What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2023-02-06 compared with 2022-11-09 · 49 added, 54 removed, 322 unchanged (24% of the section changed)

A description of the risk factors associated with our business is set forth below.

The list is not exhaustive, and you should carefully consider these risks and uncertainties before investing in our common stock.

A description of the risk factors associated with our business is set forth below and in “Management’s Discussion and Analysis of Financial Condition and Results of Operations, Legal Proceedings, and Quantitative and Qualitative Disclosures About Market Risk.” The list is not exhaustive, and you should carefully consider these risks and uncertainties before investing in our common stock.

RISKS RELATED TO OUR BUSINESS STRATEGY AND INDUSTRY

27 unchanged sentences

Many of these competitors offer solutions or are currently developing solutions that directly compete with our offerings.

We also face growing competition from other technology companies, as well as from companies in the identity threat protection space such as credit bureaus.

Further, many of our competitors are increasingly developing and incorporating into their products data protection software and other competing Cyber Safety products such as antivirus protection or VPN, often free of charge, that compete with

our offerings.

We also face growing competition from other technology companies, as well as from companies in the identity threat protection space such as

credit bureaus.

Our competitive position could be adversely affected by the functionality incorporated into these products rendering our existing solutions obsolete.

31 unchanged sentences

Renewing customers may require additional incentives to renew, may not renew for the same contract period, or may change their subscriptions.

We therefore may be unable to retain our existing customers on the same or on more profitable terms, if at all.

We therefore may be unable to retain our existing customers on the

same or on more profitable terms, if at all.

In addition, we may not be able to accurately predict or anticipate future trends in customer retention or effectively respond to such trends.

19 unchanged sentences

Our solutions are discretionary purchases, and customers may reduce or eliminate their discretionary spending on our solutions during a difficult macroeconomic environment.

Although we did not experience a material increase in cancellations by customers or a material reduction in our retention rate in fiscal 2022 or in the first two quarters of fiscal 2023, we may experience such an increase or reduction in the future, especially in the event of a prolonged recession or a worsening of current conditions as a result of the COVID-19 pandemic.

Although we did not experience a material increase in cancellations by customers or a material reduction in our retention rate in fiscal 2022 or in the first three quarters of fiscal 2023, we may experience such an increase or reduction in the future, especially in the event of a prolonged recession or a worsening of current conditions as a result of inflation, changes in interest rates, Russia’s invasion of Ukraine, the COVID-19 pandemic or other macroeconomic events.

In addition, during a recession, consumers may experience a decline in their credit or disposable income, which may result in less demand for our solutions.

As a result, we may have to lower our prices or make other changes to our pricing model to address these dynamics, any of which could adversely affect our business and financial results.

In addition, in January 2021, we acquired Germany-based Avira and in September 2022, we completed our Merger with Avast.

In addition, in January 2021, we acquired Germany-based Avira and in September 2022, we completed the Merger with Avast.

Many of Avira’s and Avast’s users are freemium subscribers, meaning they do not pay for its basic services.

Much of our anticipated growth in connection with the Avira acquisition and the Avast Merger is attributable to attracting and converting Avira’s and Avast’s freemium users to a paid subscription option.

Much of our anticipated growth in connection with the Avira acquisition and the Merger with Avast is attributable to attracting and converting Avira’s and Avast’s freemium users to a paid subscription option.

Numerous factors, however, may impede our ability to attract free users, convert these users into paying customers and retain them.

38 unchanged sentences

We may also face pressure to lower our prices in order to compete in emerging markets, which could adversely affect revenue derived from our international operations.

Our business has not been materially impacted to date by the ongoing military conflict between Russia and Ukraine;

Our business has not been materially impacted to date by Russia’s invasion of Ukraine and retaliatory sanctions against the Russian Federation and Belarus;

however, it is not possible to predict the broader consequences of this conflict or other conflicts that may arise in the future, which could include geopolitical instability and uncertainty;

adverse impacts on global and regional economic conditions and financial

markets, including significant volatility in credit, capital, and currency markets;

adverse impacts on global and regional economic conditions and financial markets, including significant volatility in credit, capital, and currency markets;

reduced economic activity;

1 unchanged sentence

and increased cybersecurity threats and concerns.

The ultimate extent to which the Russia-Ukraine conflict or other future conflicts may negatively impact our business, financial condition and results of operations will depend on future developments, which are highly uncertain, difficult to predict and subject to change.

The ultimate extent to which Russia’s invasion of Ukraine or other future conflicts may negatively impact our business, financial condition and results of operations will depend on future developments, which are highly uncertain, difficult to predict and subject to change.

Our future success depends on our ability to attract and retain personnel in a competitive marketplace.

18 unchanged sentences

In addition, hiring, training, and successfully integrating replacement personnel can be time consuming and expensive, may cause additional disruptions to our operations, and may be unsuccessful, which could negatively impact future financial results.

Our solutions, systems, websites and the data on these sources may be subject to intentional disruption that could materially harm to our reputation and future sales.

Despite our precautions and significant ongoing investments to protect against security risks, data protection breaches, cyber-attacks, and other intentional disruptions of our solutions, we expect to be an ongoing target of attacks specifically designed to impede the performance and availability of our offerings and harm our reputation as a leading cyber security company.

Similarly, experienced computer programmers or other sophisticated individuals or entities, including malicious hackers, state-sponsored organizations, and insider threats including actions by employees and third-party service providers, may attempt to penetrate our network security or the security of our systems and websites and misappropriate proprietary information or cause interruptions of our products and services.

Such attempts are increasing in number and in technical sophistication, and if successful could expose us and the affected parties, to risk of loss or misuse of proprietary or confidential information or disruptions of our business operations.

While we engage in a number of measures aimed to protect against security breaches and to minimize the impact if a data breach were to occur, our information technology systems and infrastructure may be vulnerable to damage, compromise, disruption, and shutdown due to attacks or breaches by hackers or other circumstances, such as error or malfeasance by employees or third-party service providers or technology malfunction.

The occurrence of any of these events, as well as a failure to promptly remedy these events should they occur, could compromise our systems, and the information stored in our systems could be accessed, publicly disclosed, lost, stolen, or damaged.

Our solutions, systems, websites and the data on these sources have been and may continue to be subject to intentional disruption that could materially harm our reputation and future sales.

Despite our precautions and significant ongoing investments to protect against security risks, data protection breaches, cyber-attacks, and other intentional disruptions of our solutions, we expect to continue to be a target of attacks specifically designed to impede the performance and availability of our offerings and harm our reputation as a leading cyber security company.

Similarly, experienced computer programmers or other sophisticated individuals or entities, including malicious hackers, state-sponsored organizations, and insider threats including actions by employees and third-party service providers, could or have attempted to penetrate, and in some cases have penetrated, our network security or the security of our vendors or suppliers.

Such attempts are increasing in number and in technical sophistication, and could expose us and the affected parties, to risk of loss or misuse of proprietary, personal or confidential information or disruptions of our business operations.

When a data breach occurs, our information technology systems and infrastructure can be subject to damage, compromise, disruption, and shutdown due to attacks or breaches by hackers or other circumstances, such as error or malfeasance by employees or third-party service providers or technology malfunction.

The occurrence of any of these events, as well as a failure to promptly remedy these events when they occur, could compromise our systems and the information stored in our systems.

Any such circumstance could adversely affect our ability to attract and maintain customers as well as strategic partners, cause us to suffer negative publicity or damage to our brand, and subject us to legal claims and liabilities or regulatory penalties.

1 unchanged sentence

Techniques used to obtain unauthorized access or to sabotage systems change frequently, are constantly evolving and generally are difficult to recognize and react to effectively.

We may be unable to anticipate these techniques or to implement adequate preventive or reactive measures.

Several recent, highly publicized data security breaches, including a large-scale attack on SolarWinds customers by a foreign nation state actor and a significant uptick in ransomware/extortion attacks at other companies have heightened consumer awareness of this issue and may embolden individuals or groups to target our systems or those of our strategic partners or enterprise customers.

In December 2021, a critical remote code execution (RCE) vulnerability was identified in the Apache Software Foundation’s Log4j software library (Log4j), which if exploited could result in unauthorized access to our systems and data, and

acquisition of the same.

We are taking, and have taken, steps to remediate all known Log4j vulnerabilities within our environment, deployed compensating controls, and implemented additional changes to protect against an exploit of those vulnerabilities.

A threat actor could exploit a Log4j vulnerability or newly discovered vulnerabilities before we complete our remediation work or identify a vulnerability that we did not effectively remediate.

If that happens, there could be unauthorized access to, or acquisition of, data we maintain, and damage to our systems.

We are not always able to anticipate these techniques or to implement adequate or timely preventive or reactive measures.

Several recent, highly publicized data security breaches, including large-scale attacks by foreign nation state actors and a significant uptick in ransomware/extortion attacks at other companies, have heightened consumer awareness of this issue and may embolden individuals or groups to target our systems or those of our strategic partners or enterprise customers.

As an example, a threat actor could exploit a new vulnerability before we complete our remediation work or identify a vulnerability that we did not effectively remediate.

If that happens, there could be

unauthorized access to, or acquisition of, data we maintain, and damage to our systems.

We could also face legal action from individuals, business partners, and regulators in connection with exploitation of those vulnerabilities, which would result in increased costs and fees incurred in our defense against those proceedings.

31 unchanged sentences

In addition, we could have difficulty producing accurate financial statements on a timely basis, and deficiencies may arise in our internal control over financial reporting, which may impact our ability to certify our financial results, all of which could adversely affect the trading value of our stock.

Although we endeavor to ensure there is redundancy in these systems and that

they are regularly backed-up, there are no assurances that data recovery in the event of a disaster would be effective or occur in an efficient manner.

Although we endeavor to ensure there is redundancy in these systems and that they are regularly backed-up, there are no assurances that data recovery in the event of a disaster would be effective or occur in an efficient manner.

If these systems or their functionality do not operate as we expect them to, we may be required to expend significant resources to make corrections or find alternative sources for performing these functions.

27 unchanged sentences

Our solutions are highly regulated, which could impede our ability to market and provide our solutions or adversely affect our business, financial position, and results of operations.

Our solutions are subject to a high degree of regulation, including a wide variety of federal, state, and local laws and regulations, such as the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act, the Federal Trade Commission Act (the FTC Act), and comparable state laws that are patterned after the FTC Act.

Our solutions are subject to a high degree of regulation, including a wide variety of international and U.S.

federal, state, and local laws and regulations, such as the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act, the Federal Trade Commission Act (the FTC Act), and comparable state laws that are patterned after the FTC Act.

We have previously entered into consent decrees and similar arrangements with the FTC and the attorney generals of 35 states as well as a settlement with the FTC relating to allegations that certain of LifeLock’s advertising, marketing and security practices constituted deceptive acts or practices in violation of the FTC Act, which impose additional restrictions on our business, including prohibitions against making any misrepresentation of “the means, methods, procedures, effects, effectiveness, coverage, or scope of” our solutions.

We signed an Undertaking, effective June 14, 2021, with the United Kingdom’s Competition and Markets Authority (CMA) requiring our NortonLifeLock Ireland Limited and NortonLifeLock UK entities to make certain changes to our policies and practices related to automatically renewing subscriptions in the United Kingdom as part of the CMA’s investigation into auto-renewal practices in the

antivirus sector it launched in December 2018.

Any of the laws and regulations that apply to our business are subject to revision or new or changed interpretations, and we cannot predict the impact of such changes on our business.

31 unchanged sentences

Some of these licenses contain requirements that we make available source code for modifications or derivative works we create based upon the open source software and that we license such modifications or derivative works under the terms of a particular open source license or other license granting third parties certain rights of further use.

terms of certain open source licenses, we could be required to release the source code of our proprietary software if we combine our proprietary software with open source software in a certain manner.

In addition to risks related to license requirements, usage of open source software can lead to greater risks than use of third-party commercial software, as open source licensors generally do not provide warranties or controls on origin of the software.

By the terms of certain open source licenses, we could be required to release the source code of our proprietary software if we combine our proprietary software with open source software in a certain manner.

In addition to risks related to license requirements, usage of open source software can lead to greater risks than use of third-party commercial software, as open source licensors

generally do not provide warranties or controls on origin of the software.

We have established processes to help alleviate these risks, including a review process for screening requests from our development organizations for the use of open source, but we cannot be sure that all open source is submitted for approval prior to use in our products.

2 unchanged sentences

There are risks associated with our outstanding and future indebtedness that could adversely affect our financial condition.

As of September 30, 2022, we had an aggregate of $10,207 million of outstanding indebtedness that will mature in calendar years 2022 through 2030, and $1,000 million available for borrowing under our revolving credit facility.

As of December 30, 2022, we had an aggregate of $10,207 million of outstanding indebtedness that will mature in calendar years 2022 through 2030, and $1,500 million available for borrowing under our revolving credit facility.

See Note 10 of the Notes to the Condensed Consolidated Financial Statements included in this Quarterly Report on Form 10-Q for further information on our outstanding debt.

25 unchanged sentences

GENERAL RISKS

The COVID-19 pandemic has affected how we are operating our business, and the duration and extent to which this will impact our future results of operations and overall financial performance remains uncertain.

The COVID-19 pandemic has had widespread, rapidly evolving, and unpredictable impacts on global society, economies, financial markets, and business practices.

At the onset of the pandemic, to protect the health and well-being of our employees, partners and third-party service providers, we facilitated a work-from-home requirement for most employees and established site-specific COVID-19 prevention protocols.

We continue to monitor the situation and over the past several months have adjusted our policies and protocols to reflect changes to public health regulations and guidance.

Our offices are now open to employees on a voluntary basis.

To date, we have not seen any meaningful negative impact on our customer success efforts, sales and marketing efforts, or employee productivity.

Nevertheless, as more employees, partners or third-party services providers return to work during the COVID-19 pandemic, the risk of inadvertent transmission of COVID-19 through human contact could still occur and result in litigation.

While the COVID-19 pandemic has negatively impacted many sectors of the U.S.

and global economies, the consumer Cyber Safety market experienced increased demand as the pandemic greatly accelerated the digital lives of people around the world.

However, with the extended duration of the pandemic and the easing of prevention protocols and restrictions, we are seeing decreasing demand and increased competition.

In addition, should the negative macroeconomic impacts of the COVID-19 pandemic persist or worsen, we may experience continued slowdowns in our business activity and an increase in cancellations by customers or a material reduction in our retention rate in the future, especially in the event of a prolonged recession.

A prolonged recession could adversely affect demand for our offerings, retention rates and harm our business and results of operations, particularly in light of the fact that our solutions are discretionary purchases and thus may be more susceptible to macroeconomic pressures, as well impact the value of our common stock, ability to refinance our debt and our access to capital.

The duration and extent of the impact from the COVID-19 pandemic depends on future developments that cannot be accurately forecasted at this time, such as the severity and transmission rate of new variants of the disease, the extent, effectiveness and acceptance of containment actions, such as vaccination programs, and the impact of these and other factors on our employees, customers and the overall demand for our products, partners and third-party service providers.

If we are not able to respond to and manage the impact of such events effectively and if the macroeconomic conditions of the general economy or the industries in which we operate do not improve, or deteriorate further, our business, operating results, financial condition and cash flows could be adversely affected.

Government efforts to combat inflation, along with other interest rate pressures arising from an inflationary economic environment, could lead to higher financing costs.

Inflation has risen on a global basis, the United States has been experiencing historically high levels of inflation, and government entities have taken various actions to combat inflation, such as raising interest rate benchmarks.

Government entities may continue their efforts, or implement additional efforts, to combat inflation, which could include among other things continuing to raise interest rate benchmarks or maintaining interest rate benchmarks at elevated levels.

Such government efforts, along with other interest rate pressures arising from an inflationary economic environment, could lead to higher financing costs and have material adverse effect on our business, financial condition and results of operations.

Government efforts to combat inflation, along with other interest rate pressures arising from an inflationary economic environment, have led to and may continue to lead to higher financing costs.

Inflation has risen on a global basis, including in the United States, and government entities have taken various actions to combat inflation, such as raising interest rate benchmarks.

Government entities may continue their efforts, or implement additional efforts, to combat inflation, which may include continuing to raise interest rate benchmarks or maintaining interest rate benchmarks at elevated levels.

Such government efforts, along with other interest rate pressures arising from an inflationary economic environment, have led to higher financing costs and have had and may continue to have a material adverse effect on our business, financial condition and results of operations.

Fluctuations in our quarterly financial results have affected the trading price of our outstanding securities in the past and could affect the trading price of our outstanding securities in the future.

23 unchanged sentences

Any of the foregoing factors could cause the trading price of our outstanding securities to fluctuate significantly.

While the COVID-19 pandemic has negatively impacted many sectors of the U.S.

and global economies, the consumer Cyber Safety market experienced increased demand as the pandemic greatly accelerated the digital lives of people around the world.

However, with the extended duration of the pandemic and the easing of prevention protocols and restrictions, we are seeing decreasing demand and increased competition.

A prolonged recession could adversely affect demand for our offerings, retention rates and harm our business and results of operations, particularly in light of the fact that our solutions are discretionary purchases and thus may be more susceptible to macroeconomic pressures, as well impact the value of our common stock, our ability to refinance our debt and our access to capital.

Changes to our effective tax rate could increase our income tax expense and reduce (increase) our net income (loss), cash flows and working capital.

We are a multinational company dual headquartered in the U.S.

and Czech Republic, subject to tax in multiple U.S.

and international tax jurisdictions.

Our effective tax rate could be adversely affected by several factors, many of which are outside of our control, including:

6 unchanged sentences

Pillar Two requires MNEs with an annual global turnover exceeding €750 million to pay a global minimum tax of 15%.

Additional guidance is expected to be published in 2022.

On December 12, 2022, the European Union reached an agreement to implement the Pillar Two Directive of the OECD’s reform of international taxation at the European Union level.

The agreement affirms that all Member States must transpose the Directive by December 31, 2023.

The rules will therefore first be applicable for fiscal years starting on or after December 31, 2023.

We will continue to monitor the implementation of the Inclusive Framework agreement by the countries in which we operate.

We are unable to predict if and how these legislative changes will be enacted into law, and it is possible that they could have a material effect on our corporate tax liability and our global effective tax rate;

We will continue to monitor and determine how these legislative changes will be enacted into law and how they will potentially impact our corporate tax liabilities.

It is possible that they could have a material effect on our corporate tax liability and our global effective tax rate;

• Changes in the relative proportions of revenues and income before taxes in the various jurisdictions in which we operate that have differing statutory tax rates;

6 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-Q

Item 1A. Risk Factors