furthermore, there is a proposed regulation in the EU related to AI that, if adopted, could impose onerous obligations related to the use of AI-related systems that may require us to change our business practices.

Furthermore, there is a new regulation in the EU related to AI that will impose onerous obligations related to the use of AI-related systems and may require us to change our business practices.

We may also become subject to new laws in the EU that regulate cybersecurity and non-personal information, such as the European Data Act.

Depending on how these laws are interpreted, we may have to adapt our business practices and products to comply with such obligations.

Certain jurisdictions have enacted data localization laws and cross-border personal information transfer laws, which could make it more difficult to transfer information across jurisdictions.

In particular, the European Economic Area (“EEA”) and the United Kingdom (“UK”) have significantly restricted the transfer of personal information to the United States and other countries whose privacy and data security laws are believed to be inadequate.

Other jurisdictions may adopt similarly stringent interpretations of their data localization and cross-border personal information transfer laws.

Although there are currently various mechanisms that may be used to lawfully transfer personal information to the United States, such as the standard

contractual clauses for transfers from the EEA and UK, these mechanisms are subject to legal challenges and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal information to the United States or elsewhere.

Certain countries outside Europe (e.g.

Russia, China, Brazil) have also passed or are considering laws requiring local data residency or otherwise impeding the transfer of personal information across borders, any of which could increase the cost and complexity of doing business.

Although there are currently various mechanisms that may be used to lawfully transfer personal information to the United States, such as the standard contractual clauses for transfers from the EEA and UK, the UK’s International Data Transfer Agreement / Addendum, and the EU-U.S.

Data Privacy Framework (which allows for transfers to relevant U.S.-based organizations who self-certify compliance and participate in the Framework), these mechanisms are subject to legal challenges and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal information to the United States or elsewhere.

Certain countries outside Europe (e.g., Russia, China, Brazil) have also passed or are considering laws requiring local data residency or otherwise impeding the transfer of personal information across borders, any of which could increase the cost and complexity of doing business.

If there is no lawful manner for us to transfer personal information from the EEA, the UK or other jurisdictions to the United States or elsewhere, or if the requirements for a legally-compliant transfer are too onerous, we may face significant adverse consequences, such as the interruption or degradation of our operations, increased exposure to regulatory actions, substantial fines, injunctions against processing or transferring personal information, determinations by customers not to use our services, limited ability to collaborate with parties that are subject to cross-border data transfer or localization laws, and the need to increase or relocate our personal information processing capabilities and infrastructure in foreign jurisdictions at significant expense.

5 unchanged sentences

We may also be bound by contractual obligations related to privacy and data security, and our efforts to comply with such obligations may not be successful.

For example, certain privacy and data security laws, such as the EU GDPR and the CCPA, require our customers to impose specific contractual restrictions on their service providers.

For example, certain privacy and data security laws, such as the EU GDPR and the CCPA, require our customers

to impose specific contractual restrictions on their service providers.

Additionally, in limited circumstances, under various privacy and data security laws and other obligations, we may be required to obtain certain consents to process personal information.

1 unchanged sentence

Laws relating to the liability of providers of online services for activities of their users and other third parties are currently being tested by a number of claims, including actions based on invasion of privacy and other torts, unfair competition, copyright and trademark infringement, and other theories based on the nature and content of the materials searched, the ads posted, or the content provided by users.

Moreover, our global platform outage in June 2021 has increased our public profile and resulted in more frequent interest in our company by regulators.

This outage, or any additional outages, may draw additional scrutiny or focused legislation from regulators.

Moreover, our global platform outage in June 2021 increased our public profile and resulted in more frequent interest in our company by regulators.

Any additional outages may draw additional scrutiny or focused legislation from regulators.

In addition, the United States or foreign jurisdictions may establish new laws or regulations regarding the Internet or online services.

These new laws and regulations may affect our products and infrastructure, which could cause us to incur substantial costs to comply, expose us to regulatory scrutiny, criminal or civil liability, require us to fundamentally change our products or operations, or otherwise have an adverse effect on our business.

Obligations relating to privacy and data security are evolving, increasingly stringent, creating regulatory uncertainty, and may result in increasing scrutiny.

Obligations relating to privacy and data security (and customers’ data privacy expectations) are evolving, increasingly stringent, creating uncertainty, and may result in increasing scrutiny.

Such obligations may be subject to different applications and interpretations, and which may be inconsistent and conflicting among different jurisdictions.

14 unchanged sentences

or substantial changes to our business model or operations.

Activities of our customers or the content of their websites and other Internet properties may violate applicable laws and/or our terms of service and could subject us to lawsuits, regulatory enforcement actions, and/or liability in various jurisdictions.

Through our network, we provide a wide variety of products that enable our customers and our customers’ users to exchange information, conduct business, and engage in various online activities both domestically and internationally.

Our customers and our customers’ users may use our network and products in violation of applicable law or in violation of our terms of service or the customer’s own policies.

The existing laws relating to the liability of providers of online products and services for activities of their users are highly unsettled and in flux both within the United States and internationally.

In the future we may be subject to lawsuits and/or liability arising from the conduct of our customers and our customers’ users.

Additionally, the conduct of our customers and our customers’ users may subject us to regulatory enforcement actions and/or liability.

There can be no assurance that we will not face litigation in the future or that we will prevail in any litigation we may face.

An adverse decision in one or more of these lawsuits could materially and adversely affect our business, results of operations, and financial condition.

federal statutes may apply to us with respect to various activities of our customers, including the Digital Millennium Copyright Act (“DMCA”), which provides recourse for owners of copyrighted material who believe their rights

and section 230, enacted in the Communications Decency Act (“CDA”), which addresses blocking and screening of content on the Internet.

Although these and other similar legal provisions provide limited protections from liability for service providers like us, those protections may not be interpreted in a way that applies to us, may be amended or removed in the future, or may not provide us with complete protection from liability claims.

If we are found not to be protected by the safe harbor provisions of the DMCA, CDA or other similar laws, or if we are deemed subject to laws in other countries that may not have the same protections or that may impose more onerous obligations on us, we may owe substantial damages and our brand, reputation, and financial results may be harmed.

Policies and laws in this area remain highly dynamic, and we may face additional theories of intermediary liability in various jurisdictions.

For example, policymakers in the United States have called for a re-examination of CDA section 230 and copyright law, the UK has passed the Online Safety Act 2023, and the EU has implemented the Digital Services Act and Digital Markets Act to impose additional legal requirements on certain service providers.

The DSA sets out a framework of layered responsibilities targeted at different types of services, including requirements for service providers to act on orders against illegal content and to publish reports on moderation of content.

Member States can also issue rules on penalties for violating the DSA, with fines of up to 6% of annual global revenue.

Complying with these obligations could cause us to change our products, policies, and procedures.

In addition, in 2019, the EU approved a Copyright Directive that will impose additional obligations on service providers and failure to comply could give rise to significant liability.

Other laws and pending legislation at the EU level (terrorist content, child sexual abuse materials) and in the UK (online harms), Australia (online harms), and India (Digital India Act), as well as other new laws like them, may also expose Internet companies like us to significant liability.

We may incur additional costs to comply with these new laws, which may have an adverse effect on our business, results of operations, and financial condition.

We could be subject to claims for potential damages based on a significant number of online occurrences under statutory or other damage theories.

Such claims may result in liability that exceeds our ability to pay or our insurance coverage.

Even if potential claims against us are ultimately unsuccessful, defending against such claims could increase our legal expenses and divert management’s attention from the operation of our business, which could materially and adversely impact our business and results of operations.

Our sales to highly regulated organizations and government entities are subject to a number of challenges and risks.

11 unchanged sentences

In January 2018, the Federal Communications Commission, or the FCC, repealed the “network neutrality” rules adopted during the Obama Administration, which barred Internet service providers from blocking or slowing down access to online content, protecting services like ours from such interference.

The 2018 decision was largely affirmed by the United States Court of Appeals for the District of Columbia Circuit, subject to a remand to consider several issues raised by parties that supported network neutrality, and in November 2020 the FCC affirmed its decision to repeal the rules.

Petitions for reconsideration of this decision are pending.

President Biden supported restoration of the network neutrality rules during his Presidential campaign, and such action is supported by the current Democratic FCC commissioners.

In addition, a number of states have adopted or are adopting or considering legislation or executive actions that would regulate the conduct of broadband providers.

A federal court judge denied a request for injunction against California’s state-specific network neutrality law, and as a result, California began enforcing that law.

Trade associations representing internet service providers appealed the district court’s ruling denying the preliminary injunction, and the appeal was denied on January 28, 2022.

The trade associations sought rehearing with the full court of appeal, and on April 20, 2022 it declined to rehear the case.

The appellants did not appeal to the U.S.

Supreme Court.

A number of other states have adopted or are adopting or considering legislation or executive actions that would regulate the conduct of broadband providers.

For instance, a temporary injunction preventing implementation of a similar law in Vermont expired on April 20, 2022, but the challenge to that law remains pending.

We cannot predict whether the FCC order or other state initiatives will be enforced, modified, overturned, or vacated by legal action of the court, federal legislation, or the FCC.

The 2018 decision was largely affirmed by the United States Court

of Appeals for the District of Columbia Circuit, subject to a remand to consider several issues raised by parties that supported network neutrality, and in November 2020 the FCC affirmed its decision to repeal the rules.

On October 19, 2023, the FCC adopted a notice of proposed rulemaking that would reinstate the network neutrality rules, and asked for comment on that proposal and on potential changes to those rules.

We cannot predict whether or when the FCC will adopt new rules or the impact of any rules that may be adopted on our operations or business.

A number of states have adopted or are adopting or considering legislation or executive actions that would regulate the conduct of broadband providers.

California’s state-specific network neutrality law has taken effect, as has a similar law in Vermont, but a challenge to the Vermont law remains pending and has been suspended until an appeal in another case addressing state powers to adopt internet regulation is resolved.

In addition, the status of state regimes may be affected by the FCC’s action in its new network neutrality proceeding.

We cannot predict whether any FCC order or other state initiatives will be enforced, modified, overturned, or vacated by legal action of the court, federal legislation, or the FCC.

To the extent network operators attempt to interfere with our platform, absent network neutrality rules, attempt to interfere with our services, extract fees from us to deliver our platform, or otherwise engage in discriminatory practices, our business could be adversely impacted.

29 unchanged sentences

Wayfair, Inc.

et al ("Wayfair") that online sellers can be required to collect sales and use tax despite not having a physical presence in the buyer’s

et al (“Wayfair”) that online sellers can be required to collect sales and use tax despite not having a physical presence in the buyer’s state.

In response to Wayfair, or otherwise, states or local governments may adopt, or begin to enforce, laws requiring us to calculate, collect, and remit taxes on sales in their jurisdictions.

6 unchanged sentences

We operate, and are subject to taxes, in the United States and numerous other jurisdictions throughout the world.

Changes to federal, state, local, or international tax laws on income, sales, use, indirect, or other tax laws, statutes, rules, regulations, or ordinances on multinational corporations are currently being considered by the United States and other countries where we do business.

These contemplated legislative initiatives include, but are not limited to, changes to transfer pricing policies and definitional changes to permanent establishment that could be applied solely or disproportionately to services provided over the internet.

federal, state, local, or non-U.S.

international tax laws on income, sales, use, indirect, or other tax laws, statutes, rules, regulations, or ordinances on multinational corporations to which we are subject are or under which we operate are unsettled in certain respects and may be subject to significant change.

For example, many countries in Europe, as well as a number of other countries and organizations, including the Organization for Economic Cooperation and Development and the European Commission, have recently proposed, recommended, or (in the case of countries) enacted changes to existing tax laws or new tax laws that could significantly increase our tax obligations in the countries where we do business or require us to change the manner in which we operate our business.

These proposals, recommendations and enactments include changes to the existing framework in respect of income taxes, as well as new types of non-income taxes (such as taxes based on a percentage of revenue or taxes applicable to digital services), which could apply to our business.

These contemplated tax initiatives, if finalized and adopted by countries, may ultimately impact our effective tax rate and could adversely affect our sales activity resulting in a negative impact on our operating results and cash flows.

In addition, existing tax laws, statutes, rules, regulations, or ordinances could be interpreted, changed, modified, or applied adversely to us (possibly with retroactive effect), which could require us to pay additional tax amounts, fines or penalties, and interest for past amounts.

The additional tax obligations could relate to our taxes or obligations to report or withhold on customer taxes.

In addition, existing tax laws, statutes, rules, regulations, or ordinances could be interpreted, modified, or applied adversely to us (possibly with retroactive effect), which could require us to pay additional tax amounts, fines or penalties, and interest for past amounts.

The additional tax obligations could relate to our taxes or obligations to report or withhold on

customer taxes.

We could take steps to collect customer related taxes, but if we are unsuccessful in collecting such taxes from our customers, we could be held liable for such costs, thereby adversely impacting our operating results and cash flows.

Further, if our customers must pay additional fines or penalties, it could adversely affect demand for our services.

Legislation in 2017 informally titled the “Tax Act” significantly revised the Internal Revenue Code of 1986, as amended (the “Code”).

Recently, the Inflation Reduction Act of 2022 (the "IRA") was enacted, which includes provisions that will impact the U.S.

federal income taxation of corporations, including imposing a minimum tax on the book income of certain large corporations and an excise tax on certain corporate stock repurchases that would be imposed on the corporation repurchasing such stock.

Legislation enacted in 2017 informally titled the “Tax Act” significantly revised the Internal Revenue Code of 1986, as amended (the “Code”).

In 2022, the Inflation Reduction Act of 2022 (the “IRA”) was enacted, which includes provisions that impact the U.S.

federal income taxation of corporations, including imposing a minimum tax on the book income of certain large corporations and an excise tax on certain corporate stock repurchases that is imposed on the corporation repurchasing such stock.

Future legislation or regulatory guidance, including under the Tax Act or the IRA, or other executive or Congressional actions in the United States may occur, and could ultimately increase or lessen the impact of such taxes on our business and financial condition.

3 unchanged sentences

federal income tax purposes, our NOLs generated in tax years beginning before January 1, 2018 are permitted to be carried forward for 20 years.

federal NOLs generated in tax years beginning after December 31, 2017 may be carried forward indefinitely, but for tax years beginning after December 31, 2020, our use of such federal NOLs generally is limited to 80% of such year's taxable income, computed without regard to the NOL deduction and certain other deductions.

It is uncertain if, and to what extent, various states will conform to these limitations on the use of federal NOLs.

federal NOLs generated in tax years beginning after December 31, 2017 may be carried forward indefinitely, but our use of such U.S.

federal NOLs generally is limited to 80% of such year’s taxable income, computed without regard to the NOL deduction and certain other deductions.

It is uncertain if, and to what extent, various states will conform to these limitations on the use of U.S.

federal NOLs.

In addition, under Section 382 of the Code, a corporation that undergoes an “ownership change” may be subject to limitations on its ability to utilize its pre-change NOLs to offset future taxable income.

1 unchanged sentence

As a result of this analysis, we concluded that there is no longer any limitation on our utilization of such NOLs.

A detailed analysis was performed for the period March 1, 2014 to October 1, 2020

for Signal Sciences to determine whether an ownership change under Section 382 of the Code has occurred and an ownership change was identified in 2020.

A detailed analysis was performed for the period March 1, 2014 to October 1, 2020 for Signal Sciences to determine whether an ownership change under Section 382 of the Code has occurred and an ownership change was identified in 2020.

As a result of this analysis, we concluded that there is no longer any limitation on our utilization of the NOLs of Signal Sciences.

16 unchanged sentences

We incorporate encryption technology into certain of our products.

These encryption products and the underlying technology may be exported outside of the United States only with the required export authorizations.

These encryption products and the underlying technology may be exported outside of the United States only with the required export

authorizations.

Other countries also regulate the import and export of certain encryption products and technology through import and export licensing requirements, and have enacted laws that could limit our ability to distribute our products or could limit our customers’ ability to implement our products in those countries.

24 unchanged sentences

dollar LIBOR settings.

The interest rate under our Credit Agreement is calculated based on LIBOR.

No modification has yet been made to the interest rate under the Credit Agreement, but changes will be required in the future.

Currently, it is anticipated that the new benchmark for our U.S.

dollar borrowings will be the Secured Overnight Financing Rate (“SOFR”).

On June 28, 2023, we entered into the First Amendment to Credit Agreement with the Lenders and First-Citizens Bank & Trust Company (successor by purchase to the Federal Deposit Insurance Corporation as Receiver for Silicon Valley Bridge Bank, N.A.

(as successor to Silicon Valley Bank)), as a lender and as administrative agent and collateral agent for the Lenders to, among other things, amend the interest rate provisions to replace LIBOR with the Secured Overnight Financing Rate (“SOFR”) as the interest rate benchmark.

The shift to SOFR from LIBOR is complex and may adversely affect our business, financial condition, results of operations, liquidity, and cash flows.

Unfavorable conditions in our industry or the global economy, including those caused by the Russian military operations and related geopolitical situation in Ukraine, rising inflation or reductions in information technology spending could harm our business.

Unfavorable conditions in our industry or the global economy, rising inflation or reductions in information technology spending could harm our business.

Global economic conditions have impacted, and will likely continue to impact, businesses around the world, including ours.

Inflation and other macroeconomic pressures in the U.S.

and the global economy such as rising interest rates and recession fears are creating a complex and challenging environment for us and our customers.

and the global economy such as rising interest rates, banking instability and recession fears are creating a complex and challenging environment for us and our customers.

Our results of operations may vary based on the impact of changes in our industry or the global economy on us or our customers and potential customers.

Current or future economic uncertainties or downturns could adversely affect our business and results of operations.

capital markets experienced and continues to experience extreme volatility following the global outbreak of the COVID-19 pandemic in 2020 and the Russian invasion of Ukraine in 2022.

While our ability to do business has not been materially affected, the Russian invasion of Ukraine and the global restrictive measures that have been taken, and could be taken in the future, have created significant global economic uncertainty that could prolong and escalate tensions and expand the geopolitical conflict, which could have a lasting impact on regional and global economies, any of which could harm our business and operating results.

Further, due to political uncertainty and military actions involving Russia, Ukraine, and surrounding regions, we and the third parties upon which we rely may be vulnerable to a heightened risk of security breaches, computer malware, social-engineering attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, and other cyber-attacks, including attacks that could materially disrupt our systems and operations, supply chain, and ability to do business .

capital markets experienced and continue to experience extreme volatility.

While our ability to do business has not been materially affected, and the global restrictive measures that have been taken in response to such events, and could be taken in the future, have created significant global economic uncertainty that could prolong and escalate tensions and expand the geopolitical conflict, which could have a lasting impact on regional and global economies, any of which could harm our business and operating results.

Further, due to political uncertainty and international military actions, we and the third parties upon which we rely may be vulnerable to a heightened risk of security breaches, computer malware, social-engineering attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, and other cyber-attacks, including attacks that could materially disrupt our systems and operations, supply chain, and ability to do business .

These attacks are expected to continue to occur in the future.

Furthermore, inflation rates in the U.S.

have recently increased to levels not seen in decades, prompting the Federal Reserve to increase interest rates.

Negative conditions in the general economy both in the United States and abroad, including conditions resulting from changes in gross domestic product growth, financial and credit market fluctuations, currency and interest rate fluctuations, political turmoil, natural catastrophes, warfare, public health issues, such as the COVID-19 pandemic, and terrorist attacks on the United States, Europe, the Asia Pacific region, or elsewhere, could cause a downturn or recession and a decrease in business investments, including spending on information technology, which would harm our business.

in the past few years have increased to levels not seen in decades, prompting the Federal Reserve to increase interest rates.

Negative conditions in the general economy both in the United States and abroad, including conditions resulting from changes in gross domestic product growth, financial and credit market fluctuations, currency and interest rate fluctuations, political turmoil, natural catastrophes, warfare, public health issues, and terrorist attacks on the United States, Europe, the Asia Pacific region, or elsewhere, could cause a downturn or recession and a decrease in business investments, including spending on information technology, which would harm our business.

To the extent that our platform and our products are perceived by customers and potential customers as too costly, or difficult to deploy or migrate to, our revenue may be disproportionately affected by delays or reductions in general information technology spending.

34 unchanged sentences

If a third party is able to obtain an injunction preventing us from accessing such third-party intellectual property rights, or if we cannot license or develop technology for any infringing aspect of our business, we would be forced to limit or stop selling products impacted by the claim or injunction or cease business activities covered by such intellectual property, and may be unable to compete effectively.

Any inability to license third-party technology in the

future would have an adverse effect on our business and operating results, and would adversely affect our ability to compete.

Any inability to license third-party technology in the future would have an adverse effect on our business and operating results, and would adversely affect our ability to compete.

We may also be contractually obligated to indemnify our customers in the event of infringement of a third party’s intellectual property rights.

35 unchanged sentences

• changes in the anticipated future size and growth rate of our market;

• general political, social, economic, regulatory, and market conditions, in both domestic and our foreign markets, including the effects of global events like the war in Ukraine on the global economy, labor shortages, supply chain disruptions, inflation, increased interest rates and slow or negative growth of our markets.

• general political, social, economic, regulatory, and market conditions, in both domestic and our foreign markets, including the effects of global events like the war in Ukraine and the more recent hostilities in Israel on the global

economy, labor shortages, supply chain disruptions, inflation, increased interest rates, banking instability and slow or negative growth of our markets.

Broad market and industry fluctuations, as well as general economic, political, social, regulatory, and market conditions, may impact the market price of our Class A common stock.

10 unchanged sentences

In March 2021, we entered into a purchase agreement for the sale of an aggregate of $948.8 million principal amount of our 0% convertible senior notes due 2026 (the “Notes”).

On May 25, 2022, we entered into separate, privately negotiated transactions with certain holders of the Notes to repurchase (the “Repurchases”) approximately $235.0 million aggregate outstanding principal amount of the Notes for an aggregate cash repurchase price of approximately $176.4 million.

The Repurchases closed on May 31, 2022.

The remaining Notes of $713.8 million will mature on March 15, 2026, unless earlier converted, redeemed or repurchased.

During the year ended December 31, 2022, we entered into separate, privately negotiated transactions with certain holders of the Notes to repurchase approximately $235.0 million aggregate outstanding principal amount of the Notes for an aggregate cash repurchase price of approximately $176.4 million.

During the year ended December 31, 2023, we entered into several separate, privately negotiated transactions with certain holders of the Notes to repurchase (the “Repurchases”) $367.3 million of aggregate principal amount of the Notes for an aggregate cash repurchase price of $309.1 million and aggregate transaction costs of $2.0 million.

The remaining Notes with an aggregate principal amount of $346.5 million will mature on March 15, 2026, unless earlier converted, redeemed or repurchased.

Holders of the Notes will have the right, subject to certain conditions and limited exceptions, to require us to repurchase all or a portion of their Notes upon the occurrence of a fundamental change at a fundamental change repurchase price equal to 100% of the principal amount of the Notes to be repurchased, plus accrued and unpaid special interest, if any, as described in the indenture governing the Notes.

If our stock price is lower than the conversion

price of the Notes on maturity, the holders of our Notes will likely not convert and we will have to repay those Notes in cash.

If our stock price is lower than the conversion price of the Notes on maturity, the holders of our Notes will likely not convert and we will have to repay those Notes in cash.

In addition, upon conversion of the Notes, unless we elect to deliver solely shares of our Class A common stock to settle such conversion (other than paying cash in lieu of delivering any fractional share), we will be required to make cash payments in respect of the Notes being converted as described in the indenture governing the Notes.

10 unchanged sentences

If we elect to settle our conversion obligation in shares of our Class A common stock or a combination of cash and shares of our Class A common stock, any sales in the public market of our Class A common stock issuable upon such conversion could adversely affect prevailing market prices of our Class A common stock.

In addition, the existence of the Notes may encourage short selling by market participants because the conversion of the Notes could be used to satisfy short positions, or anticipated conversion of the Notes into shares of our Class A common stock could depress the price of our Class A common stock.

In addition, the existence of the Notes may encourage short selling by market participants because the conversion of the

Notes could be used to satisfy short positions, or anticipated conversion of the Notes into shares of our Class A common stock could depress the price of our Class A common stock.

Servicing our debt requires a significant amount of cash, and we may not have sufficient cash flow from our business to pay our substantial debt.

12 unchanged sentences

and the national securities exchanges of a “Limit Up-Limit Down” program, the imposition of market-wide circuit breakers that halt trading of securities for certain periods following specific market declines, and the implementation of certain regulatory reforms required by the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010.

Any governmental or regulatory action that restricts the ability of investors in, or potential purchasers of, the Notes to effect short sales of our Class A common stock, borrow our Class A

common stock or enter into swaps on our Class A common stock could adversely affect the trading price and the liquidity of the Notes.

Any governmental or regulatory action that restricts the ability of investors in, or potential purchasers of, the Notes to effect short sales of our Class A common stock, borrow our Class A common stock or enter into swaps on our Class A common stock could adversely affect the trading price and the liquidity of the Notes.

The conditional conversion feature of the Notes, if triggered, may adversely affect our financial condition and operating results.

8 unchanged sentences

We may sell Class A common stock, convertible securities, and other equity securities in one or more transactions at prices and in a manner as we may determine from time to time.

If we sell any such securities in subsequent transactions, investors may be materially diluted.

any such securities in subsequent transactions, investors may be materially diluted.

New investors in such subsequent transactions could gain rights, preferences, and privileges senior to those of holders of our Class A common stock.

12 unchanged sentences

We do not have any control over these analysts.

If the number of analysts that cover

us declines, demand for our Class A common stock could decrease and our Class A common stock price and trading volume may decline.

If the number of analysts that cover us declines, demand for our Class A common stock could decrease and our Class A common stock price and trading volume may decline.

Even if our Class A common stock is actively covered by analysts, we do not have any control over the analysts or the measures that analysts or investors may rely upon to forecast our future results.

8 unchanged sentences

Accordingly, investors must rely on sales of their Class A common stock after price appreciation, which may never occur, as the only way to realize any future gains on their investments.

We incur increased costs as a result of operating as a public company, and our management is required to devote substantial time to compliance with our public company responsibilities and corporate governance practices.

We incur significant costs as a result of operating as a public company, and our management is required to devote substantial time to compliance with our public company responsibilities and corporate governance practices.

As a public company, we incur significant legal, accounting, and other expenses that we did not incur as a private company.

33 unchanged sentences

To prevent having to litigate claims in multiple jurisdictions and the threat of inconsistent or contrary rulings by different courts, among other considerations, our amended and restated certificate of incorporation provides that the federal district courts of the United States of America will be the exclusive forum for resolving any complaint asserting a cause of action arising under the Securities Act.

Delaware courts have determined that such choice of forum provisions are facially valid, and several state trial courts have enforced such provisions and required that suits asserting Securities Act claims be filed in federal court, there is no guarantee that courts of appeal will affirm the enforceability of such provisions and a stockholder may nevertheless seek to bring a claim in a venue other than those designated in the exclusive forum provisions.

While the Delaware courts have determined that such choice of forum provisions are facially valid, and several state trial courts have enforced such provisions and required that suits asserting Securities Act claims be filed in federal court, there is no guarantee that courts of appeal will affirm the enforceability of such provisions and a stockholder may nevertheless seek to bring a claim in a venue other than those designated in the exclusive forum provisions.

In such instance, we would expect to vigorously assert the validity and enforceability of the exclusive forum provisions of our amended and restated certificate of incorporation.

3 unchanged sentences

If a court were to find either exclusive-forum provision in our amended and restated certificate of incorporation to be inapplicable or unenforceable in an action, we may incur further significant additional costs associated with resolving the dispute in other jurisdictions, all of which could harm our business.

Unresolved Staff Comments

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors