What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2026-02-25 compared with 2025-02-26 · 278 added, 239 removed, 905 unchanged (36% of the section changed)

16 unchanged sentences

We depend, in part, on our third-party facility providers’ ability to protect these facilities against damage or interruption from natural disasters, extreme weather events, power or telecommunications failures, criminal acts, armed conflict, public health issues, such as a pandemic or epidemic, and similar events.

In some cases, third-party cloud providers run their own platforms that we access, and are, therefore, vulnerable to their service interruptions.

In some cases, third-party cloud providers run their own platforms that we access, and we are, therefore, vulnerable to their service interruptions.

In the event that there are any defects or errors in software, failures of hardware, damages to a facility, or misconfigurations of any of our services, we may have to divert resources away from other planned work, could experience lengthy interruptions in our platform, and also incur delays and additional expenses in arranging new facilities and services.

6 unchanged sentences

Any interruptions or delays in our platform, whether caused by our products or our data centers, third-party error, our own error, natural disasters (such as drought, flooding, wildfires, and storms), or security breaches, whether accidental or willful, could harm our relationships with customers, reduce customers’ usage of our platform, cause our revenue to decrease and our expenses to increase, and divert resources away from product development.

Climate change and other environmental or social pressures is expected to increase the frequency and severity of certain events, as well as contribute to chronic changes (such as changes in meteorological and hydrological patterns) that may also result in similar or additional risks.

Climate change and other environmental or social pressures are expected to increase the frequency and severity of certain events, as well as contribute to chronic changes (such as changes in meteorological and hydrological patterns) that may also result in similar or additional risks.

Also, in the event of damage or interruption, our insurance policies may not adequately compensate us for any losses that we may incur.

22 unchanged sentences

Most of our customers, including some of our largest enterprise customers, do not have long-term contractual financial commitments to us.

Some of our customers, who generally do not include our enterprise customers, enter into “click-though” agreements with us via our self-service model, and agree to a minimum monthly fee by signing up online with a credit card, and can easily terminate their subscriptions, or switch to a less expensive plan, at will with little advance notice.

Some of our customers, who generally do not include our enterprise customers, enter into “click-through” agreements with us via our self-service model, and agree to a minimum monthly fee by signing up online with a credit card, and can easily terminate their subscriptions, or switch to a less expensive plan, at will with little advance notice.

In addition, most of our current customer contracts are only one year in duration and these customers may not use our platform in a subsequent year.

3 unchanged sentences

usage, it can be easy for certain customers to quickly reallocate usage or switch from our platform to an alternative platform altogether.

In addition, they may reduce or cease their use of our products at any time without penalty or termination charges, even after they have expanded usage in prior periods.

In addition, certain customers may reduce or cease their use of our products at any time without penalty or termination charges, even after they have expanded usage in prior periods.

We base our decisions about expense levels and investments on estimates of our future revenue and anticipated rate of growth.

9 unchanged sentences

In addition, because many of our products endeavor to deliver increased efficiency and functionality, the successful sale of a new or additional product to an existing customer could result in a reduction of the customer’s overall usage of our platform.

We receive a substantial portion of our revenues from a limited number of customers from a limited number of industries, and the loss of, or a significant reduction in usage by, one or more of our major customers would result in lower revenues and could harm our business.

We receive a substantial portion of our revenues from a limited number of customers within a limited number of industries, and the loss of, or a significant reduction in usage by, one or more of our major customers would result in lower revenues and could harm our business.

Our future success depends on establishing and maintaining successful relationships with a diverse set of customers.

We currently receive a substantial portion of our revenues from a limited number of customers and from a limited number of industries, such as media and entertainment.

We currently receive a substantial portion of our revenues from a limited number of customers and within a limited number of industries, such as media and entertainment.

Our 10 largest customers generated an aggregate of 32% and 33% of our revenue in the trailing 12 months ended December 31, 2025 and 2024, respectively.

No affiliated customers that are business units of a single company generated more than 10% of our revenue in the trailing 12 months ended December 31, 2024.

Affiliated customers that are business units of a single company in the streaming entertainment space generated an aggregate of 12% of our revenue in the trailing 12 months ended December 31, 2023.

In addition, in April 2024, the former administration signed into law a bill that would effectively ban TikTok in the United States if ByteDance, its China-based parent company, does not sell its stake in TikTok within a set time frame.

The current administration signed an executive order on January 20, 2025 instructing the Attorney General not to enforce the law or impose any penalties against any entity for noncompliance for a period of 75 days and to provide written guidance as to how the law will be implemented.

Affiliated customers that are business units of a single company generated an aggregate of 10% of the Company’s revenue for the year ended December 31, 2025.

No affiliated customers that are business units of a single company generated more than 10% of our revenue for the year ended December 31, 2024.

In addition, in April 2024, the former administration signed into law a bill that would effectively ban TikTok in the United States if ByteDance, its China-based parent company, did not sell its stake in TikTok within a set time frame.

Following a series of executive orders in 2025 that suspended enforcement of this law, on January 22, 2026, ByteDance announced the establishment of TikTok USDS Joint Venture LLC in compliance with the law to secure United States user data, apps, and the algorithm through data privacy and cybersecurity measures.

TikTok was one of our largest customers for the year ended December 31, 2025 and remains a customer of ours.

While the full impact of the legislation is unknown, it could eventually lead to a reduction in this customer’s United States traffic levels which could have a negative impact on our business.

We do not know whether or how ByteDance might restructure its business and how that may impact our traffic levels.

We do not know how the restructuring may impact our traffic levels.

It is likely that we will continue to be dependent upon a limited number of customers for a significant portion of our revenues for the foreseeable future and, in some cases, the portion of our revenues attributable to individual customers may increase in the future.

2 unchanged sentences

If we fail to maintain existing customers or develop relationships with new customers and across different industries, our business would be harmed.

Component delays, shortages or price increases could interrupt our ability to complete the construction of our servers to meet the usage needs of our customers.

Our operating results could be materially harmed if we are unable to adequately manage our server needs.

Our business depends on the timely supply of certain parts and components to construct our servers.

Component delays, shortages, or price increases could interrupt our ability to complete the construction of our servers or POPs and to meet the usage needs of our customers.

Our operating results could be materially harmed if we are unable to adequately manage our infrastructure needs.

Our business depends on the timely supply of certain parts and components to construct our servers or POPs.

We rely on a limited number of suppliers for several components of the equipment we use to operate our network and provide products to our customers.

Our reliance on these suppliers exposes us to risks including reduced control over production costs and constraints based on the then current availability, terms, and pricing of these components, including pricing changes as a result of inflationary pressures.

The COVID-19 pandemic caused disruptions and delays for these components and the delivery and installation of such components at our colocation facilities, in addition to pricing increases.

of inflationary pressures.

Moreover, international trade disputes may disrupt or delay our supply chain for these components or lead to pricing increases.

For example, the United States has imposed or indicated an intention to impose tariffs on certain countries which may lead to retaliatory actions such as counter-tariffs and increase production costs and disruptions in our supply chain.

The United States and other jurisdictions have also leveraged various trade and value chain requirements, including on environmental and social criteria, which may make sourcing more costly, require us to change suppliers, or otherwise adversely impact our operations.

Further, it is possible that government policy changes, including policy changes made with little to no advance notice, and related uncertainty about policy changes could increase market volatility.

If our supply of certain components is further disrupted or delayed, there can be no assurance that we will be able to obtain adequate replacements for the existing components or that supplies will be available on terms and prices that are favorable to us, if at all.

7 unchanged sentences

Our history of operating losses makes it difficult to evaluate our current business and prospects and may increase the risks associated with your investment.

We were founded in 2011 and have experienced net losses and negative cash flows from operations since inception.

We have encountered and will continue to encounter risks and difficulties frequently experienced by growth companies in constantly evolving industries, including companies in the technology sector, including the risks described in this report.

We were founded in 2011 and have experienced net losses since inception.

If we do not address these risks successfully, our business may be harmed.

7 unchanged sentences

If we are unable to achieve and sustain profitability, our business may be harmed.

If our information technology systems or data, or those of third parties upon which we rely, are compromised now, or in the future, or the security, confidentiality, integrity or availability of our information technology, software, services, networks, communications or data is compromised, limited or fails, our business could experience materially adverse consequences, including but not limited to regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, loss of revenue or profits, loss of customers or sales, reputational harm, and other adverse consequences.

Our business depends on providing our customers with fast, efficient, and reliable distribution of applications and content over the Internet.

In the ordinary course of our business, we and the third parties upon which we rely, collect, receive,

store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share, proprietary, confidential, and sensitive data, including personal information, intellectual property, trade secrets, and encryption keys, including our data and data of our customers, including their end-users (collectively, “Sensitive Information”).

Maintaining the security and availability of our platform, network, and internal information technology systems and the security of information we hold on behalf of our customers is a critical issue for us and our customers, and we expend significant resources, and may need to fundamentally change our business activities and continue to modify our practices and operations, in an effort to protect against security incidents and to mitigate, detect, and remediate actual and potential vulnerabilities.

Cyber-attacks, malicious Internet-based activity, online and offline fraud, and other similar activities threaten the confidentiality, integrity, and availability of our Sensitive Information and information technology systems, and those of the third parties upon which we rely.

Such threats are prevalent and continue to rise, are difficult to detect, and come from a variety of sources, including threat actors, “hacktivists,” personnel (such as through theft or misuse), sophisticated nation states, and nation-state-supported actors.

Some actors now engage, and are expected to continue to engage in cyber-attacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities.

If our IT Systems or data, or those of third parties upon which we rely, are compromised, limited, or fail, our business could experience materially adverse consequences, including but not limited to regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, loss of revenue or profits, loss of customers or sales, reputational harm, and other adverse consequences.

Our business depends on providing our customers with fast, efficient, and reliable distribution of applications and content over the Internet, and we rely on IT Systems to provide our products and services, including for internal and external operations that are critical to our business.

“IT Systems” includes computer systems, hardware, software, technology infrastructure and websites and networks.

In the ordinary course of business, we and the third parties upon which we rely, collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share Sensitive Information.

"Sensitive Information" includes our, our customers', and our customers' end users' proprietary, confidential, and sensitive data, including personal information, intellectual property, trade secrets, and encryption keys.

Maintaining the security and availability of our platform, IT Systems, and Sensitive Information is a critical issue for us and our customers, and we expend significant resources, and may need to fundamentally change our business activities and modify our practices and operations, in an effort to protect against security incidents and to mitigate, detect, and remediate actual and potential vulnerabilities.

Cyber-attacks, malicious Internet-based activity, online and offline fraud, and other similar activities threaten the confidentiality, integrity, and availability of our Sensitive Information and IT Systems, and those of the third parties upon which we rely.

Such threats are prevalent and continue to become more so.

They are difficult to detect, and come from a variety of sources and threat actors, including “hacktivists,” personnel (such as through theft or misuse), sophisticated nation states, and nation-state-supported actors.

Some threat actors engage in cyber-attacks for geopolitical reasons and in conjunction with military conflicts and defense activities.

We have in the past been subject to cyber-attacks from third parties, including parties who we believe are sponsored by government actors.

1 unchanged sentence

In the past, these attacks have significantly increased the bandwidth used on our platform and have strained our network.

During times of war and other major conflicts, we, the third parties upon which we rely, and our customers may be vulnerable to a heightened risk of these attacks, including retaliatory cyber-attacks, that could materially disrupt our systems and operations, supply chain, and ability to produce, sell, and distribute our services.

We and the third parties upon which we rely are subject to a variety of evolving threats, including but not limited to social-engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), malicious code, malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks (“DDoS”), account takeover attacks, credential harvesting, personnel misconduct or error, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, attacks facilitated or enhanced by artificial intelligence (“AI”), loss of data or other information technology assets, adware, telecommunications failures, natural disasters, and other similar threats.

During times of war and other major conflicts, we, the third parties upon which we rely, and our customers may be vulnerable to a heightened risk of these attacks, including retaliatory cyber-attacks, that could materially disrupt our IT Systems and operations, supply chain, and ability to produce, sell, and distribute our services.

We and the third parties upon which we rely are subject to a variety of evolving threats, including but not limited to social-engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), malicious code, malware (including as a result of advanced persistent threat intrusions), DDoS attacks, account takeover attacks, credential harvesting, personnel misconduct or error, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, attacks facilitated or enhanced by artificial intelligence (“AI”) such as prompt injection or AI model inversion attacks, loss of data or other information technology assets, adware, telecommunications failures, natural disasters, and other similar threats.

For example, we have experienced DDoS attacks of significant size and severity that caused us to invest resources into improving our systems, and we expect to continue to be subject to DDoS and other forms of attacks in the future, particularly as they have become more prevalent in our industry.

Similarly, we have been the target of phishing and social engineering schemes that may be designed to, among other things, improperly gain access to our confidential information or fraudulently obtain payments or funds from us.

Further, we are not immune from the possibility of a malicious insider compromising our information systems and infrastructure or misappropriating our confidential information.

In particular, severe ransomware attacks are becoming increasingly prevalent, and can lead to significant interruptions in our operations, loss of Sensitive Information and revenue, reputational harm, and diversion of funds.

Similarly, we have been the target of phishing and social engineering schemes that may be designed to, among other things, improperly gain access to our Sensitive Information or fraudulently obtain payments or funds from us.

Further, we are not immune from the possibility of a malicious insider compromising our IT Systems or misappropriating our Sensitive Information.

In particular, severe ransomware attacks are becoming increasingly prevalent, and can lead to significant interruptions in our operations, compromise of our or our service providers’ IT Systems, loss of Sensitive Information and revenue, reputational harm, and diversion of funds.

Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to a number of factors, including applicable laws or regulations prohibiting such payments.

2 unchanged sentences

The potential liability and associated consequences we could suffer as a result of such a large-scale event could be catastrophic and result in irreparable harm.

Future or past business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities’ systems and technologies.

Furthermore, we may discover security issues that were not found during due diligence of such acquired or integrated entities, and it may be difficult to integrate companies into our information technology environment and security program.

We rely on third-party service providers and technologies to operate critical business systems to process Sensitive Information in a variety of contexts, including, without limitation, cloud-based infrastructure, data center facilities, encryption and authentication technology, content delivery to customers, and other functions.

Like many other companies, our ability to monitor third parties’ information security practices is limited, and these third parties may not have adequate information

security measures in place.

Future or past business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and vulnerabilities, as our IT Systems could be negatively affected by vulnerabilities present in acquired or integrated entities’ systems and technologies.

We rely on third-party service providers and technologies to operate critical IT Systems and to process Sensitive Information in a variety of contexts, including, without limitation, cloud-based infrastructure, data center facilities, encryption and authentication technology, content delivery to customers, and other functions.

Like many other companies, our ability to monitor third parties’ information security practices is limited, and these third parties may not have adequate information security measures in place.

If our third-party service providers experience a security incident or other interruption, we could experience adverse consequences.

While we may be entitled to damages if our third-party service providers fail to satisfy their privacy and data security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award.

Any of the previously identified or similar threats could cause a security incident or other interruption that could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our Sensitive Information or our information technology systems, or those of the third parties upon whom we rely.

While we may be entitled to damages if our third-party service providers fail to satisfy their

privacy and data security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award.

Any adverse impact to the availability, integrity, or confidentiality of our Sensitive Information or IT Systems, including as a result of the previously identified or similar threats, could cause a security incident or other interruption that could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our Sensitive Information or our IT Systems, or those of the third parties upon whom we rely.

A security incident or other interruption could disrupt our ability (and that of third parties upon whom we rely) to provide our platform, products and services.

3 unchanged sentences

Further, Sensitive Information of the Company or our customers could be leaked, disclosed, or revealed as a result of or in connection with our employees’, personnel’s, or vendors’ use of generative AI technologies.

Certain privacy and data security obligations may require us to implement and maintain specific security measures or industry-standard or reasonable security measures to protect our information technology systems and Sensitive Information.

Moreover, certain privacy and data security obligations may require us to implement and maintain specific or industry-standard or reasonable security measures to protect our IT Systems and Sensitive Information, and a failure to do so could result in material financial penalties and other materially adverse consequences.

While we have implemented security measures designed to protect against security incidents, there can be no assurance that these measures will be effective.

We take steps to detect and remediate vulnerabilities, but we may not be able to detect and remediate all vulnerabilities because the threats and techniques used to exploit the vulnerability change frequently and are often sophisticated in nature.

Additionally, we may not be able to detect and remediate all vulnerabilities because the threats and techniques used to exploit the vulnerability change frequently and are often sophisticated in nature.

Therefore, such vulnerabilities could be exploited but may not be detected until after a security incident has occurred.

4 unchanged sentences

Compliance with such disclosure efforts is costly, and the disclosure or the failure to comply with such requirements could lead to adverse consequences.

If we (or a third party upon whom we rely) experience a security incident or are perceived to have experienced a security incident, we may experience adverse consequences, such as government enforcement actions (for example, investigations, fines penalties, audits, and inspections);

If we (or a third party upon whom we rely) experience any adverse impact to the availability, integrity, or confidentiality of our IT Systems or Sensitive Information, we may experience adverse consequences, such as government enforcement actions (for example, investigations, fines, penalties, audits, and inspections);

additional reporting requirements and/or oversight, restrictions on processing Sensitive Information (including personal data);

8 unchanged sentences

and other similar harms.

Security incidents and attendant consequences may cause customers to stop using our platform, products, and services, cause us to offer pricing and other concessions, deter new customers from using our platform, products, and services, and negatively impact our ability to grow and operate our business.

Security incidents and attendant consequences may also impact customers’ systems and data, and cause customers to stop using our platform, products, and services, cause us to offer pricing and other concessions, deter new customers from using our platform, products, and services, result in litigation, and negatively impact our ability to grow and operate our business.

Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our privacy and data security obligations.

2 unchanged sentences

The market in which we compete is relatively new and subject to rapid technological change, evolving industry standards and regulatory changes, as well as changing customer needs, requirements, and preferences.

The success of our business will depend, in part, on our ability to adapt and respond effectively to these changes on a timely basis.

If we are unable to develop

and sell new products that satisfy and are adopted by our customers and provide enhancements, new features, and capabilities to our platform that keep pace with rapid technological and industry change, our revenue and operating results could be adversely affected.

The success of our business will

depend, in part, on our ability to adapt and respond effectively to these changes on a timely basis.

If we are unable to develop and sell new products that satisfy and are adopted by our customers and provide enhancements, new features, and capabilities to our platform that keep pace with rapid technological and industry change, our revenue and operating results could be adversely affected.

Further, some of our prospective customers may require custom development of features as part of their purchase decision, or our existing customers may require us to develop custom features.

2 unchanged sentences

If new technologies emerge that enable large Internet platform companies to utilize their own data centers and implement delivery approaches that limit or eliminate reliance on third-party providers like us, or that enable our competitors to deliver competitive products and applications at lower prices, more efficiently, more conveniently, or more securely, such technologies could adversely impact our ability to compete.

If our platform does not allow us or our customers to comply with the latest regulatory requirements, our existing customers may decrease their usage on our platform and new customers will be less likely to adopt our platform.

If our platform does not allow us or our customers to comply with the latest regulatory requirements, our existing customers may decrease their usage on our platform or leave our platform and new customers will be less likely to adopt our platform.

Our platform must also integrate with a variety of network, hardware, mobile, and software platforms and technologies, and we need to continuously modify and enhance our products and platform capabilities to adapt to changes and innovation in these technologies.

3 unchanged sentences

If we are unable to respond to these changes in a cost-effective manner, our products may become less marketable and less competitive or obsolete, and our business may be harmed.

In particular, the market for AI solutions is evolving rapidly.

We may not be successful in our AI initiatives or our competitors may incorporate AI into their products or market their AI solutions more successfully than us, which could adversely affect our business (such as by impairing our ability to compete effectively against our competitors), reputation, or financial results.

For example, we may encounter challenges such as a lack of talented personnel, inability to secure necessary infrastructure, or the possibility that the AI tools we utilize may not deliver their intended value.

Each of these challenges would adversely impact our ability to effectively execute our strategy of leveraging AI in our products and to enhance our business operations.

In addition to ongoing investments to use AI to enhance our business operations, we are enabling AI workloads for our customers and leveraging AI in a manner that is designed to enhance our platform's usability and capabilities.

However, our AI-focused products and services may not be successful or may fail to meet customer expectations, which could impair our ability to compete effectively and adversely affect our financial results.

If we are unable to use AI effectively or use AI less successfully than our competitors, it could impair our ability to compete effectively against our competitors, adversely affect our business and result in competitive disadvantages.

Moreover, our platform is highly technical and complex.

For example, our delivery products rely on knowledge of the Varnish Configuration Language (“VCL”) to utilize many features of this platform.

For example, our delivery products may rely on knowledge of Varnish Configuration Language (“VCL”) to utilize certain features.

Potential developers may be unfamiliar or opposed to working with VCL and therefore decide to not adopt our platform, which may harm our business.

14 unchanged sentences

All of these efforts will require us to invest significant financial and other resources and if they fail to attract additional customers, our business will be harmed.

We have also used a strategy of offering free trial versions of our platform in order to strengthen our relationship and reputation within the developer community by providing these developers with the ability to familiarize themselves with our platform without first becoming a paying customer.

However, these developers may not perceive value in the additional benefits and services we offer beyond the free trial versions of our platform and may choose not to pay for those additional benefits.

Moreover, some

existing paying customers may choose not to renew their commitment with us in favor of relying on the free version of our platform.

Most trial accounts do not convert to paid versions of our platform, and to date, only a few users who have converted to paying customers have gone on to generate meaningful revenue.

If our other lead generation methods do not result in broader market acceptance of our platform and the users of trial versions of our platform do not become, or are unable to convince their organizations to become, paying customers, or if paying customers choose to convert to the free versions of our platform, we will not realize the intended benefits of this strategy, and our business will be harmed.

We have also used a strategy of offering free accounts on our platform in order to strengthen our relationship and reputation within the developer community by providing these developers with the ability to familiarize themselves with our platform without first becoming a paying customer.

However, these developers may not perceive value in the additional benefits and services we offer beyond the free accounts and may choose not to pay for those additional benefits.

In addition, we may be subject to potential liabilities, including litigation, as a result of our free account users' use of our network.

Moreover, some existing paying customers may choose not to renew their commitment with us in favor of relying on the free version of our platform.

Most free accounts do not convert to paid versions of our platform, and to date, only a few users who have converted to paying customers have gone on to generate meaningful revenue.

If our other lead generation methods do not result in broader market acceptance of our platform and the users of free versions of our platform do not become, or are unable to convince their organizations to become, paying customers, or if paying customers choose to convert to the free versions of our platform, we will not realize the intended benefits of this strategy, and our business will be harmed.

We believe that there is significant competition for sales personnel, including sales representatives, sales managers, and sales engineers, with the skills and technical knowledge that we require.

7 unchanged sentences

With the introduction of new technologies and market entrants, we expect that the competitive environment in which we compete will remain intense going forward.

Application and API security vendors like Akamai, Cloudflare, F5, and Thales (Imperva) offer products that compete with ours.

We also compete with CDN providers, which now offer serverless edge compute functionality like Akamai (Linode) and Cloudflare, public cloud providers that have added CDN and WAF capabilities like Amazon Web Services (AWS), Google Cloud Platform, and Microsoft (Azure), legacy CDNs, such as Akamai, point CDN players like Bunny CDN, CDNetworks, CDN77, and Qwilt, and traditional on-premise data center appliance vendors for load balancing, WAF, and/or DDoS like F5, Thales (Imperva), and Radware.

Legacy CDN platform solutions like Akamai, application and API security vendors like Akamai, Cloudflare, F5, and Thales (Imperva), and Point CDN players like Bunny CDN, CDNetworks, CDN77, and Qwilt offer products that compete with ours.

We also compete with CDN providers that also offer serverless edge compute functionality like Akamai and Cloudflare, public cloud providers that have added CDN and WAF capabilities like Amazon Web Services (AWS), Google Cloud Platform (GCP), and Microsoft (Azure), and traditional on-premise data center appliance vendors for load balancing, WAF, and/or DDoS like F5, Thales (Imperva), and Radware.

Some of our competitors have made or may make acquisitions or may enter into partnerships or other strategic relationships that may provide more comprehensive offerings than they individually had offered.

13 unchanged sentences

• our ability to identify opportunities for acquisitions and strategic relationships and successfully execute on them.

We face substantial competition from legacy CDNs, small business-focused CDNs, cloud providers, traditional data center, and appliance vendors.

We face substantial competition from legacy CDNs, small business-focused CDNs, cloud providers, and traditional data center and appliance vendors.

In addition, existing customers have transitioned or notified us of their intent to transition, and existing and potential customers may in the future transition, off of our platform, or may limit their use, because they pursue a “do-it-yourself” approach to develop their own CDN by putting in place equipment, software, and other technology products for content and application delivery within their internal systems;

20 unchanged sentences

We have in the past acquired, and we may in the future seek to acquire or invest in, businesses, products, or technologies that we believe could complement or expand our platform, enhance our technical capabilities, or otherwise offer growth opportunities.

Our acquisitions of Glitch and Signal Sciences reflect this strategy.

The pursuit of potential acquisitions may divert the attention of management and cause us to incur various expenses in identifying, investigating, and pursuing acquisitions, whether or not such acquisitions are completed.

20 unchanged sentences

On June 12, 2024 and July 1, 2024, stockholder derivative complaints were filed in the United States District Court for the Northern District of California against certain of our officers and directors based on substantially similar allegations as those in the putative securities class action.

These two shareholder derivative actions have been consolidated and stayed pending resolution of our motion to dismiss in the securities class action.

On August 23, 2024 and December 20, 2024, substantially similar stockholder derivative complaints were filed against certain of our officers and directors in the United States District Court for the District of Delaware and the Court of Chancery for the State of Delaware.

These two shareholder derivative actions have also been stayed pending resolution of our motion to dismiss in the above-referenced putative securities class action.

These two shareholder derivative actions have been consolidated and stayed pending resolution of our motion(s) to dismiss in the securities class action.

On August 23, 2024 and December 20, 2024, substantially similar stockholder derivative complaints were filed against certain of our officers and directors in the United States District Court for

the District of Delaware and the Court of Chancery for the State of Delaware.

These two shareholder derivative actions have also been stayed pending resolution of our motion(s) to dismiss in the above-referenced putative securities class action.

Defendants filed a motion to dismiss the putative securities class action on January 15, 2025.

The lead plaintiff filed an opposition to defendants’ motion to dismiss on March 17, 2025.

Defendants filed a reply in support of the motion to dismiss on April 30, 2025.

On September 24, 2025, the court issued an order granting in part and denying in part the motion to dismiss.

On October 24, 2025, the lead plaintiff filed a second amended complaint.

On December 9, 2025, Defendants filed a motion to dismiss the second amended complaint.

On January 26, 2026, Lead Plaintiff filed an opposition.

Defendants filed a reply in support of the motion to dismiss the second amended complaint on February 19, 2026.

A hearing is scheduled for April 30, 2026 on Defendants’ motion to dismiss the second amended complaint.

We anticipate that we may be a target for lawsuits in the future, as we have been in the past.

6 unchanged sentences

As usage of our edge cloud computing platform grows and as the breadth of use cases for our platform expands, we will need to devote additional resources to improving our platform architecture, integrating with third-party applications and maintaining infrastructure performance.

In addition, we will need to appropriately scale our processes and procedures that

support our growing customer base, including increasing our number of POPs around the world and investments in systems, training, and customer support.

In addition, we will need to appropriately scale our processes and procedures that support our growing customer base, including increasing our number of POPs around the world and investments in systems, training, and customer support.

Any failure of or delay in these efforts could cause impaired system performance and reduced customer satisfaction.

15 unchanged sentences

Our platform and related applications, including our security solutions, are designed to provide rapid protection against web application vulnerabilities and cyber-attacks.

However, no security product can provide absolute protection against all vulnerabilities and cyber-attacks.

However, no security product can provide absolute protection against all

vulnerabilities and cyber-attacks.

Our platform is subject to cyber-attacks, and the failure of our platform and related applications to adequately protect against these cyber-attacks may allow our customers to be attacked.

4 unchanged sentences

We have taken, and may continue to take, actions that we believe are in the best interests of our customers, our employees, and our business, even if those actions do not maximize financial results in the short term.

For instance, we do not knowingly allow our platform to be used to deliver content from groups that promote violence or hate, and that conflict with our values like strong ethical principles of integrity and trustworthiness, among others.

For instance, we do not knowingly allow our platform to be used by organizations with a primary objective to promote violence or hate speech, and that conflict with our values, including principles of integrity and trustworthiness, among others.

In the past, we have removed customers from our platform who we believed took positions conflicting with these values, and we may continue to do so in the future.

3 unchanged sentences

We are dependent on these partner relationships to amplify our reach and provide our customers with enhanced value from our platform.

Our future growth will be increasingly dependent on the success of our partner relationships, including their development of useful applications for our platform.

Our future growth may be dependent on the success of our partner relationships, including their development of useful applications for our platform.

If those partnerships do not provide these benefits or if our partners are unable to serve our customers effectively, we may need to allocate resources internally to provide these services or our customers may not realize the full value of our platform, which could harm our business.

16 unchanged sentences

and the success of our competitors.

If we are unsuccessful in developing and marketing our product into new and existing markets, or if organizations do not perceive or value the benefits of our platform, the market for our product might not continue to develop or might develop more slowly than we expect, either of which may harm our business.

If we are unsuccessful in developing and marketing our products in new and existing markets, or if organizations do not perceive or value the benefits of our platform, the market for our products might not continue to develop or might develop more slowly than we expect, either of which may harm our business.

The estimates of market opportunity and forecasts of market growth may prove to be inaccurate, and any real or perceived inaccuracies may harm our reputation and negatively affect our business.

14 unchanged sentences

• our inability to release enhanced versions of our edge cloud platform on a timely basis.

In addition, because substantially all of our revenue from usage is recognized during the term of the relevant contract upon usage, downturns or upturns in sales contracts are not immediately reflected in full in our operating results.

In addition, because substantially all of our usage-based revenue is recognized at the time of use during the term of the relevant contract, downturns or upturns in sales contracts are not immediately reflected in full in our operating results.

If the market for our edge cloud platform grows more slowly than anticipated or if demand for our edge cloud platform does not grow as quickly as anticipated, whether as a result of competition, pricing sensitivities, product obsolescence, technological change, unfavorable economic conditions, uncertain geopolitical environment, budgetary constraints of our customers, or other factors, our business would be harmed.

18 unchanged sentences

• general economic conditions, both domestically and internationally, as well as economic conditions specifically affecting industries in which our customers participate;

• the ability to maintain our partnerships;

• the ability to maintain our key partnerships;

• the impact of new accounting pronouncements;

6 unchanged sentences

Any of the foregoing and other factors may cause our results of operations to vary significantly.

Furthermore, if our quarterly results of operations or our guidance fall below the expectations of investors and securities analysts who follow our stock, the price of our common stock could decline substantially, and our business could be harmed.

Furthermore, if our quarterly results of operations or our guidance fall below the expectations of investors and securities analysts who follow our

stock, the price of our common stock could decline substantially, and our business could be harmed.

We cannot assure you that our operating results or projected operating results will meet the expectations of market analysts or our investors.

7 unchanged sentences

In addition, during 2023 we introduced the option for customers to purchase product packages with single price points and set limits on usage.

We do not charge for overages on these single price point product packages.

We generally do not charge for overages on these single price point product packages.

This pricing model has been in place for a limited amount of time, and we do not know the impact it will have on our usage-based pricing model over time.

2 unchanged sentences

Moreover, larger organizations may demand substantial price concessions.

As a result, in the future we may be

required to reduce our prices or develop new pricing models, which could adversely affect our revenue, gross margin, profitability, financial position, and cash flow.

As a result, in the future we may be required to reduce our prices or develop new pricing models, which could adversely affect our revenue, gross margin, profitability, financial position, and cash flow.

Our sales and onboarding cycles with customers can be long and unpredictable, and our sales and onboarding efforts require considerable time and expense.

4 unchanged sentences

As the purchase of our products can be dependent upon customer initiatives, our sales cycle can extend to even longer periods of time.

Customers often view a switch to our platform as a strategic decision requiring significant investment and, as a result, frequently require considerable time to evaluate, test, and qualify our product offering prior to entering into or expanding a contract commitment.

Customers often view a switch to our platform as a strategic decision requiring significant investment and, as a result, frequently require considerable time to evaluate, test, and qualify our products prior to entering into or expanding a contract commitment.

During the sales cycle, we expend significant time and money on sales and marketing and contract negotiation activities, which may not result in a completed sale.

17 unchanged sentences

Maintaining adequate research and development resources, such as the appropriate personnel and development technology, to meet the demands of the market is essential.

If we are unable to develop products internally due to inadequate or ineffective research and

development resources, we may not be able to address our customers’ needs on a timely basis or at all.

If we are unable to develop products internally due to inadequate or ineffective research and development resources, we may not be able to address our customers’ needs on a timely basis or at all.

In addition, if we seek to supplement our research and development capabilities or the breadth of our products through acquisitions, such acquisitions could be expensive and we may not successfully integrate acquired technologies or businesses into our business.

2 unchanged sentences

Our new products or enhancements and changes to our existing products could fail to attain sufficient market acceptance for many reasons, including:

• failure to predict market demand accurately in terms of functionality and a failure to supply products that meet this demand in a timely fashion;

• failure to predict market demand for functionality accurately and a failure to supply products that meet this demand in a timely fashion;

• defects, errors, or failures;

7 unchanged sentences

We rely on developers to choose our platform over other options they may have, and to continue to use and promote our platform as they move between companies.

These developers often make design decisions and influence the product and vendor processes within our customers.

These developers often

make design decisions and influence the product and vendor processes within our customers.

If we fail to gain or maintain their acceptance of our platform, our business would be harmed.

We rely on third-party hosting providers that may be difficult to replace.

We rely on third-party hosting services such as AWS, Google Cloud Platform, Microsoft (Azure), and other cloud providers that facilitate the offering of our platform.

Some of these third-party hosting services offer competing products to ours and therefore may not continue to be available on commercially reasonable terms, or at all.

We rely on third-party providers that may be difficult to replace.

We rely on third-party services such as Amazon Web Services (AWS), Google Cloud Platform (GCP), Microsoft (Azure), and other cloud providers such as object storage providers, that facilitate our platform.

Some of these third-party services offer competing products to ours and therefore may not continue to be available on commercially reasonable terms, or at all.

These providers may be unwilling to do business with us if they view our platform as a threat.

Any loss of the right to use any of the hosting providers could impair our ability to offer our platform and harm our business until we are able to obtain alternative hosting providers.

Any loss of the right to use any of these third-party providers could impair our ability to offer our platform and harm our business until we are able to obtain alternative providers.

Our business is exposed to risks associated with credit card and other online payment processing methods.

5 unchanged sentences

If we are unable to maintain our chargeback rate at acceptable levels, card networks may impose fines and our card approval rate may be impacted.

If we fail to adequately control fraudulent credit card transactions, we may face civil liability, reputational harm, and

significantly higher credit card-related costs, each of which could harm our business, results of operations and financial condition.

If we fail to adequately control fraudulent credit card transactions, we may face civil liability, reputational harm, and significantly higher credit card-related costs, each of which could harm our business, results of operations and financial condition.

If we do not or cannot maintain the compatibility of our platform with third-party applications that our customers use in their businesses, our business will be harmed.

Because our customers choose to integrate our products with certain capabilities provided by third-party providers, the functionality and popularity of our platform depends, in part, on our ability to integrate our platform and applications with third-party applications.

The functionality and popularity of our platform depends, in part, on our ability to integrate our platform and applications with third-party applications our customers choose to use with our platform.

These third parties may change the features of their technologies, restrict our access to their applications, or alter the terms governing use of their applications in a manner that is adverse to our business.

12 unchanged sentences

The importance of maintaining high quality support will increase as we expand our business and pursue new customers.

If we do not help our customers quickly resolve issues and provide effective ongoing support, our ability to maintain and expand our relationships with existing and new customers could suffer and our business could be harmed.

If we do not help our customers quickly resolve issues and provide effective ongoing support, our ability to maintain and expand our

relationships with existing and new customers could suffer and our business could be harmed.

Further, increased demand for customer support, without corresponding revenue, could increase costs and adversely affect our business.

2 unchanged sentences

Scrutiny relating to environmental, social and governance factors may impose additional costs and expose us to new risks.

There is an increasing focus from investors, employees, customers, policymakers, and other stakeholders concerning companies' management of various environmental, social, and governance matters (“ESG”), such as climate change and human capital.

There is an ongoing focus from certain investors, employees, customers, policymakers, and other stakeholders concerning companies' management of various environmental, social, and governance matters (“ESG”), such as climate change and human capital.

Any initiatives, including disclosures, that we engage in to improve our ESG profile and respond to stakeholder expectations may be costly and may not have the desired effect.

For example, many ESG initiatives leverage methodologies and data that continue to evolve.

For example, while we have established a sustainability program focused on emissions quantification, disclosure and reduction initiatives, as climate-related regulatory regimes and stakeholder expectations continue to evolve, we may need to undertake additional measures to comply with new regulations and expectations, which could adversely affect our operating results in future periods.

In addition, many ESG initiatives leverage methodologies and data that continue to evolve.

As with other companies, our approach to such matters also evolves, and we cannot guarantee that our approach will align with any particular stakeholder’s expectations or preferences.

4 unchanged sentences

Addressing stakeholder expectations or requirements entails costs and any failure to successfully navigate such expectations, as well as evolving interpretations of any existing governmental laws or requirements, may result in reputational harm, loss of customers or contracts, regulatory or investor engagement, or other adverse impacts to our business.

Such risks may also be augmented based on relative performance, both against any initiatives or goals we communicate as well as in

comparison to our competitors.

Such risks may also be augmented based on relative performance, both against any initiatives or goals we communicate as well as in comparison to our competitors.

Various of our stakeholders are also subject to similar pressures, which may result in additional or novel risks.

3 unchanged sentences

Competition for executive officers, software developers, sales personnel, product managers, and other key employees in our industry is intense.

In particular, we compete with many other companies for software developers with high levels of experience in designing, developing, and managing cloud-based software, as well as for skilled sales, operations, and security professionals.

In addition, we believe that the success of our business and corporate culture depends on employing people with a variety of backgrounds and experiences, and the competition for such diverse personnel is significant.

In particular, we compete with many other companies for software developers with high levels of experience in designing, developing, and managing cloud-based software, including products with AI capabilities, as well as for skilled sales, operations, and security professionals.

The market for such talented personnel is competitive.

7 unchanged sentences

We rely on the performance of highly skilled personnel, including our senior management and other key employees, and the loss or transition of one or more of such personnel, or of a significant number of our team members, could harm our business.

We believe that our success has depended, and continues to depend, on the efforts and talents of senior management and key employees, including Artur Bergman, our Chief Technology Officer and Todd Nightingale, our Chief Executive Officer.

We believe that our success has depended, and continues to depend, on the efforts and talents of senior management and key employees, including Artur Bergman, our Chief Technology Officer.

There have been, and from time to time, there may continue to be, changes in our management team resulting from the hiring or departure of executives and key employees, or the transition of executives within our business, which could disrupt our business.

For example, Charles Compton began serving as our new Chief Executive Officer, replacing Todd Nightingale, effective June 16, 2025.

Such changes in our executive management team may be disruptive to our business.

2 unchanged sentences

Our senior management, including Mr.

Nightingale and Mr.

Compton and Mr.

Bergman, and key employees are employed on an at-will basis.

50 unchanged sentences

We may need to engage in equity or debt financings to secure additional funds, in particular if we are required to repay our outstanding convertible notes in cash.

Additional financing may not be available on favorable terms, if at all, and the terms of our existing Senior Secured Credit Facilities Credit Agreement, dated as of February 16, 2021, with the lenders from time to time party thereto and Silicon Valley Bank, a division of First-Citizens Bank & Trust Company (as amended, restated, amended and restated, supplemented, restructured, or otherwise modified from time to time, the “Credit Agreement”) may limit our ability to pursue additional financings.

amended and restated, supplemented, restructured, or otherwise modified from time to time, the “Credit Agreement”) limits our ability to incur additional debt.

If adequate funds are not available on acceptable terms, we may be forced to reduce or delay our business activities and capital expenditures, unable to invest in future growth opportunities, sell assets, or restructure or refinance all or a portion of our debt on or before maturity, all of which could harm our business, operating results, and financial condition.

9 unchanged sentences

Some of our customers host certain large-scale events, such as sporting events or coverage of major elections, increasing their usage on a seasonal or one-time basis which can cause revenue to fluctuate between the periods in which these events occur and subsequent periods.

Since we have built our network to handle seasonal capacity fluctuations, we may not be able to reduce our capacity in a timely manner, and as such sustain more costs.

Since we built our network to handle seasonal capacity fluctuations, we may not be able to reduce our capacity in a timely manner, and as such sustain more costs that may not be tied to traffic demand.

We believe that the seasonal trends that we have experienced in the past may continue for the foreseeable future, particularly as we expand our sales to larger enterprises.

To the extent we

experience this seasonality, it may cause fluctuations in our operating results and financial metrics, and make forecasting our future operating results and financial metrics difficult.

To the extent we experience this seasonality, it may cause fluctuations in our operating results and financial metrics, and make forecasting our future operating results and financial metrics difficult.

Additionally, we do not have sufficient experience in selling certain of our products to determine if demand for these products is, or will be, subject to material seasonality.

18 unchanged sentences

• difficulties in managing a business in new markets with diverse cultures, languages, customs, legal systems, alternative dispute systems, and regulatory systems;

• increased travel, real estate, infrastructure, and legal compliance costs associated with international operations;

• increased travel, real estate, infrastructure, and legal costs associated with international operations;

• currency exchange rate fluctuations and the resulting effect on our revenue and expenses, and the cost and risk of entering into hedging transactions if we choose to do so in the future;

4 unchanged sentences

• limited or insufficient scope, strength, and enforcement of intellectual property rights;

• political instability, economic sanctions, terrorist activities, or international conflicts, including ongoing conflicts between Russia and Ukraine and Hamas and Israel, which may impact the operations of our business or the businesses of our customers;

• political instability, economic sanctions, terrorist activities, or global conflicts and developments, including, but not limited to, ongoing conflicts between Russia and Ukraine and in the Middle East, which may impact the operations of our business or the businesses of our customers;

• inflationary pressures, such as those the global market is currently experiencing, labor shortages, and supply chain disruptions, which may increase costs for certain services;

5 unchanged sentences

If our estimates or judgments relating to our critical accounting estimates prove to be incorrect, our results of operations could be adversely affected.

The preparation of financial statements in conformity with generally accepted accounting principles in the United States (“U.S.

GAAP”) requires management to make estimates and assumptions that affect the amounts reported in the consolidated financial statements and accompanying notes.

The preparation of financial statements in conformity with generally accepted accounting principles in the United States (“GAAP”) requires management to make estimates and assumptions that affect the amounts reported in the consolidated financial statements and accompanying notes.

We base our estimates on historical experience and on various other assumptions that we believe to be reasonable under the circumstances, as provided in the section titled “Management’s Discussion and Analysis of Financial Condition and Results of Operations—Critical Accounting Estimates.” The results of these estimates form the basis for making judgments about the carrying values of assets, liabilities, and equity and the amount of revenue and expenses that are not readily apparent from other sources.

1 unchanged sentence

Our results of operations may be adversely affected if our assumptions change or if actual circumstances differ from those in our assumptions, which could cause our results of operations to fall below the expectations of securities analysts and investors, resulting in a decline in the trading price of our common stock.

For example, as a result of a sustained decrease in our stock price and market capitalization, we performed an interim qualitative impairment assessment of our goodwill as of September 30, 2024 and concluded it is not more likely than not that the fair value of our one single reporting unit is less than its carrying amount.

Therefore, we determined that goodwill was not impaired and no impairment charge was recorded.

In addition, we performed our annual goodwill assessment as of October 31, 2024, and concluded it is not more likely than not that the fair value of our one single reporting unit is less than its carrying amount.

In addition to certain interim goodwill assessments performed during 2025, we performed our annual goodwill assessment as of October 1, 2025, and in each such case concluded it is not more likely than not that the fair value of our one single reporting unit is less than its carrying amount.

Therefore, we determined that goodwill was not impaired and no impairment charge was recorded.

3 unchanged sentences

Our Credit Agreement contains, and any future indebtedness would likely contain, a number of restrictive covenants that impose significant operating and financial restrictions on us, including restrictions on our ability to incur additional indebtedness, grant liens, pay dividends and make distributions, transfer property, make investments, and take other actions that may otherwise be in our best interests.

In addition, our Credit Agreement contains a financial covenant that requires us to maintain a consolidated adjusted quick ratio of at least 1:25 to 1:00 tested on a quarterly basis as well as a springing revenue growth covenant for certain periods if our consolidated adjusted quick ratio falls below 1:75 to 1:00 on the last day of any fiscal quarter.

In addition, our Credit Agreement contains a financial covenant that requires us to maintain a consolidated adjusted quick ratio of at least 1.25 to 1:00 tested on a quarterly basis as well as a springing revenue growth covenant not to be less than 5% on a quarterly basis for certain periods if our consolidated adjusted quick ratio falls below 1:75 to 1:00 on the last day of any fiscal quarter.

Our ability to meet these financial covenants can be affected by events beyond our control, and we may not be able to continue to meet those covenants.

In addition, a breach of a covenant under our Credit Agreement or any other current or future indebtedness may result in a cross-default under any such indebtedness.

In addition, a breach of a covenant under our Credit Agreement or any other current or future indebtedness above certain thresholds may result in a cross-default under any such indebtedness.

If we seek to incur additional indebtedness in the future, we may not be able to obtain debt or equity financing on terms that are favorable to us, if at all.

2 unchanged sentences

If we are unable to obtain adequate financing or financing on terms that are satisfactory to us when we require it, our ability to continue to support our business growth and to respond to business challenges could be significantly impaired, and our business may be harmed.

We have identified a material weakness in our internal control over financial reporting, and if we are unable to remediate and maintain effective internal control over financial reporting in the future, investors may lose confidence in the accuracy and completeness of our financial reports, and the market price of our common stock may be seriously harmed.

If we are unable to maintain effective internal control over financial reporting in the future, investors may lose confidence in the accuracy and completeness of our financial reports, and the market price of our common stock may be seriously harmed.

As a public company, we are required to maintain internal control over financial reporting and to report any material weaknesses in those internal controls.

3 unchanged sentences

That process is time-consuming, costly, and complicated.

As detailed in Item 9A in this report, we and our independent registered public accounting firm identified a material weakness in our internal control over financial reporting for the year ended December 31, 2024.

This material weakness relates to deficiencies in our design and operating effectiveness controls within our revenue process, primarily caused by a lack of sufficiently qualified personnel due to turnover.

These deficiencies are related to certain business process controls, information technology general controls, including the absence of a service auditor's report for our billing system hosted by a third-party, and insufficient monitoring controls over third-party service providers.

In the aggregate, these deficiencies created a reasonable possibility that a material misstatement to our consolidated financial statements might not be prevented or detected on a timely basis, and represent a material weakness.

This material weakness did not result in a misstatement, but could result in misstatements to our financial statements in the future, if not remediated.

While management has developed a remediation plan, we will not be able to conclude whether the steps management is taking will remediate the material weakness until a sustained period of time has passed to allow management to test the design and operational effectiveness of the new controls.

As detailed in Item 9A in our Annual Report on Form 10-K filed February 26, 2025, we and our independent registered public accounting firm identified a material weakness in our internal control related over financial reporting for the year ended December 31, 2024.

This material weakness related to deficiencies in the design and operating effectiveness of controls within the revenue process.

During the year ended December 31, 2025, we implemented remediation actions to address the material weakness in our internal controls, and as of December 31, 2025, this material weakness has been deemed remediated.

The process of implementing an effective financial reporting system is a continuous effort that requires us to anticipate and react to changes in our business and the economic and regulatory environments and to expend significant resources to maintain a financial reporting system that is adequate to satisfy our reporting obligations.

We continue to evaluate and take actions to improve our internal control over financial reporting, which includes but is not limited to hiring additional resources, to address control deficiencies.

If we fail to remediate our existing material weakness or identify future material weaknesses in our internal control over financial reporting, if we are unable to comply with the requirements of Section 404 or assert that our internal control over financial reporting is effective, or if our independent registered public accounting firm is unable to express an unqualified opinion or expresses a qualified or adverse opinion about the effectiveness of our internal control over financial reporting, investors may lose confidence in the accuracy and completeness of our financial reports and the market price of our common stock could be negatively affected.

to fail to meet our reporting and financial obligations or incur significant additional costs to remediate new material weaknesses, each of which could harm our ability to raise capital on favorable terms in the future or otherwise have a negative impact on our financial condition.

In addition, we could become subject to investigations by the New York Stock Exchange (the “NYSE”), the SEC, and other regulatory authorities, which could require additional financial and management resources.

While our previous material weakness has been remediated, if we fail to identify future material weaknesses in our internal control over financial reporting, if we are unable to comply with the requirements of Section 404 or assert that our internal control over financial reporting is effective, or if our independent registered public accounting firm is unable to express an unqualified opinion or expresses a qualified or adverse opinion about the effectiveness of our internal control over financial reporting, investors may lose confidence in the accuracy and completeness of our financial reports and the market price of our common stock could be negatively affected.

Moreover, any failure to identify new material weaknesses in our internal control over financial reporting, could result in material misstatements in our financial statements that may continue undetected and cause us to fail to meet our reporting and financial obligations or incur significant additional costs to remediate new material weaknesses, each of which could harm our ability to raise capital on favorable terms in the future or otherwise have a negative impact on our financial condition.

In addition, we could become subject to investigations by The Nasdaq Stock Market LLC ("Nasdaq"), the SEC, and other regulatory authorities, which could require additional financial and management resources.

We may not be able to successfully manage the growth of our business if we are unable to improve our internal systems, processes and controls.

2 unchanged sentences

For example, we may not be able to effectively monitor certain extraordinary contract requirements or provisions that are individually negotiated by our sales force as the number of transactions continues to grow.

Moreover, as we continue to improve our pricing structure, we will need to implement and maintain corresponding improvements to our systems around payment of sales commissions.

In addition, our systems and processes may not prevent or detect all errors, omissions, or fraud.

Moreover, as we continue to improve our pricing structure, we will need to implement and maintain corresponding updates to our systems around payment of sales commissions to account for these new or revised structures.

We may experience difficulties in managing improvements to our systems, processes, and controls or in connection with third-party software, which could impair our ability to manage our business, pay sales commissions, or offer our platform to our customers in a timely manner, causing us to lose customers or employees, limit our growth, limit us to smaller deployments of our products, or increase our technical support costs.

In addition, our systems and processes may not prevent or detect all errors, omissions, or fraud.

Our financial results may be adversely affected by changes in accounting principles applicable to us.

7 unchanged sentences

Our business is subject to regulation by various federal, state, local, and foreign governments.

If we do not comply with these laws or regulations or if we become liable under these laws or regulations due to the failure of our customers to comply with these laws, we could face direct liability or delivery of content by our platform may be blocked by certain governments.

If we do not comply with these laws or regulations or if we become liable under these laws or regulations due to the failure of our customers to comply

with these laws, we could face direct liability or delivery of content by our platform may be blocked by certain governments.

In certain jurisdictions, these regulatory requirements may be more stringent than those in the United States.

For example, in June 2020, China passed a national security law for Hong Kong that imposes criminal liability for the violation of content regulations, it is currently not clear how broadly such legislation will be interpreted or applied in relation to our customers or our business, and additional developments in our understanding of the application of this law could cause us to remove our POP from Hong Kong.

Noncompliance with applicable regulations or requirements could subject us to investigations, sanctions, enforcement actions, disgorgement of profits, fines, damages, civil and criminal penalties, injunctions, or other collateral consequences.

For example, in June 2020, China passed a national security law for Hong Kong that imposes criminal liability for the violation of content regulations, and in March 2024, Hong Kong enacted the Safeguarding National Security Ordinance which further expanded the scope of criminal liability for acts such as the unlawful disclosure of state secrets and foreign interference.

It is not clear how broadly such legislation will be interpreted or applied in relation to our customers or our business, and additional developments in the application of these laws could cause us to remove our POP from Hong Kong.

If any governmental sanctions are imposed, or if we do not prevail in any possible civil or criminal litigation, our business could be harmed.

In addition, responding to any action will likely result in a significant diversion of management’s attention and resources and an increase in professional fees.

Enforcement actions and sanctions could harm our business.

In addition, responding to any action will likely result in a significant diversion of management’s attention and resources and an increase in professional services fees.

Further, enforcement actions and sanctions could harm our business.

If the United States government prohibits our current or potential customers from doing business with us, whether through policy, regulations or laws, we could face direct liability or our delivery of content by our platform may be blocked.

1 unchanged sentence

As a result, we could lose the ability to contract with current or potential customers and usage of our platform may decrease by affected customers, which could harm our business and reputation.

Even in the absence of new restrictions or trade actions imposed by the United States or other governments,

including potential new regulations resulting from the recent presidential and congressional elections in the United States, our customers that operate in China, target China as a market, or that have strong business ties to China, may take actions to reduce dependence on our platform, which could harm our business.

In April 2024, under the prior administration, a bill was signed into law that would effectively ban TikTok in the United States if ByteDance, its China-based parent company, does not sell its stake in TikTok within a set time frame.

The current administration issued an executive order on January 20, 2025 instructing the Attorney General not to enforce the law or impose any penalties against any entity for noncompliance for a period of 75 days and to provide written guidance as to how the law will be implemented.

Even in the absence of new restrictions or trade actions imposed by the United States or other governments, our customers that operate in China, target China as a market, or that have strong business ties to China, may take actions to reduce dependence on our platform, which could harm our business.

In April 2024, under the prior administration, a bill was signed into law that would effectively ban TikTok in the United States if ByteDance, its China-based parent company, did not sell its stake in TikTok within a set time frame.

TikTok was one of our largest customers for the year ended December 31, 2025 and remains a customer of ours.

While the full impact of the legislation is unknown, it could eventually lead to a reduction in this customer’s United States traffic levels which could have a negative impact on our business.

We do not know whether or how ByteDance might restructure its business and how that may impact our traffic levels.

We do not know how the restructuring may impact our traffic levels or our ongoing relationship with TikTok.

We are subject, or may become subject, to stringent and evolving U.S.

and foreign laws, governmental regulations and rules, and contractual obligations, industry standards, policies and other obligations related to privacy, infrastructure, and data security.

Our actual or perceived failure to comply with such obligations could harm our business, by resulting in regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, adverse publicity and reputational damage, loss of revenue or profits, loss of customers or sales and other adverse consequences that may negatively affect the value of our business and decrease the price of our common stock.

and foreign laws, governmental regulations and rules, contractual obligations, industry standards, policies and other obligations related to privacy, infrastructure, artificial intelligence, and data security.

Our actual or perceived failure to comply with such obligations could harm our business, by resulting in regulatory investigations or actions, disputes or litigation, fines and penalties, disruptions of our business operations, adverse publicity and reputational damage, loss of revenue or profits, loss of customers or sales, and other adverse consequences that may negatively affect the value of our business and decrease the price of our common stock.

Compliance with such obligations could also result in costs and liabilities to us or inhibit sales of our products.

We receive, store, process, collect, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share personal information and other proprietary, confidential, and sensitive data, including intellectual property, trade secrets, encryption keys, and including our data and data of our customers (including their end-users).

Our handling of data is subject to a variety of obligations related to privacy and data security, contractual obligations, internal and external privacy policies, guidance, industry standards, and other obligations that govern the processing of personal information.

Additionally, we are or may become subject to other laws and regulations around the world with respect to the Internet related to, among other things, content liability, security requirements, critical infrastructure designations, Internet resiliency, law enforcement access to information, net neutrality, data localization requirements, and restrictions on social media or other content.

In the United States, federal, state, and local governments have enacted numerous privacy and data security laws, including data breach notification laws, personal data privacy laws, consumer protection laws (e.g., Section 5 of the FTC Act), and other similar laws (e.g., wiretapping laws).

Domestically, states have also begun to introduce more comprehensive privacy and data security legislation, including data breach notification laws, personal information privacy laws, and consumer protection laws.

We receive, store, process, collect, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share information that relates to individuals and/or constitutes “personal data,” “personal information,” “personally identifiable information,” or similar terms under applicable data privacy laws (collectively, “Personal Information”).

Our handling of Personal Information is subject to a variety of obligations related to privacy and data security, including laws and regulations, contractual obligations, internal and external privacy policies, guidance, industry standards, and other obligations that govern the processing of Personal Information.

Additionally, we are or may become subject to other laws and regulations around the world with respect to the Internet related to, among other things, content moderation, security requirements, critical infrastructure designations, Internet resiliency, law enforcement access to information, net neutrality, data localization requirements, and restrictions on social media or other content.

For example, in the United States, federal, state, and local governments have enacted numerous privacy and data security laws, including data breach notification laws, Personal Information privacy laws, consumer protection laws (e.g., Section 5 of the FTC Act), and other similar laws (e.g., wiretapping laws).

In the past few years, numerous U.S.

states—including California, Virginia, Colorado, Connecticut, and Utah—have enacted comprehensive privacy and data security laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal information.

states have enacted comprehensive privacy and data security laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their Personal Information.

As applicable, such rights may include the right to access, correct, or delete certain Personal Information, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making.

The exercise of these rights may impact our business and ability to provide our products and services.

Certain states also impose stricter requirements for processing certain personal information, including Sensitive Information, such as conducting data privacy impact assessments.

Certain states also impose stricter requirements for processing certain Personal Information, including sensitive

Personal Information, such as conducting data privacy impact assessments or requiring prior consent.

These state laws allow for statutory fines for noncompliance.

1 unchanged sentence

The CCPA allows for statutory fines for noncompliance (up to $7,988 per violation), as well as a private right of action for individuals affected by certain data breaches to recover significant statutory damages.

Similar laws have been proposed in several other states and at the federal and local levels, and we expect more states to pass similar laws in the future, which could increase our compliance costs and adversely affect our business.

Our customers may deploy AI models or technologies using our platform, and our employees and personnel may use AI to perform their work.

The regulatory framework for AI is rapidly evolving as many governments have passed and are likely to pass additional laws regulating AI.

For example, in the United States, the current administration has rescinded an executive order relating to the safe and secure development of AI that was previously implemented by the former administration.

Thus, the current administration may continue to rescind other existing federal orders or administrative policies relating to AI, or may implement new executive orders or other rule making relating to AI in the future.

Therefore, our use of AI could result in

additional compliance costs, regulatory investigations and actions, and lawsuits.

If we are unable to use AI or use AI less successfully than our competitors, it could impair our ability to compete effectively against our competitors, adversely affect our business and result in competitive disadvantages.

Due to inaccuracies or flaws in the inputs, outputs, or logic of AI, the AI model could be biased and could lead us to make decisions that could bias certain individuals (or classes of individuals), and adversely impact their rights, employment, and ability to obtain certain pricing, products, services, or benefits.

Several jurisdictions around the globe, including Europe and certain U.S.

states, have proposed, enacted, or are considering laws governing the development, deployment and use of AI, such as the European Union’s (the “EU”) AI Act.

We expect other jurisdictions will adopt similar laws.

Additionally, existing laws and regulations may be interpreted in ways that could affect our use of AI, or could be rescinded or amended as new administrations take differing approaches to evolving AI.

As a result, implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future, and we cannot yet completely determine the impact future laws, regulations, standards, or market perception of their requirements may have on our business and may not always be able to anticipate how to respond to these laws or regulations.

Therefore, this uncertainty may make it harder for us to conduct our business using AI, lead to regulatory fines or penalties, require us to change our business practices, retrain our AI, or prevent or limit our use of AI.

If we cannot use or are restricted in using AI technologies, or deployment of AI by our customers using our platform is affected, our business and results of operations may be harmed, and we may be at a competitive disadvantage.

Similar laws have been enacted in numerous other states, and proposed at the federal and local levels, and we expect more states to pass similar laws in the future, which could increase our compliance costs and adversely affect our business.

Outside of the United States, an increasing number of foreign laws and regulations apply to privacy and data security.

For example, the European Union’s General Data Protection Regulation (“EU GDPR”), the United Kingdom’s GDPR (“UK GDPR”), (collectively “GDPR”) Brazil’s General Data Protection Law (Lei Geral de Proteção de Dados Pessoais or “LGPD”) (Law No.

For example, the European Union’s General Data Protection Regulation (“EU GDPR”), the United Kingdom’s GDPR (“UK GDPR” and collectively “GDPR”), Brazil’s General Data Protection Law (Lei Geral de Proteção de Dados Pessoais or “LGPD”) (Law No.

13,709/2018), Canada’s Personal Information Protection and Electronic Documents Act (“PIPEDA”) and Canada’s Anti-Spam Legislation (“CASL”), and China’s Personal Information Protection Law (“PIPL”) impose strict requirements for processing the Personal Information of individuals.

For example, under the GDPR, government regulators may impose restrictions or injunctions on data processing, and fines of up to 20 million euros (£17.5 million) or 4% of annual global revenue, whichever is greater.

The GDPR also provides for private litigation related to the processing of personal information, which can be brought by classes of data subjects or consumer protection organizations authorized by law to represent the interests of such classes.

European legislative proposals and existing laws and regulations also apply to cookies and similar tracking technologies, electronic communications, and marketing.

In the EU and the United Kingdom ("UK"), regulators are increasingly focusing on compliance with requirements related to the online behavioral advertising ecosystem.

It is anticipated that the ePrivacy Regulation and national implementing laws will replace the current national laws that implement the ePrivacy Directive that governs electronic communications.

Compliance with these laws may require us to make significant operational changes, limit the effectiveness of our marketing activities, divert the attention of our technology personnel, adversely affect our margins, and subject us to liabilities.

Furthermore, there is a new regulation in the EU related to AI that will impose onerous obligations related to the use of AI-related systems and may require us to change our business practices.

We may also become subject to new laws in the EU that regulate cybersecurity and non-personal information, such as the European Data Act.

Depending on how these laws are interpreted, we may have to adapt our business practices and products to comply with such obligations.

Certain jurisdictions have enacted data localization laws and cross-border personal information transfer laws, which could make it more difficult to transfer information across jurisdictions.

In particular, the European Economic Area (“EEA”) and the UK have significantly restricted the transfer of personal information to the United States and other countries whose privacy and data security laws are generally believed to be inadequate.

Other jurisdictions may adopt similarly stringent interpretations of their data localization and cross-border personal information transfer laws.

Although there are currently various mechanisms that may be used to lawfully transfer personal information to the United States, such as the standard contractual clauses for transfers from the EEA and UK, the UK’s International Data Transfer Agreement / Addendum, and the EU-U.S.

Data Privacy Framework (which allows for transfers to relevant U.S.-based organizations who self-certify compliance and participate in the Framework), these mechanisms are subject to legal challenges and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal information to the United States or elsewhere.

Certain countries outside Europe (e.g., Russia, China, Brazil) have also passed or are considering laws requiring local data residency or otherwise impeding the transfer of personal information across borders, any of which could increase the cost and complexity of doing business.

If there is no lawful manner for us to transfer personal information from the EEA, the UK or other jurisdictions to the United States or elsewhere, or if the requirements for a legally-compliant transfer are too onerous, we may face significant adverse consequences, such as the interruption or degradation of our operations, increased exposure to regulatory actions, substantial fines, injunctions against processing or transferring personal information, determinations by customers not to use our services, limited ability to collaborate with parties that are subject to cross-border data transfer or localization laws, and the

need to increase or relocate our personal information processing capabilities and infrastructure in foreign jurisdictions at significant expense.

Additionally, companies that transfer personal information out of the EEA and UK to other jurisdictions, particularly to the United States, are subject to increased scrutiny from regulators, individual litigants, and activist groups.

Some European regulators have ordered certain companies to suspend or permanently cease certain transfers out of Europe for allegedly violating the EU GDPR’s cross-border data transfer limitations.

Since we are under the supervision of relevant data protection authorities in both the EEA and the UK, we may be fined under both the EU GDPR and UK GDPR for the same breach.

Penalties for certain breaches are up to the greater of EUR 20 million / GBP 17.5 million or 4% of our global annual turnover.

In addition to fines, a breach of the GDPR may result in regulatory investigations, reputational damage, orders to cease or change our data processing activities, enforcement notices, assessment notices for a compulsory audit and/or civil claims (including class actions).

We may also become subject to new laws in the EU that regulate cybersecurity and non-personal information.

For example, the European Union Data Act ("Data Act") became applicable in September 2025.

The Data Act establishes new requirements for providers of data processing services (including cloud and SaaS) into the EU.

The Data Act requires providers to enable customers to switch to other providers or on-premise solutions and to port customer data within certain timeframes;

remove technical, contractual, and commercial obstacles to service switching (including switching charges);

and include certain mandatory terms in customer contracts.

Failure to comply with the Data Act can result in regulatory enforcement and fines, civil claims, and reputational damage.

Depending on how all these laws are interpreted, we may have to adapt our business practices and products to comply with such obligations.

In relation to such cross border transfers of personal data, we expect the existing legal complexity and uncertainty regarding international personal data transfers to continue, and international transfers to the United States and to other jurisdictions more generally to continue to be subject to enhanced scrutiny by regulators.

As the regulatory guidance and enforcement landscape in relation to data transfers continue to develop, we could suffer additional costs, complaints and/or regulatory investigations or fines;

we may have to stop using certain tools and vendors and make other operational changes;

we may have to implement alternative data transfer mechanisms under the GDPR and/ or take additional compliance and operational measures;

and/or it could otherwise affect the manner in which we provide our services, and could adversely affect our business, operations and financial condition.

In relation to data transfers from the EEA to the United States, the EU-US Data Privacy Framework (“DPF”) was approved by the European Commission in July 2023 as an effective EU GDPR data transfer mechanism to U.S.

entities self-certified under the DPF.

The UK Extension to the DPF followed in October 2023, as an effective UK GDPR data transfer mechanism to U.S.

entities self-certified under the UK Extension to the DPF.

In addition to government regulation, privacy advocates, and industry groups may propose new and different self-regulatory standards that may apply to us.

2 unchanged sentences

We may also be bound by contractual obligations related to privacy and data security, and our efforts to comply with such obligations may not be successful.

For example, certain privacy and data security laws, such as the EU GDPR and the CCPA, require our customers to impose specific contractual restrictions on their service providers.

For example, certain privacy and data security laws, such as the GDPR and the CCPA, require our customers to impose specific contractual restrictions on their service providers.

Additionally, in limited circumstances, under various privacy and data security laws and other obligations, we may be required to obtain certain consents to process Personal Information.

1 unchanged sentence

Laws relating to the liability of providers of online services for activities of their users and other third parties are currently being tested by a number of claims, including actions based on invasion of privacy and other torts, unfair competition, copyright and trademark infringement, and other theories based on the nature and content of the materials searched, the ads posted, or the content provided by users.

Moreover, our global platform outage in June 2021 increased our public profile and resulted in more frequent interest in our company by regulators.

Any additional outages may draw additional scrutiny or focused legislation from regulators.

Outages of our platform may draw additional scrutiny or focused legislation from regulators.

In addition, the United States or foreign jurisdictions may establish new laws or regulations regarding the Internet or online services.

These new laws and regulations may affect our products and infrastructure, which could cause us to incur substantial costs to comply, expose us to regulatory scrutiny, criminal or civil liability, require us to fundamentally change our products or operations, or otherwise have an adverse effect on our business.

Obligations relating to privacy and data security (and customers’ data privacy expectations) are evolving, increasingly stringent, creating uncertainty, and may result in increasing scrutiny.

Obligations relating to privacy and data security (and customers’ data privacy expectations) are evolving, increasingly stringent, and create uncertainty, and may result in increasing scrutiny.

Such obligations may be subject to different applications and interpretations, and which may be inconsistent and conflicting among different jurisdictions.

3 unchanged sentences

Future restrictions on the collection, use, sharing, or disclosure of data or additional requirements for express or implied consent of our customers, partners, or end users for the use and disclosure of such information could require us to incur additional costs or modify our platform, possibly in a material manner, and could limit our ability to develop new functionality.

We may at times fail (or be perceived to have failed) in our efforts to comply with our privacy and data security obligations.

We may at times fail (or be perceived to have failed) in our efforts to comply with our privacy and data security obligations or other laws and regulations with respect to the Internet.

Moreover, despite our efforts, our personnel or third parties on whom we rely may fail to comply with such obligations, which could negatively impact our business operations.

Any failure or perceived failure by us or third parties upon whom we rely to comply with obligations, relating to privacy and data security may result in significant consequences including but not limited to governmental investigations and enforcement actions (e.g., investigations, fines, penalties, audits, inspections, and similar), litigation (including class-action claims), additional reporting requirements and/or oversight, bans on processing personal data, and orders to destroy or not use personal information.

Any failure or perceived failure by us or third parties upon whom we rely to comply with obligations, relating to privacy and data security or the Internet may result in significant consequences including but not limited to reputational harm, governmental investigations and enforcement actions (e.g., investigations, fines, penalties, audits, inspections, and similar), litigation (including class-action claims), additional reporting requirements and/or oversight, bans on processing Personal Information, and orders to destroy or not use Personal Information.

Any of these events could have a material adverse effect on our reputation, business, or financial condition, including but not limited to:

6 unchanged sentences

or substantial changes to our business model or operations.

Activities of our customers or the content of their websites and other Internet properties may violate applicable laws and/or our terms of service and could subject us to lawsuits, regulatory enforcement actions, and/or liability in various jurisdictions.

Through our network, we provide a wide variety of products that enable our customers and our customers’ users to exchange information, conduct business, and engage in various online activities both domestically and internationally.

Our customers and our customers’ users may use our network and products in violation of applicable law or in violation of our terms of service or the customer’s own policies.

Regulatory and legislative developments on the development and deployment of AI technologies could adversely affect our use of such technologies in our business operations or our products and services.

Our employees and personnel may increasingly use AI to perform their work, and our customers may deploy AI models or technologies using our platform, including because we develop products that support AI.

However, the regulatory framework for AI is rapidly evolving as many governments have passed and are likely to pass additional laws regulating the development and deployment of AI.

For example, in the United States, the current executive administration’s approach to investment in, and regulation of, AI technologies has and is expected to continue to deviate from that of the previous administration and we will need to adapt to any changes that may result from such approach, including as the result of new or changing executive orders.

For instance, the current administration issued an AI-focused Executive Order on December 11, 2025 entitled “Ensuring a National Policy Framework for Artificial Intelligence”.

This order calls for federal standards and legislation that would preempt conflicting state AI regulations and create a federal litigation task force focused on challenging state AI laws in court.

Additionally, several jurisdictions around the globe, including in Europe and certain U.S.

states, have proposed, enacted, or are considering laws governing the development and deployment of AI.

For example, California enacted several new laws in 2024 and 2025 that regulate the use of AI technologies and provide consumers with additional protections around companies’ use of AI technologies, such as requiring companies to disclose certain uses of generative AI and provide further transparency about how such AI was developed.

Other states have also passed AI-focused legislation, such as Colorado’s Artificial Intelligence Act, which will require developers and deployers of “high-risk” AI systems to implement certain safeguards against algorithmic discrimination, and Utah’s Artificial Intelligence Policy Act, which establishes disclosure requirements and accountability measures for the use of generative AI in certain consumer interactions.

Such additional regulations, the manner in which such new laws are interpreted, and uncertainty around whether they will survive legal challenges or how they will be enforced, may impact our ability to develop, use, procure and commercialize AI and machine learning technologies in the future.

Further, jurisdictions around the globe, including the European Union are considering or have enacted their own AI-focused regulations.

The EU Artificial Intelligence Act (“EU AI Act”), which establishes a risk-based governance framework for AI in the EU market, entered into force on August 1, 2024, and the majority of the substantive requirements are expected to apply from August 2, 2026, and though the European Commission has proposed an extension to December 2, 2027, such extension is not yet finalized or effective.

This framework categorizes AI applications into risk categories such as “unacceptable”, “high”, “limited”, and “minimal”.

AI applications in the “high” risk category are subject to new ex ante conformity assessments and other new requirements related to risk management, testing, technical documentation and robustness, data training and data governance and log recording, transparency, human oversight, and cybersecurity, while AI applications in the “limited” risk category are expected to become subject to new transparency and output labelling obligations.

Fines for breaches of the EU AI Act can be up to 7% of worldwide annual turnover.

The EU AI Act, together with developing guidance and/or decisions in this area, may affect our use of AI technologies and our ability to provide, improve or commercialize our services, require additional compliance measures and changes to our operations and processes, result in increased compliance costs and potential increases in civil claims against us, and could adversely affect our business, operations and financial condition.

If our current or future AI applications fall within the “high” or “limited” risk categories, the increased cost and complexity to comply could adversely affect our business, financial condition and results of operations.

We expect other jurisdictions will adopt similar laws.

Additionally, existing laws and regulations have been and may continue to be interpreted in ways that could affect our use of AI, or could be rescinded or amended as new administrations take differing approaches to AI.

As a result, implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future, and we cannot yet completely determine the impact that existing or future laws, regulations, standards, decisions, or market perception of their requirements may have on our business.

We may not always be able to anticipate how to respond to these laws or regulations, and this uncertainty may make it harder for us to conduct our business using AI, or could lead to regulatory fines or penalties, require us to change our business practices, retrain AI, or prevent or limit our use of AI.

In addition, due to inaccuracies or flaws in the inputs, outputs, or logic of AI, AI models could be biased and could lead us to make decisions that could bias certain individuals (or classes of individuals), and adversely impact their rights, employment, and ability to obtain certain pricing, products, services, or benefits, which could expose us to reputational and competitive harm, customer loss, or legal liability.

Furthermore, because AI models are highly complex and their internal logic often lacks transparency, our use of these technologies could result in unintended consequences or outcomes that differ significantly from our expectations or those of our customers.

Through our network, we provide a wide variety of products that enable our customers, including free account users, and our customers’ users to exchange information, conduct business, and engage in various online activities both domestically and internationally.

Our customers, including free account users, and our customers’ users may use our network and products in violation of applicable law or in violation of our terms of service or the customer’s own policies.

The existing laws relating to the liability of providers of online products and services for activities of their users are highly unsettled and in flux both within the United States and internationally.

In the future we may be subject to lawsuits and/or liability arising from the conduct of our customers and our customers’ users.

Additionally, the conduct of our customers and our customers’ users may subject us to regulatory enforcement actions and/or liability.

In the future we may be subject to lawsuits and/or liability arising from the conduct of our customers, including free account users, and our customers’ users.

Additionally, the conduct of our customers, including free account users, and our customers’ users may subject us to regulatory enforcement actions, reputational harm, and/or liability.

There can be no assurance that we will not face litigation in the future or that we will prevail in any litigation we may face.

An adverse decision in one or more of these lawsuits could materially and adversely affect our business, results of operations, and financial condition.

federal statutes may apply to us with respect to various activities of our customers, including the Digital Millennium Copyright Act (“DMCA”), which provides recourse for owners of copyrighted material who believe their rights under U.S.

federal statutes may apply to us with respect to various activities of our customers, including free account users, including the Digital Millennium Copyright Act (“DMCA”), which provides recourse for owners of copyrighted material who believe their rights under U.S.

1 unchanged sentence

Although these and other similar legal provisions provide limited protections from liability for service providers like us, those protections may not be interpreted in a way that applies to us, may be amended or removed in the future, or may not provide us with complete protection from liability claims.

If we are found not to be protected by the safe harbor provisions of the DMCA, CDA or other similar laws, or if we are deemed subject to laws in other countries that may not have the same protections or that may impose more onerous obligations on us, we may owe substantial damages and our brand, reputation, and financial results may be harmed.

Policies and laws in this area remain highly dynamic, and we may face additional theories of intermediary liability in various jurisdictions.

For example, policymakers in the United States have called for a re-examination of CDA section 230 and copyright law, the UK has passed the Online Safety Act 2023, and the EU has implemented the Digital Services Act and Digital Markets Act to impose additional legal requirements on certain service providers.

The DSA sets out a framework of layered responsibilities targeted at different types of services, including requirements for service providers to act on orders against illegal content and to publish reports on moderation of content.

If we are found not to be protected by the safe harbor provisions of the DMCA, CDA, or other similar laws, or if we are deemed subject to laws in other countries that may not have the same protections or that may impose

more onerous obligations on us, we may owe substantial damages and our brand, reputation, and financial results may be harmed.

Policies and laws in this area remain highly dynamic, and we may face additional theories of intermediary liability in various jurisdictions if these evolving laws begin to apply to our services.

For example, policymakers in the United States have called for a re-examination of CDA section 230 and copyright law, and the EU has implemented the Digital Services Act ("DSA") and Digital Markets Act to impose additional legal requirements on certain service providers.

The DSA sets out a framework of layered responsibilities targeted at different types of services, including requirements for certain service providers to act on orders against illegal content, publish reports on moderation of content, and update terms and conditions.

Member States can also issue rules on penalties for violating the DSA, with fines of up to 6% of annual global revenue.

Complying with these obligations could cause us to change our products, policies, and procedures.

In addition, in 2019, the EU approved a Copyright Directive that will impose additional obligations on service providers and failure to comply could give rise to significant liability.

Other laws and pending legislation at the EU level (terrorist content, child sexual abuse materials) and in the UK (online harms), Australia (online harms), and India (Digital India Act), as well as other new laws like them, may also expose Internet companies like us to significant liability.

In addition, in 2019, the EU approved a Copyright Directive that imposes additional obligations on service providers and failure to comply could give rise to significant liability.

We may incur additional costs to comply with these new laws, which may have an adverse effect on our business, results of operations, and financial condition.

10 unchanged sentences

Such entities may have statutory, contractual, or other legal rights to terminate contracts with us or our partners due to a default or for other reasons, and any such termination may harm our business.

In addition, these

governmental agencies may be required to publish the rates we negotiate with them, which could harm our negotiating leverage with other potential customers and in turn harm our business.

In addition, these governmental agencies may be required to publish the rates we negotiate with them, which could harm our negotiating leverage with other potential customers and in turn harm our business.

The success of our business depends on customers’ continued and unimpeded access to our platform on the Internet.

5 unchanged sentences

On April 25, 2024, the FCC voted to restore the network neutrality rules which bring back a national standard for broadband reliability, security, and consumer protection.

On August 1, 2024, the United States Court of Appeals for the Sixth Circuit granted a stay of the network neutrality rules.

On August 1, 2024, the United

States Court of Appeals for the Sixth Circuit granted a stay of the network neutrality rules.

On January 2, 2025, the United States Court of Appeals for the Sixth Circuit struck down the FCC’s network neutrality rules, ruling that the FCC lacks statutory authority to impose its proposed net neutrality policies and therefore exceeded its authority in imposing the net neutrality regulations.

1 unchanged sentence

A number of states have adopted or are adopting or considering legislation or executive actions that would regulate the conduct of broadband providers.

California’s state-specific network neutrality law has taken effect, as has a similar law in Vermont, but a challenge to the Vermont law remains pending and has been suspended until an appeal in another case addressing state powers to adopt internet regulation is resolved.

For example, California, Vermont, and Maine have state-specific network neutrality laws in effect.

In addition, the status of state regimes may be affected by the FCC’s action in its new network neutrality proceeding.

38 unchanged sentences

federal, state, local, or non-U.S.

international tax laws on income, sales, use, indirect, or other tax laws, statutes, rules, regulations, or ordinances on multinational corporations to which we are subject are or under which we operate are unsettled in certain respects and may be subject to significant change.

international tax laws on income, sales, use, indirect, or other tax laws, statutes, rules, regulations, or ordinances on multinational corporations to which we are subject or under which we operate are unsettled in certain respects and may be subject to significant change.

For example, many countries in Europe, as well as a number of other countries and organizations, including the Organization for Economic Cooperation and Development and the European Commission, have recently proposed, recommended, or (in the case of countries) enacted changes to existing tax laws or new tax laws that could significantly increase our tax obligations in the countries where we do business or require us to change the manner in which we operate our business.

These proposals, recommendations and enactments include changes to the existing

framework in respect of income taxes, as well as new types of non-income taxes (such as taxes based on a percentage of revenue or taxes applicable to digital services), which could apply to our business.

These proposals, recommendations and enactments include changes to the existing framework in respect of income taxes, as well as new types of non-income taxes (such as taxes based on a percentage of revenue or taxes applicable to digital services), which could apply to our business.

These contemplated tax initiatives, if finalized and adopted by countries, may ultimately impact our effective tax rate and could adversely affect our sales activity resulting in a negative impact on our operating results and cash flows.

6 unchanged sentences

federal income taxation of corporations, including imposing a minimum tax on the book income of certain large corporations and an excise tax on certain corporate stock repurchases that is imposed on the corporation repurchasing such stock.

Future legislation or regulatory guidance, including under the Tax Act or the IRA, or other executive or Congressional actions in the United States may occur, including as a result of the recent presidential and congressional elections in the United States, and could ultimately increase or lessen the impact of such taxes on our business and financial condition.

We urge our stockholders to consult with their legal and tax advisors with respect to this legislation and the potential tax consequences of investing in or holding our common stock.

On July 4, 2025, the One Big Beautiful Bill Act ("OBBBA"), was enacted in the U.S., which includes significant changes to federal tax law and other regulatory provisions that may impact us.

Future legislation or regulatory guidance, including under the OBBBA, Tax Act or the IRA, or other executive or Congressional actions in the United States may occur, and could ultimately increase or lessen the impact of such taxes on our business and financial condition.

Stockholders should consult with

their legal and tax advisors with respect to this legislation and the potential tax consequences of investing in or holding our common stock.

Our ability to use our net operating losses to offset future taxable income may be subject to certain limitations.

7 unchanged sentences

A detailed analysis was performed through December 31, 2021 for us to determine whether an ownership change under Section 382 of the Code has occurred, and ownership changes were identified in 2013 and 2020.

As a result of this analysis, we concluded that there is no longer any limitation on our utilization of such NOLs.

Another detailed analysis was completed through December 31, 2024 and no further ownership changes were identified.

As a result of these analyses, we concluded that there is no longer any limitation on our utilization of such NOLs.

A detailed analysis was performed for the period March 1, 2014 to October 1, 2020 for Signal Sciences to determine whether an ownership change under Section 382 of the Code has occurred and an ownership change was identified in 2020.

12 unchanged sentences

The taxing authorities of the jurisdictions in which we operate may challenge our methodologies for pricing intercompany transactions pursuant to our intercompany arrangements or disagree with our determinations as to the income and expenses attributable to specific jurisdictions.

If such a challenge or disagreement were to occur, and our position was not sustained, we could be required to pay additional taxes, interest, and penalties, which could result in one-time tax

charges, higher effective tax rates, reduced cash flows, and lower overall profitability of our operations.

If such a challenge or disagreement were to occur, and our position was not sustained, we could be required to pay additional taxes, interest, and penalties, which could result in one-time tax charges, higher effective tax rates, reduced cash flows, and lower overall profitability of our operations.

Our financial statements could fail to reflect adequate reserves to cover such a contingency.

4 unchanged sentences

Other countries also regulate the import and export of certain encryption products and technology through import and export licensing requirements, and have enacted laws that could limit our ability to distribute our products or could limit our customers’ ability to implement our products in those countries.

Additionally, export restrictions recently imposed on Russia and Belarus in connection with the military conflict involving Ukraine specifically restrict the export of encryption software to these locations.

Furthermore, our activities are subject to United States economic sanctions laws and regulations that generally prohibit the direct or indirect exportation or provision of products and services to countries, governments, and individuals and entities targeted by United States embargoes or sanctions, except to the extent authorized by OFAC or exempt from sanctions.

For example, following Russia’s invasion of Ukraine, the United States and other countries imposed economic sanctions and severe export control restrictions against Russia and Belarus, and the United States and other countries could impose wider sanctions and export restrictions and take other actions should the conflict further escalate.

Additionally, export restrictions imposed on Russia, Belarus, and restricted regions of Ukraine in connection with the military conflict involving Ukraine specifically restrict the export of encryption software to these locations.

targeted by United States embargoes or sanctions, except to the extent authorized by OFAC or exempt from sanctions.

For example, following Russia’s invasion of Ukraine, the United States and other countries imposed economic sanctions and severe export control restrictions against Russia,Belarus, and restricted regions of Ukraine, and the United States and other countries could impose wider sanctions and export restrictions and take other actions should the conflict further escalate.

Obtaining the necessary export license or other authorization for a particular sale may not always be possible, and, even if the export license is ultimately granted, the process may be time-consuming and may result in the delay or loss of sales opportunities.

21 unchanged sentences

capital markets experienced and continue to experience extreme volatility.

While our ability to do business has not been materially affected, and the global restrictive measures that have been taken in response to such events, and could be taken in the future, have created significant global economic uncertainty that could prolong and escalate tensions and expand the geopolitical conflict, which could have a lasting impact on regional and global economies, any of which could harm our business and operating results.

While our ability to do business has not been materially affected, the global restrictive measures that have been taken in response to such events, and could be taken in the future, have created significant global economic uncertainty that could prolong and escalate tensions and expand the geopolitical conflict, which could have a lasting impact on regional and global economies, any of which could harm our business and operating results.

Further, due to political uncertainty and international military actions, we and the third parties upon which we rely may be vulnerable to a heightened risk of security breaches, computer malware, social-engineering attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, and other cyber-attacks, including attacks that could materially disrupt our systems and operations, supply chain, and ability to do business .

2 unchanged sentences

in the past few years have increased to levels not seen in decades, prompting the Federal Reserve to increase interest rates.

Negative conditions in the general economy both in the United States and abroad, including conditions resulting from changes in gross domestic product growth, financial and credit market fluctuations, currency and interest rate fluctuations, political turmoil, natural catastrophes, warfare, public health issues, and terrorist attacks on the United States, Europe, the Asia Pacific region, or elsewhere, could cause a downturn or recession and a decrease in business investments, including spending on information technology, which would harm our business.

Negative conditions in the general economy both in the United States and abroad, including conditions resulting from changes in gross domestic product growth, financial and credit market fluctuations, currency and interest rate fluctuations, political turmoil, actual or potential government shutdowns, natural catastrophes, warfare, public health issues, and terrorist attacks on the United States, Europe, the Asia Pacific region, or elsewhere, could cause a downturn or recession and a decrease in business investments, including spending on information technology, which would harm our business.

In addition, international trade disputes may disrupt our supply chain and increase pricing of the equipment components we use to operate our network and provide products to our customers.

Further, it is possible that government policy changes and related uncertainty about policy

changes could increase market volatility.

To the extent that our platform and our products are perceived by customers and potential customers as too costly, or difficult to deploy or migrate to, our revenue may be disproportionately affected by delays or reductions in general information technology spending.

22 unchanged sentences

Furthermore, our efforts to enforce our intellectual property rights may be met with defenses, counterclaims, and countersuits attacking the validity and enforceability of our intellectual property rights.

further sales or the implementation of our platform, impair the functionality of our platform, delay introductions of new products, result in our substituting inferior or more costly technologies into our products, or injure our reputation.

Our inability to protect our intellectual property and proprietary technology against unauthorized copying or use, as well as any costly litigation or diversion of our management’s attention and resources, could, among other things, delay further sales or the implementation of our platform, impair the functionality of our platform, delay introductions of new products, result in our substituting inferior or more costly technologies into our products, or injure our reputation.

We will not be able to protect our intellectual property if we are unable to enforce our rights or if we do not detect unauthorized use of our intellectual property.

1 unchanged sentence

If we fail to meaningfully protect our intellectual property and proprietary rights, our business and competitive advantage may be harmed.

In addition, there is uncertainty surrounding the applications of intellectual property laws to AI.

Intellectual property ownership and rights (including copyright) and the remedies of rights owners surrounding the use and development of AI have not been fully addressed by courts or other federal or state laws or regulations, and our use of AI or adoption of AI into our products and services may result in disputes with respect to ownership of intellectual property, or exposure to claims of

Such claims, regardless of merit, could lead to costly litigation, significant settlements, or injunctions forcing us to cease using or redesign AI features.

We may in the future be subject to legal proceedings and litigation relating to intellectual property disputes, which are costly and may subject us to significant liability and increased costs of doing business.

7 unchanged sentences

Any inability to license third-party technology in the future would have an adverse effect on our business and operating results, and would adversely affect our ability to compete.

We may also be contractually obligated to indemnify our customers or other third parties in the event of infringement of a third party’s intellectual property rights.

We may also be contractually obligated to indemnify our customers or other third parties in the event of a claim of infringement of a third party’s intellectual property rights.

We receive demands for such indemnification from time to time and expect to continue to do so.

7 unchanged sentences

Few courts have interpreted open source licenses, and the manner in which these licenses may be interpreted and enforced is therefore subject to some uncertainty.

We rely on multiple software programmers to design our proprietary technologies, and we do not exercise complete control over the development efforts of our programmers and we cannot be certain that our programmers have not incorporated open source software into our proprietary products and technologies or that they will not do so in the future.

We rely on multiple software programmers to design our proprietary technologies, and because we do not exercise complete control over the development efforts of our programmers, we may not be aware of possible unauthorized actions.

We cannot be certain that our programmers have not incorporated open source software into our proprietary products and technologies or that they will not do so in the future.

In the event that portions of our proprietary technology are determined to be subject to an open source license, we could be required to publicly release the affected portions of our source code, re-engineer all or a portion of our technologies, or otherwise be limited in the licensing of our technologies, each of which could reduce or eliminate the value of our platform and technologies and materially and adversely affect our ability to sustain and grow our business.

1 unchanged sentence

Our agreements with customers and other third parties generally include provisions under which we are liable or agree to indemnify them for losses suffered or incurred as a result of claims of intellectual property infringement, data protection, damages caused by us to property or persons, or other liabilities relating to or arising from our platform, services, or other contractual obligations.

Some of these agreements provide for uncapped liability for which we would be responsible, and some

provisions survive termination or expiration of the applicable agreement.

Some of these agreements provide for uncapped liability for which we would be responsible, and some provisions survive termination or expiration of the applicable agreement.

Large liability payments could harm our business, results of operations, and financial condition.

Although we often contractually limit our liability with respect to such obligations, we may still incur substantial liability related to them, and in case of an intellectual property infringement indemnification claim, we may be required to cease use of certain functions of our platform as a result of any such claims.

Any dispute with a customer with respect to such obligations could have adverse effects on our relationship with that customer and other existing customers and new customers and harm our business.

Even when we have contractual protections against such customer claims, we may choose to honor a customer’s request for indemnification or otherwise seek to maintain customer satisfaction by issuing customer credits, assisting our customer in defending against claims, or in other ways.

Any dispute with a customer with respect to such obligations could have adverse effects on our relationship with that customer, other existing customers, and new customers and harm our business.

Even when we have contractual protections against such

customer claims, we may choose to honor a customer’s request for indemnification or otherwise seek to maintain customer satisfaction by issuing customer credits, assisting our customer in defending against claims, or in other ways.

Risks Related to Ownership of Our Common Stock

Our stock price may be volatile, and the value of our common stock may decline.

Our stock price is volatile, and the value of our common stock may decline.

Historically, our stock price has been volatile.

6 unchanged sentences

• changes in our projected operating and financial results;

• changes in laws or regulations applicable to our platform or related products;

• changes in laws or regulations applicable to our operations, platform or related products;

• announcements by us or our competitors of significant business developments, acquisitions, or new offerings;

5 unchanged sentences

• changes in the anticipated future size and growth rate of our market;

• general political, social, economic, regulatory, and market conditions, in both domestic and our foreign markets, including the effects of global events like the war in Ukraine and the more recent hostilities in Israel on the global economy, labor shortages, supply chain disruptions, inflation, increased interest rates, banking instability and slow or negative growth of our markets.

• general political, social, economic, regulatory, and market conditions, in both domestic and our foreign markets, including the effects of global events like the war in Ukraine and the hostilities in the Middle East on the global economy, labor shortages, supply chain disruptions, inflation, increased interest rates, banking instability, and slow or negative growth of our markets.

Broad market and industry fluctuations, as well as general economic, political, social, regulatory, and market conditions, may impact the market price of our common stock.

1 unchanged sentence

Over the past few years, our stock price has declined significantly.

There are no assurances that the trading price of

our common stock will recover to prior levels.

There are no assurances that the trading price of our common stock will recover to prior levels.

Moreover, the trading price of our common stock could experience further volatility and declines.

These fluctuations could cause you to lose all or part of your investment in our common stock.

These fluctuations could cause investors to lose all or part of their investment in our common stock.

In addition, extreme price and volume fluctuations in the stock markets have affected and continue to affect many technology companies’ stock prices, including ours.

Often, their stock prices have fluctuated in ways unrelated or disproportionate to the companies’ operating performance.

Often, stock prices have fluctuated in ways unrelated or disproportionate to companies’ operating performance.

In the past, companies that have experienced volatility in the market price of their securities have been subject to securities class action litigation.

3 unchanged sentences

During the year ended December 31, 2022, we entered into separate, privately negotiated transactions with certain holders of the Notes to repurchase approximately $235.0 million aggregate outstanding principal amount of the 2026 Notes for an aggregate cash repurchase price of approximately $176.4 million.

During the year ended December 31, 2024, we entered into several separate, privately negotiated transactions with certain holders of the 2026 Notes to exchange (the “Exchange”) $157.9 million of aggregate principal amount of the 2026 Notes for $150.0 million aggregate principal amount of 7.75% convertible senior unsecured notes due in 2028 (the “2028 Notes” and together with the 2026 Notes, the “Notes”).

During the year ended December 31, 2024, we entered into several separate, privately negotiated transactions with certain holders of the 2026 Notes to exchange $157.9 million of aggregate principal amount of the 2026 Notes for $150.0 million aggregate principal amount of 7.75% convertible senior unsecured notes due in 2028 (the “2028 Notes”).

In December 2025, we entered into a purchase agreement for the sale (the “Offering”) of $160.0 million principal amount of our 0% convertible senior notes due 2030 (the “2030 Notes”, together with the 2026 Notes and the 2028 Notes, the “Notes).

In connection with the Offering, the initial purchasers exercised in full their option to purchase an additional $20.0 million principal amount of the 2030 Notes, resulting in the issuance of an aggregate principal amount of $180.0 million of the 2030 Notes.

We used a portion of the net proceeds from the offering of the 2030 Notes to repurchase approximately $150.0 million aggregate principal amount of the 2026 Notes for an aggregate cash repurchase price of approximately $148.9 million.

The remaining 2026 Notes with an aggregate principal amount of $38.6 million will mature on March 15, 2026, unless earlier converted, redeemed or repurchased.

The 2030 Notes incurred transaction costs of $6.7 million which were recorded as contra-liability and represents the difference between the principal and carrying amount of the 2030 Notes.

The 2028 Notes will mature on June 1, 2028, unless earlier converted or repurchased.

The 2028 Notes and the 2030 Notes will mature on June 1, 2028 and December 15, 2030, respectively, unless earlier converted or repurchased.

Holders of the Notes will have the right, subject to certain conditions and limited exceptions, to require us to repurchase all or a portion of their Notes upon the occurrence of a fundamental change at a fundamental change repurchase price equal to 100% of the principal amount of the Notes to be repurchased, plus accrued and unpaid special interest, if any, as described in the indenture governing the Notes.

14 unchanged sentences

Servicing our debt requires a significant amount of cash, and we may not have sufficient cash flow from our business to pay our substantial debt.

Our ability to make scheduled payments of the principal of or to refinance our indebtedness, including the Notes, depends on our future performance, which is subject to economic, financial, competitive, and other factors beyond our control.

Our business may not generate cash flow from operations in the future sufficient to service our debt, including the Notes, and make necessary capital expenditures.

Our ability to make scheduled payments of the principal of or to refinance our indebtedness, including any loans incurred under the Credit Agreement and the Notes, depends on our future performance, which is subject to economic, financial,

competitive, and other factors beyond our control.

Our business may not generate cash flow from operations in the future sufficient to service our debt, including any loans incurred under the Credit Agreement and the Notes, and make necessary capital expenditures.

If we are unable to generate such cash flow, we may be required to adopt one or more alternatives, such as selling assets, refinancing or restructuring debt or obtaining additional equity capital on terms that may be onerous or highly dilutive.

23 unchanged sentences

Future sales of our common stock in the public market could cause the market price of our common stock to decline.

Sales of a substantial number of shares of our common stock in the public market, or the perception that these sales might occur, could depress the market price of our common stock and could impair our ability to raise capital through the sale of additional equity securities.

of additional equity securities.

We are unable to predict the effect that such sales may have on the prevailing market price of our common stock.

3 unchanged sentences

The outstanding portion of the 2026 Notes will also become convertible at the option of the holders, subject to certain limitations and restrictions, prior to March 15, 2026.

The 2028 Notes will also become convertible at the option of the holders, subject to certain limitations and restrictions, prior to June 1, 2028.

The 2028 Notes and the 2030 Notes will also become convertible at the option of the holders, subject to certain limitations and restrictions, prior to June 1, 2028 and December 15, 2030, respectively.

Future sales also could cause the trading price of our common stock to decline and make it more difficult for investors to sell shares of our common stock.

12 unchanged sentences

Any determination to pay cash dividends in the future will be at the discretion of our board of directors and are restricted by the terms of our Credit Agreement.

The Credit Agreement permits the payment of cash dividends so long as, after giving effect to any such dividend, we maintain a consolidated adjusted quick ratio of at least 1.50 to 1.00 and are otherwise in pro forma compliance with all covenants under the Credit Agreement.

In addition, the Credit Agreement permits us to pay up to $10.0 million in cash dividends per fiscal year so long as, after giving effect to any such dividend, we are in pro forma compliance with all covenants under the Credit Agreement, including a consolidated adjusted quick ratio of at least 1.25 to 1.00.

The Credit Agreement permits the payment of cash dividends so long as, after giving effect to any such dividend, (i) we maintain a consolidated adjusted quick ratio of at least 1.50 to 1.00, (ii) if our consolidated adjusted quick ratio is less than 1.75 to 1.00, our revenue growth rate for the trailing four fiscal quarters is at least 5%, and (iii) no event of default is continuing or would result under the Credit Agreement.

In addition, the Credit Agreement permits us to pay up to $10.0 million in cash dividends per fiscal year so long as, after giving effect to any such dividend, no event of default is continuing or would result under the Credit Agreement, including a consolidated adjusted quick ratio of at least 1.25 to 1.00.

Accordingly, investors must rely on sales of their common stock after price appreciation, which may never occur, as the only way to realize any future gains on their investments.

1 unchanged sentence

As a public company, we incur significant legal, accounting, and other expenses.

The Sarbanes-Oxley Act, the Dodd-Frank Wall Street Reform and Consumer Protection Act, the listing requirements of the NYSE, and other applicable securities rules and regulations impose various requirements on public companies.

As a result, our management and other personnel have to devote a substantial amount of time to compliance with these requirements.

The Sarbanes-Oxley Act, the Dodd-Frank Wall Street Reform and Consumer Protection Act, the listing requirements of Nasdaq, and other applicable securities rules and regulations impose various requirements on public companies.

As a result, our management and other personnel have

to devote a substantial amount of time to compliance with these requirements.

Moreover, these rules and regulations increase our legal and financial compliance costs and make some activities more time-consuming and costly.

16 unchanged sentences

For example, the indenture governing the Notes will require us, except as described therein, to repurchase the Notes for cash upon the occurrence of a fundamental change and, in certain circumstances, to increase the conversion rate for a holder that converts its notes in connection with a make-whole fundamental change.

A takeover of us may trigger the requirement that

we repurchase the Notes, increase the conversion rate, or both, which could make it costlier for a potential acquirer to engage in such takeover.

A takeover of us may trigger the requirement that we repurchase the Notes, increase the conversion rate, or both, which could make it costlier for a potential acquirer to engage in such takeover.

Such additional costs may have the effect of delaying or preventing a takeover of us that would otherwise be beneficial to investors.

17 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors