What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2026-03-17 compared with 2025-03-21 · 210 added, 174 removed, 796 unchanged (33% of the section changed)

9 unchanged sentences

Our total number of Base Customers has gro wn to 10,682 as of January 31, 2026 from 9,893 as of January 31, 2025.

The growth and expansion of our business places a continuous significant strain on our management and operational and financial resources.

The growth and expansion of our business places a continuous strain on our management and operational and financial resources.

In addition, as customers adopt our products for an increasing number of use cases, we have had to support more complex commercial relationships.

To effectively manage and capitalize on our growth periods, we need to manage headcount capital and processes efficiently, while continuing to make investments to improve and expand our information technology and financial infrastructure, our security and compliance requirements, our operating and administrative systems, our relationships with various partners and other third parties.

Our rate of growth may also be impacted as a result of global business or macroeconomic conditions, including inflation, volatile interest rates, uncertainty with respect to the federal budget and debt ceiling and potential government shutdowns related thereto, volatility of the global debt and equity markets, and investment decisions by our customers.

Our rate of growth may also be impacted as a result of global business or macroeconomic conditions, including inflation, tariffs, volatile interest rates, uncertainty with respect to the federal budget, debt ceiling and potential government shutdowns, volatility of the global debt and equity markets, and investment decisions by our customers.

We may not be able to sustain the pace of improvements to our products successfully or implement systems, processes, and controls in an efficient or timely manner or in a manner that does not negatively affect our results of operations.

5 unchanged sentences

You should not rely on the revenue growth of any prior quarter or annual period as an indication of our future performance.

As a resu lt of our limited history operating as a public company, our ability to accurately forecast our future results of operations is limited

and subject to a number of uncertainties, including our ability to plan for and model future growth.

As a result of our limited history operating as a public company, our ability to accurately forecast our future results of operations is limited and subject to a number of uncertainties, including our ability to plan for and model future growth, and our

Table of Conte n t s

usage (or consumption) billing model.

Our historical revenue growth should not be considered indicative of our future performance.

Further, in future periods, our revenue could decline or our revenue growth rate could slow.

Many factors may contribute to this decline, including changes to technology, increased competition, slowing demand for The DevSecOps platform, the maturation of our business, a failure by us to continue capitalizing on growth opportunities, our failure, for any reason, to continue to take advantage of growth opportunities and a global economic downturn, among others.

Many factors may contribute to this decline, including changes to technology, such as increased AI adoption, our usage billing models, increased competition, slowing demand for The DevSecOps platform, the maturation of our business, a failure by us to continue capitalizing on growth opportunities, our failure, for any reason, to continue to take advantage of growth opportunities and a global economic downturn, among others.

If our growth rate declines, investors’ perceptions of our business and the market price of our Class A common stock could be adversely affected.

In addition, we expect to continue to responsibly expend financial and other resources to align with our:

• expansion and enablement of our sales, services, and marketing organization to increase brand awareness and drive adoption of The DevSecOps platform;

• product development, including investments in our product development team and the development of new features and functionality for The DevSecOps platform, including those related to artificial intelligence, or AI;

• expansion and enablement of our sales, services, and marketing organization to increase brand awareness and drive adoption of The DevSecOps platform;

• technology and sales channel partnerships;

4 unchanged sentences

If we are unable to maintain or increase our revenue at a rate sufficient to offset the expected increase in our costs, our business, financial position and results of operations will be harmed, and we may not be able to achieve or maintain profitability.

Our ability to forecast our future results of operations is subject to a number of uncertainties, including our ability to effectively plan for and model future growth.

Our ability to forecast our future results of operations is subject to a number of uncertainties, including our ability to effectively plan for and model future growth and our usage billing models.

We have encountered in the past, and may encounter in the future, risks and uncertainties frequently experienced by growing companies in rapidly changing industries.

6 unchanged sentences

While we have experienced significant growth in revenue in recent periods, we cannot assure you that we will achieve profitability in future periods or that, if at any time we are profitable, we will sustain profitability.

We also expect our operating and other expenses to increase in the foreseeable future as we continue to invest in our future growth, including expanding our research and development function to drive further development of The DevSecOps platform (including related to AI capabilities), expanding our sales and marketing activities, developing the functionality to expand into adjacent markets, and reaching customers

in new geographic locations, which will negatively affect our operating results if our total revenue does not increase.

We also expect our operating and other expenses to increase in the foreseeable future as we continue to invest in our future growth, including implementing usage billing, expanding our research and development function to drive further development of The DevSecOps platform (including related to AI capabilities), expanding our sales and marketing activities, developing the functionality to expand into adjacent

Table of Conte n t s

markets, and reaching customers in new geographic locations, which will negatively affect our operating results if our total revenue does not increase.

While we consistently evaluate opportunities to reduce our operating costs and optimize efficiencies, we cannot guarantee that these efforts will be successful or that we will not re-accelerate operating expenditures in the future in order to capitalize on growth opportunities.

1 unchanged sentence

These efforts and expenses may be more costly than we expect, and we cannot guarantee that we will be able to increase our revenue to offset our operating expenses.

Our revenue growth may slow or our revenue may decline for a number of reasons, including reduced demand for The DevSecOps platform, increased competition, an increased use of our free product offerings, a decrease in the growth or reduction in size of our overall market, or any inability on our part to capitalize on growth opportunities.

Our revenue growth may slow or our revenue may decline for a number of reasons, including reduced demand for The DevSecOps platform, increased competition, an increased use of our free product offerings, a decrease in the growth or reduction in size of our overall market, usage billing, or any inability on our part to capitalize on growth opportunities.

Further, as our SaaS offering makes up an increasing percentage of our total revenue, we expect to see increased associated cloud-related costs, such as hosting and infrastructure costs, which may adversely impact our gross margins.

13 unchanged sentences

In addition, any failure by our vendors to comply with applicable law or regulations could result in proceedings against us by governmental entities or others.

Security incidents of ours or our third-party service provider’s information technology systems that compromise the confidentiality, integrity, and availability of our data could result from AI related sensitive data exposure such as insufficient data anonymization during the training process, system misconfiguration, or from cyber attacks, including, but not limited to, denial-of-service attacks, reverse-engineering of AI algorithms, web scraping, ransomware attacks, business email compromises, computer

malware, viruses, and social engineering (including phishing), which are prevalent in our industry and our customers’ industries.

Any security breach or disruption could result in the loss or destruction of or unauthorized access to, or use, alteration, disclosure, or acquisition of confidential and/or personal data, which may result in damage to our reputation, early termination of our contracts, litigation, regulatory investigations, or other liabilities.

If our, our customers’, or our partners’ security measures are breached as a result of third-party action, team member error, misconfiguration, malfeasance (including bribery) or otherwise and, as a result, someone obtains unauthorized access to The DevSecOps platform, including personal and/or confidential information of our customers, our reputation could be damaged, our business may suffer loss of current customers and future opportunities and we could incur significant financial liability including fines, cost of recovery, and costs related to remediation measures.

Techniques used to obtain unauthorized access or to sabotage systems change frequently.

As a result, we may be unable to fully anticipate these techniques or to implement adequate preventative measures.

Security incidents of our or our third-party service provider’s information technology systems that compromise the confidentiality, integrity, and availability of our data could result in sensitive data exposure.

Cyber attacks may also occur, including, but not limited to, denial-of-service attacks, ransomware attacks, application security attacks, software-supply chain attacks, compromised credentials, business email compromises, computer malware, viruses, and social engineering (including

Table of Conte n t s

phishing), which are prevalent in our industry and our customers’ industries.

AI has shifted previously defined security boundaries for GitLab and our providers, including new and novel language-based attack vectors.

AI incorporated into our and our third-party service provider’s products may introduce security risks including, but not limited to, AI-enabled social engineering, automated vulnerability exploitation, inadvertent data exposure due to model training, inappropriate data access using AI-enabled features, and AI supply-chain attacks.

On the other hand, we could increase our vulnerability to cybersecurity incidents or other technology related failures due to, or as a result of, the timing of our evaluation, updating, or integration of new technology or AI enabled systems used in our business.

Any security breach, disruption or other technology related failure could result in the loss or destruction of or unauthorized access to, or use, alteration, disclosure, or acquisition of confidential and/or personal data, which may result in damage to our reputation, early termination of our contracts, litigation, regulatory investigations, or other liabilities.

If our, our customers’, or our partners’ security measures are breached as a result of third-party action, team member error, misconfiguration, malfeasance (including bribery) or otherwise and, as a result, someone obtains unauthorized access to The DevSecOps platform, including personal and/or confidential data of our customers, our reputation could be damaged, our business may suffer loss of current customers and future opportunities and we could incur significant financial liability including fines, cost of recovery, and costs related to remediation measures.

Techniques used to obtain unauthorized access or to sabotage systems change frequently, including novel AI-specific attack vectors and vulnerabilities.

The use of agentic AI is changing the fundamental ways that we secure and defend our platform and operations as both threat actors and security teams are using AI to industrialize their attacks.

Traditional perimeter controls and static security rules are no longer the most effective security mechanisms and we, in alignment with our industry, are reinforcing our defensive capabilities in areas such as, but not limited to, behavioral analysis, automated detection response, and zero-trust.

However, we may be unable to fully anticipate these techniques or implement adequate preventative measures.

If an actual or perceived security breach occurs, the market perception of our security measures could be harmed, and we could lose sales and customers.

2 unchanged sentences

Any significant violations of data privacy could result in the loss of business, litigation, and regulatory investigations and penalties that could damage our reputation and adversely impact our results of operations and financial condition.

Because code is executed on our infrastructure on behalf of customers and users, including open source projects hosted on GitLab, we face heightened security risks beyond those of standard SaaS providers.

Unlike platforms that primarily store and transmit data, we operate a platform on which code can be executed, which creates additional attack surface and potential for harm.

We have contractual and legal obligations to notify relevant stakeholders of security breaches.

5 unchanged sentences

A security breach could lead to claims by our customers, their end-users, or other relevant stakeholders that we have failed to comply with such legal or contractual obligations.

As a result, we could be subject to legal action or our customers could end their relationships with us.

As a result, we could be subject to legal action or our customers could end their relationships

Table of Conte n t s

There can be no assurance that any limitations of liability in our contracts would be enforceable or adequate or would otherwise protect us from liabilities or damages.

4 unchanged sentences

If a security breach were to occur, and the confidentiality, integrity, or availability of our data or the data of our partners, our customers or our customers’ end-users was disrupted, we could incur significant liability, or The DevSecOps platform, systems, or networks may be perceived as less desirable, which could negatively affect our business and damage our reputation.

If we fail to detect, contain, or remediate a security breach in a timely manner, or a breach otherwise affects a large amount of data of one or more customers, or if we suffer a cyber attack that impacts our ability to operate The DevSecOps platform, we may suffer material damage to our reputation, business,

financial condition, and results of operations.

Further, while we maintain cyber insurance that may provide coverage for these types of incidents, such coverage may not be adequate to cover the costs and other liabilities related to these incidents.

1 unchanged sentence

Our risks are likely to increase as we continue to expand The DevSecOps platform, grow our customer base, and host, process, store, and transmit increasingly large amounts of proprietary and confidential data.

We face heightened risk of security breaches because we use third-party open source technologies and incorporate a substantial amount of open source code in our products.

The DevSecOps platform is built using open-source technology.

We face heightened risk of security breaches because we use third-party open source technologies and incorporate a substantial amount of open source and community contributed code in our products.

The DevSecOps platform is built using open-source technology and GitLab accepted community code contributions.

Using or incorporating any third-party technology can become a vector for supply-chain cyber attacks.

9 unchanged sentences

We face competition in several areas due to the nature of our product.

Our product offering is broad across all stages of the software development lifecycle which has us competing with many providers with offerings across all stages.

We compete with well-established providers such as Microsoft and Atlassian as well as other companies with offerings in fewer stages, including with respect to both code hosting and code collaboration services, as well as file storage, distribution services, and AI.

Our product offering is broad across all stages of the software development lifecycle which means we compete with many providers with offerings across all stages.

We compete with well-established providers such as Microsoft and

Table of Conte n t s

Atlassian as well as other companies with offerings in fewer stages, including with respect to both code hosting and code collaboration services, as well as file storage, distribution services, and AI.

Competition in these markets may intensify further as advances in AI enable rapid, low-cost development of software applications.

We believe that our ability to compete depends upon many factors both within and beyond our control, including the following:

• the ability of our products or of those of our competitors to deliver the positive business outcomes prioritized and valued by our customers and prospects;

• our ability to price our products competitively, including our ability to transition users of our free product offering to a paid version of The DevSecOps platform;

• our ability to price our products competitively, including our usage billing model and our ability to transition users of our free product offering to a paid version of The DevSecOps platform;

• the timing and market acceptance of services, including the developments and enhancements to those services offered by us or our competitors, including incorporation of AI into such services;

17 unchanged sentences

These competitors may engage in more extensive research and development efforts, undertake more far-reaching marketing campaigns and adopt more aggressive pricing policies which may undercut our pricing policies and allow them to build a larger user base or to monetize that user base more effectively than us.

If our competitors’ products, platforms, services or technologies maintain or achieve greater market acceptance than ours, if they are successful in bringing their products or services to market earlier than ours, or if their products, platforms or services are more technologically capable than ours, then our revenues could be adversely affected.

If our competitors’ products,

Table of Conte n t s

platforms, services or technologies maintain or achieve greater market acceptance than ours, if they are successful in bringing their products or services to market earlier than ours, or if their products, platforms or services are more technologically capable than ours, then our revenues could be adversely affected.

In addition, some of our competitors may offer their products and services at a lower price or for free, or may offer a competing product with other services or products that together result in offering the competing product for free.

If we are unable to achieve our target pricing levels, our operating results would be negatively affected.

Pricing pressures and increased competition could result in reduced sales, reduced margins, losses or a failure to maintain or improve our competitive market position, any of which could adversely affect our business.

If we are unable to achieve our target pricing levels or successfully implement usage billing, our operating results would be negatively affected.

Pricing pressures, usage billing, and increased competition could result in reduced sales, reduced margins, losses or a failure to maintain or improve our competitive market position, any of which could adversely affect our business.

Many of our users extend the functionality of The DevSecOps platform using third-party code editors and integrated development environments, or IDEs, including editors and IDEs developed by our competitors.

3 unchanged sentences

The DevSecOps market is characterized by rapid technological change, fluctuating price points, and frequent new product and service introductions.

Our ability to increase our user base and increase

revenue from existing customers will depend heavily on our ability to enhance and improve our existing solutions, introduce new features and products, both independently and in conjunction with third-party developers and technology partners, reach new platforms and sell into new markets.

Our ability to increase our user base and increase revenue from existing customers will depend heavily on our ability to enhance and improve our existing solutions, introduce new features and products, both independently and in conjunction with third-party developers and technology partners, reach new platforms and sell into new markets.

Customers may require features and capabilities that our current solutions do not have.

11 unchanged sentences

• loss or delayed market acceptance and sales;

• loss of data;

Table of Conte n t s

• loss of customer data;

• breach of warranty claims;

9 unchanged sentences

The operation, success and growth of our business (whether now or in the future) depends on streamlined processes made available through information systems, global communications, internet activity, and other network processes.

The future operation, success and growth of our business depends

on streamlined processes made available through information systems, global communications, internet activity, and other network processes.

The future operation, success and growth of our business depends on streamlined processes made available through information systems, global communications, internet activity, and other network processes.

Our information technology systems may be subject to damage or interruption from telecommunications problems, data corruption, software errors, fire, flood, acts of terror and armed conflicts, global pandemics and natural disasters, power outages, systems disruptions, system conversions, and/or human error.

6 unchanged sentences

Furthermore, the availability or performance of our products could be adversely affected by a number of factors, including:

customers’ inability to access the internet, the failure of our network or software systems, security breaches, or variability in user traffic for our services.

customers’ inability to access the internet, customers’ inappropriate use of our software, the failure of our network or software systems, security breaches, or variability in user traffic for our services.

We may be required to issue credits or refunds for prepaid amounts related to unused services or otherwise be liable to our customers for damages they may incur resulting from certain events.

If a customer’s internet service provider fails to provide sufficient capacity to support our products, otherwise experiences service outages, interruption or disruption, or intentionally or unintentionally restricts or limits our ability to send, deliver, or receive electronic communications or provide services, such failure could interrupt our customers’ access to our products, adversely affect their perception of our products’ reliability and reduce our revenues.

In addition to potential liability, if we experience interruptions in the availability of our products or services, our reputation could be adversely affected and we could lose customers.

In addition to potential liability, if we experience interruptions in the availability of our products or services, our

Table of Conte n t s

reputation could be adversely affected and we could lose customers.

Our production systems might not be sufficiently resilient against regional outages and recovery from such an outage might take an extended period of time.

2 unchanged sentences

In addition, our policy may not cover all claims made against us and defending a suit, regardless of its merit, could be costly and divert management’s attention.

The market for our services is relatively new and rapidly evolving with uncertain growth expectations which would adversely affect our future results and the trading price of our Class A common stock.

Because the market for our services is relatively new and rapidly evolving, it is difficult to predict customer adoption, customer demand for our services, the size and growth rate of this market, the entry of competitive products or the success of existing competitive services.

The market for our services is rapidly evolving with uncertain growth expectations which would adversely affect our future results and the trading price of our Class A common stock.

Because the market for our services is rapidly evolving, it is difficult to predict customer adoption, customer demand for our services, the size and growth rate of this market, the entry of competitive products or the success of existing competitive services.

Any expansion or contraction in our market depends on a number of factors, including the cost, performance and perceived value associated with our services and the appetite and ability of customers to use and pay for the services we provide.

Further, even if the overall market for the type of services we provide continues to grow, we face intense competition from larger and more well-established providers and we may not be able to compete effectively or achieve market acceptance of our products.

If we or other software and SaaS providers

experience security incidents, loss of customer data, or disruptions in delivery or service, the market for these applications as a whole, including The DevSecOps platform and products, may be negatively affected.

If the market for our services does not achieve widespread adoption, we do not compete effectively in this market, or there is a reduction in demand for our software or our services in our market caused by a lack of customer acceptance, implementation challenges for deployment, technological challenges, lack of accessible data, competing technologies and services, decreases in corporate spending, including as a result of global business or macroeconomic conditions, including inflation, volatile interest rates, uncertainty with respect to the federal budget and debt ceiling and potential government shutdowns related thereto, volatility of the global debt and equity markets, actual or perceived instability in the global banking sector, or otherwise, it could result in reduced customer orders and decreased revenues, which could require slowing our rate of headcount growth and would adversely affect our business operations and financial results.

If we or other software and SaaS providers experience security incidents, loss of customer data, or disruptions in delivery or service, the market for these applications as a whole, including The DevSecOps platform and products, may be negatively affected.

If the market for our services does not achieve widespread adoption, we do not compete effectively in this market, or there is a reduction in demand for our software or our services in our market caused by a lack of customer acceptance, implementation challenges for deployment, technological challenges, lack of accessible data, competing technologies and services, decreases in corporate spending, including as a result of global business or macroeconomic conditions, including inflation, tariffs, volatile interest rates, uncertainty with respect to the federal budget, debt ceiling and potential government shutdowns, volatility of the global debt and equity markets, actual or perceived instability in the global banking sector, or otherwise, it could result in reduced customer orders and decreased revenues, which could require slowing our rate of headcount growth and would adversely affect our business operations and financial results.

We are dependent on sales and marketing strategies to drive our growth in our revenue.

5 unchanged sentences

As a result, we may not accurately predict future customer purchasing trends.

In future periods, our growth could slow or our profits could decline for several reasons, including decreased demand for our product offerings and our professional services, increased competition, a decrease in the growth of our overall market, a decrease in corporate spending, including as a result of global business or macroeconomic conditions, including inflation, volatile interest rates, uncertainty with respect to the federal budget and debt ceiling and potential government shutdowns related thereto, volatility of the global debt and equity markets, and actual or perceived instability in the global banking sector, or otherwise, or our failure, for any reason, to continue to capitalize on growth opportunities.

We may be forced to change or abandon our subscription based revenue model in order to compete with our competitors’ offerings.

It could also become increasingly difficult to predict revenue and timing of collections as our mix of annual, multi-year and other types of transactions changes as a result of our expansion into cloud-based offerings.

In future periods, our growth could slow or our profits could decline for several reasons, including decreased demand for our product offerings and our professional services, usage billing, increased competition, a decrease in the growth of our overall market, a decrease in corporate spending, including as a result of global business or macroeconomic conditions, including inflation, tariffs, volatile interest rates, uncertainty with respect to the federal budget, debt ceiling and potential government shutdowns, volatility of the global debt and equity markets, and actual or perceived instability in the global banking sector, or otherwise, or our failure, for any reason, to continue to capitalize on growth opportunities.

Table of Conte n t s

may be forced to change or abandon our subscription based revenue model in order to compete with our competitors’ offerings.

It could also become increasingly difficult to predict revenue and timing of collections given our usage billing model and our mix of annual, multi-year and other types of transactions changes as a result of our expansion into cloud-based offerings.

Our failure to execute on our revenue projections could impair our ability to meet our business objectives and adversely affect our results of operations and financial condition.

Our future success also depends in part on our ability to sell more subscriptions and additional services to our current customers.

Even if customers choose to renew their current subscriptions with us, they may decline to purchase additional services or they may choose to downtier or otherwise decrease the number of seats in their subscription.

Our future success also depends in part on our ability to increase usage or consumption, sell more subscriptions and additional services to our current customers.

If our customers do not purchase additional subscriptions and services from us, our revenue may decline and our operating results may be harmed.

1 unchanged sentence

We have limited historical data with respect to rates of paying customers buying more seats, uptiering, downtiering and churning, so we may not accurately predict future customer trends.

Our customer expansions and renewals may decline or fluctuate, and conversely, contractions and downtiers may increase, or fluctuate, as a result of a number of factors, including:

quality of our sales efforts, customer usage, customer satisfaction with our services and customer support, our prices

(including price increases we have implemented in the past, the prices of competing services, mergers and acquisitions affecting our customer base, the effects of global economic conditions, including inflation, volatile interest rates, uncertainty with respect to the federal budget and debt ceiling and potential government shutdowns related thereto and volatility of the global debt and equity markets, and actual or perceived instability in the global banking sector, or reductions in our customers’ spending levels generally (including, our customers that have or may have to downsize their operations or headcount).

Our customer expansions and renewals may decline or fluctuate, and conversely, contractions and down-tiers may increase, or fluctuate, as a result of a number of factors, including:

quality of our sales efforts, customer usage, customer satisfaction with our services and customer support, our prices (including price increases we have implemented in the past, the prices of competing services, mergers and acquisitions affecting our customer base, the effects of global economic conditions, including inflation, tariffs, volatile interest rates, uncertainty with respect to the federal budget, debt ceiling and potential government shutdowns and volatility of the global debt and equity markets, and actual or perceived instability in the global banking sector, or reductions in our customers’ spending levels generally (including, our customers that have or may have to downsize their operations or headcount).

If we cannot use our marketing strategies in a cost-effective manner or if we fail to promote our services efficiently and effectively, our ability to acquire new customers or expand the services of our existing customers may suffer.

8 unchanged sentences

Our quarterly or annual financial results may fluctuate as a result of several factors, many of which are outside of our control and may be difficult to predict, including:

Table of Conte n t s

• our ability to attract and retain new customers;

• the addition or loss of material customers, including through acquisitions or consolidations;

• the timing of recognition of revenues;

• the timing of recognition of revenues and impact of usage billing;

• the amount and timing of operating expenses related to the maintenance and expansion of our business, operations and infrastructure;

• general economic, industry and market conditions, in both domestic and our foreign markets, including inflation, volatile interest rates, uncertainty with respect to the federal budget and debt ceiling and potential government shutdowns related thereto and volatility of the global debt and equity markets, and actual or perceived instability in the global banking sector, the potential effects of health pandemics or epidemics and other global events, including the impacts of the U.S.

• general economic, industry and market conditions, in both domestic and our foreign markets, including inflation, tariffs, volatile interest rates, uncertainty with respect to the federal budget, debt ceiling and potential government shutdowns and volatility of the global debt and equity markets, and actual or perceived instability in the global banking sector, the potential effects of health pandemics or epidemics and other global events, including the impacts of the U.S.

presidential election and ongoing armed conflicts in different regions of the world;

15 unchanged sentences

• increases or decreases in our expenses caused by fluctuations in foreign currency exchange rates.

In addition, we experience seasonal fluctuations in our financial results as we typically receive a higher percentage of our annual orders from new customers, as well as renewal orders from existing customers, in our last two fiscal quarters as compared to the first two fiscal quarters due to the annual budget approval process of many of our customers, the timing of our customers’ decisions to make a purchase, changes our customers experienced, or may experience, in their businesses, and other variables some of which are outside of our and our customers’ control, such as macroeconomic and general economic conditions, including inflation and volatile interest rates.

Table of Conte n t s

variables some of which are outside of our and our customers’ control, such as macroeconomic and general economic conditions, including inflation, tariffs, and volatile interest rates.

Any of the above factors, individually or in the aggregate, may result in significant fluctuations in our financial and other operating results from period to period.

2 unchanged sentences

If we fail to meet such expectations for the reasons described above or any other reasons, our stock price could fall substantially.

As our product offerings mature and expand, our pricing and packaging for new products may result in existing customers purchasing new products on terms less favorable to us in order to replace the products they currently purchase or subscribe for from us.

As our product offerings mature and expand, our pricing and packaging for new and existing products may result in customers purchasing products on terms less favorable to us in order to replace the products they currently purchase or subscribe for from us.

As our product offerings and the markets for our services mature, or as new competitors introduce new products or services that are similar to or compete with ours, we may be unable to attract new customers at the same price or based on the same pricing model as we have used historically.

Moreover, some customers may demand greater price concessions or additional functionality at the same price levels.

As a result, in the future we may be required to reduce our prices or provide more features without corresponding increases in price, which could adversely affect our revenues, gross margin, profitability, financial position and cash flow.

Moreover, some customers may demand greater price concessions or additional functionality at the same price levels, and some customers may choose to adjust their usage rates due to our usage billing.

As a result, in the future we may be required to reduce our prices or adjust existing products or packaging, or provide more features without corresponding increases in price, which could adversely affect our revenues, gross margin, profitability, financial position and cash flow.

In addition, our customers have no obligation to renew their subscriptions for our services after the expiration of the initial subscription period.

1 unchanged sentence

Our customers may renew for fewer or other elements of our services or negotiate for different pricing terms.

Our customers’ renewal rates may decline or fluctuate as a result of a number of factors, including their

dissatisfaction with our pricing or our services, their ability to continue their operations and spending levels, and changes in other technology components used within the customer’s organization.

Our customers’ renewal rates may decline or fluctuate as a result of a number of factors, including their dissatisfaction with our pricing or our services, their ability to continue their operations and spending levels, and changes in other technology components used within the customer’s organization.

Changes in product packaging, pricing strategy, or product offerings, or the implementation or execution of the foregoing, may not be seen favorably by our customers and may have an adverse effect on our ability to retain our current customers and acquire new ones.

5 unchanged sentences

We have implemented AI capabilities throughout GitLab’s services, including as part of the GitLab Duo suite of AI features.

The technologies underpinning these features are in the early stages of commercial use and exist in a rapidly-evolving regulatory and commercial environment which presents regulatory, litigation, ethical, reputational, and financial risks.

Many states, regions, and supranational bodies have proposed or enacted regulations related to the use of AI and machine learning technologies, such as the E.U.

Artificial Intelligence Act, which came into effect on August 1, 2024.

These regulations may impose onerous obligations related to our, and our vendors’, development, offering, and use of AI technologies and expose us to an increased risk of regulatory enforcement and litigation.

The technologies underpinning these features exist in a rapidly-evolving regulatory and commercial environment which presents regulatory, litigation, ethical, reputational, and financial risks.

Many states, regions, and supranational bodies have proposed or enacted regulations related to the use of AI and machine learning technologies.

These regulations impose prescriptive obligations related to the development, offering, and use of AI technologies and expose us to an increased risk of regulatory enforcement and litigation.

Additionally, issues relating to intellectual property rights in AI-generated content have not been fully addressed by the courts, laws, or regulations and there has been an increase in litigation in this area.

Table of Conte n t s

Accordingly, the implementation of generative AI technologies into our services may result in exposure to claims related to copyright infringement or other intellectual property misappropriation.

Furthermore, many of our generative AI features involve the processing of personal data and may be subject to laws, policies, legal obligations, and codes of conduct related to privacy and data protection.

While there is current uncertainty about the extent to which privacy and data protection laws apply to AI technologies, any delay in addressing privacy or data protection concerns relating to our AI features may result in liability or regulatory investigations and fines, as well as damage to our sales and reputation.

Our generative AI features may also generate output that is misleading, insecure, inaccurate, harmful, or otherwise flawed, which may harm our reputation, business, or customers, or expose us to legal liability.

Furthermore, many of our AI features involve the processing of personal data and any processing of personal data is subject to comprehensive privacy and data protection laws, including the E.U.

General Data Protection Regulation, or the GDPR, and the California Consumer Privacy Act, or the CCPA.

Specific obligations under these regulations, such as requirements for lawful basis, data minimization, automated decision-making, and storage limitation, apply equally to personal data processed by the GitLab Duo suite of AI features.

Any difficulties in addressing privacy or data protection concerns relating to our AI features may result in liability or regulatory investigations and fines, as well as damage to our sales and reputation.

Our AI features may also generate output or perform actions, as applicable, that are misleading, insecure, inaccurate, harmful, or otherwise flawed, which may harm our reputation, business, or customers, or expose us to legal liability.

Some of our AI-powered features, including those offered through the GitLab Duo Agent Platform, are designed to automate elements of the software development lifecycle based on user-defined goals and context.

As the prevalence and scrutiny of such agentic AI systems increases, we may face regulatory, litigation, ethical, reputational, and financial risks.

We rely on third-party vendors for the provision of the AI models which power many of our AI features.

In the event those vendors encounter service disruption, materially and adversely change the terms on which they provide access to the models, or otherwise cease providing or change the basis on which they provide access to the models such that we can no longer obtain access, our ability to provide AI-powered features may be adversely affected.

In the event those vendors encounter service disruption, materially and adversely change the terms on which they provide access to the models, are subject to regulatory or other national security actions by governmental authorities, or otherwise cease providing or change the basis on which they provide access to the models such that we can no longer obtain access, our ability to provide AI-powered features may be adversely affected.

Any such events could also impact our customers’ ability to use GitLab features powered by specific third-party vendors’ AI models in certain deployment contexts.

Further, developing, testing, and offering AI-powered features may lead to greater than expected expenditures for our company because deploying AI systems involves high computing costs, which could adversely affect our gross margin, profitability, financial position, and cash flow.

9 unchanged sentences

We are also subject to Regulation FD, which imposes restrictions on the selective disclosure of material information to stockholders and other market participants, and other regulations.

While we have implemented internal controls to maintain compliance with Regulation FD, if as a result of our transparency, we disclose material information in a non-Regulation FD compliant matter, we may be subject to heightened regulatory and litigation risk.

The Handbook may not be up to date or accurate, which may result in negative third-party scrutiny or be used in ways that adversely affects our business.

While we have implemented internal controls to maintain compliance with Regulation FD, if as a result of our

Table of Conte n t s

transparency, we disclose material information in a non-Regulation FD compliant matter, we may be subject to heightened regulatory and litigation risk.

The publicly available GitLab Handbook, or Handbook, may not be up to date or accurate, which may result in negative third-party scrutiny or be used in ways that adversely affects our business.

Consistent with our commitment to our transparency and efficiency values, we maintain a publicly available company Handbook that contains important information about our operations and business practices.

10 unchanged sentences

Converting users of our free product offering may require increasingly sophisticated and costly sales efforts and may not result in additional sales.

In addition, the rate at which our end-customers purchase additional products and services depends on a number of factors, including the perceived need for additional products and services, the limitations on the number of users and limitations on storage and

transfers applicable to the free product offering as well as general economic conditions.

If our efforts to sell additional products and services to our end-customers are not successful, our business may suffer.

6 unchanged sentences

If we are unable to find efficient ways to deploy our marketing spend or to hire, develop, and retain talent required to maintain and support our growth, if our new sales talent are unable to achieve desired productivity levels in a reasonable period of time, or if our sales and marketing programs are not effective, our ability to increase our customer base and achieve broader market acceptance of our services could be harmed.

Any failure to offer high-quality technical support services, including success plan services, or adequately sell such services, may adversely affect our relationships with our customers and our financial results.

Any failure to offer high-quality technical support services, including success tiers, or adequately sell such services, may adversely affect our relationships with our customers and our financial results.

Once our products are deployed, our customers depend on our technical support organization to resolve technical issues.

We may be unable to respond quickly enough to accommodate short-term increases in customer demand for support services, and customers may not purchase the success plan services that we offer.

We may be unable to respond quickly enough to accommodate short-term

Table of Conte n t s

increases in customer demand for support services, and customers may not purchase the success tiers that we offer.

We also may be unable to modify the format of our support services to compete with changes in support services provided by our competitors.

8 unchanged sentences

Our industry is subject to rapid technological change, evolving industry standards and practices, and changing customer needs, requirements, and preferences.

achieve market acceptance or that keep pace with rapid technological developments and the competitive landscape.

The success of our business will depend, in part, on our ability to adapt and respond effectively to these changes on a timely basis, including our ability to timely provide enhancements and new features for our existing services or new services that achieve market acceptance or that keep pace with rapid technological developments and the competitive landscape.

The success of new services and enhancements depends on several factors, including the timely delivery, introduction, and market acceptance of such services.

8 unchanged sentences

We may not be successful in either developing these modifications and enhancements or in bringing them to market in a timely fashion.

Furthermore, uncertainties about the timing and nature of new network platforms or technologies, or modifications to existing platforms or technologies, could increase our research and development expenses.

Furthermore, uncertainties about the timing and nature of new network platforms or technologies, or modifications to

Table of Conte n t s

existing platforms or technologies, could increase our research and development expenses.

If we are unable to respond to these changes in a timely or cost-effective manner, our services may become less marketable and less competitive or obsolete, which may result in customer dissatisfaction, and adversely affect our business.

11 unchanged sentences

If we do not succeed in identifying suitable indirect sales channel partners, our business, operating results, and financial condition may be adversely affected.

We also cannot be certain that we will be able to maintain successful relationships with any channel partners and, to the extent that our channel partners are unsuccessful in selling our products, our ability to sell our products and our business, operating results, and financial condition could be adversely

Our channel partners may offer customers the products and services of several different companies, including products and services that compete with our products.

11 unchanged sentences

We calculate and track performance metrics with internal tools, which are not independently verified by any third party.

While we believe our metrics are reasonable estimates of our customer base for the applicable period of measurement, the methodologies used to measure these metrics require significant judgment and may be susceptible to algorithmic or other technical errors.

While we believe our metrics are reasonable estimates of our customer base for the applicable period of measurement, the methodologies used to measure these

Table of Conte n t s

metrics require significant judgment and may be susceptible to algorithmic or other technical errors.

For example, the accuracy and consistency of our performance metrics may be impacted by changes to internal assumptions regarding how we account for and track customers, limitations on system implementations, and limitations on the ability of third-party tools to match our database.

11 unchanged sentences

In either event, our development expenses could be increased, and our technology release and upgrade schedules could be delayed.

Delays in developing, completing, or delivering new or enhanced offerings

could cause our offerings to be less competitive, impair customer acceptance of our offerings and result in delayed or reduced revenue for our offerings.

Delays in developing, completing, or delivering new or enhanced offerings could cause our offerings to be less competitive, impair customer acceptance of our offerings and result in delayed or reduced revenue for our offerings.

Our failure or inability to protect our intellectual property rights, or claims by others that we are infringing upon or unlawfully using their intellectual property, could diminish the value of our brand and weaken our competitive position, and adversely affect our business, financial condition, operating results, and prospects.

6 unchanged sentences

Moreover, intellectual property protection may be unavailable or limited in some foreign countries where laws or law enforcement practices may not protect our intellectual property rights as fully as in the United States, and it may be more difficult for us to successfully challenge the use of our intellectual property rights by other parties in these countries.

Costly and time-consuming litigation could be necessary to enforce and determine the scope of our proprietary rights, and our failure or inability to obtain or maintain trade secret protection or otherwise protect our proprietary rights could adversely affect our business.

Costly and time-consuming litigation could be necessary to enforce and determine the scope of our proprietary rights, and our failure

Table of Conte n t s

or inability to obtain or maintain trade secret protection or otherwise protect our proprietary rights could adversely affect our business.

We may in the future be subject to intellectual property infringement claims and lawsuits in various jurisdictions, and although we are diligent in our efforts to protect our intellectual property we cannot be certain that our products or activities do not violate the patents, trademarks, or other intellectual property rights of third-party claimants.

19 unchanged sentences

Litigation is inherently unpredictable, and it is not possible to predict the outcome of any such lawsuits, individually or in the aggregate.

However, these lawsuits may consume substantial amounts of our financial and managerial resources and might result in adverse publicity, regardless of the ultimate outcome of the lawsuits.

However, these lawsuits may consume substantial amounts of our financial and managerial resources and might result in adverse publicity, regardless of the

Table of Conte n t s

ultimate outcome of the lawsuits.

In addition, we and our subsidiaries may become subject to similar lawsuits in the same or other jurisdictions.

2 unchanged sentences

Further, while we maintain insurance that may provide coverage for these types of lawsuits and other claims, such coverage may not be adequate to cover the related costs and other liabilities.

We have been and could in the future be subject to securities class action litigation and shareholder derivative suits.

Securities class action litigation, and ensuing shareholder derivative suits, are often instituted against companies following periods of volatility in the market price of a company’s securities.

See Part II, Item 1 of this Form 10-K for additional information regarding our legal proceedings.

Such suits may seek, as applicable, direct, indirect, consequential, punitive or other penalties or monetary damages, injunctive relief, and/or attorneys’ fees.

These types of litigation could result in substantial costs, adverse publicity, and a diversion of management’s attention and resources, which could adversely affect our business operating results, or financial condition.

Additionally, the cost of directors’ and officers’ liability insurance may increase, which may cause us to opt for lower overall policy limits or to forgo insurance that we may otherwise rely on to cover significant defense costs, settlements, and damages awarded to plaintiffs.

We may engage in merger and acquisition activities and joint ventures, which could require significant management attention, disrupt our business, dilute stockholder value, and adversely affect our operating results.

12 unchanged sentences

• integration of the acquired company’s accounting, management information, human resources and other administrative systems;

Table of Conte n t s

• the need to implement or improve controls, procedures and policies at a business that prior to the acquisition may have lacked sufficiently effective controls, procedures and policies;

14 unchanged sentences

The results of these estimates form the basis for making judgments about the carrying values of assets, liabilities, and equity, and the amount of revenue and expenses that are not readily apparent from other sources.

Significant assumptions and estimates used in

preparing our consolidated financial statements include those related to revenue recognition, allowance for doubtful accounts, deferred contract acquisition costs, income taxes, business combinations, and impairment of goodwill.

Significant assumptions and estimates used in preparing our consolidated financial statements include those related to revenue recognition, allowance for doubtful accounts, deferred contract acquisition costs, income taxes, impairment of goodwill and long-lived assets.

Our operating results may be adversely affected if our assumptions change or if actual circumstances differ from those in our assumptions, which could cause our operating results to fall below the expectations of securities analysts and investors, resulting in a decline in the price of our common stock.

2 unchanged sentences

New sales, use, value-added tax, digital service or other tax laws, statutes, rules, regulations or ordinances could be enacted at any time (possibly with retroactive effect), and could be applied solely or disproportionately to services provided over the internet.

If we are unsuccessful in collecting such taxes from our customers, we could be held liable for such costs, thereby adversely impacting our operating results and cash flows.

If we are unsuccessful in collecting such taxes from our customers, we could be held liable for such costs, thereby adversely impacting our operating

Table of Conte n t s

results and cash flows.

Moreover, we are subject to the examination of our sales, use, and value-added tax returns by U.S.

4 unchanged sentences

All web direct customers purchase our solution using online payment solutions such as credit cards, which represent the majority of the payment transactions we receive, and our business depends upon our ability to offer such payment options.

The termination of our ability to process payments on any material payment option would significantly impair our ability to operate our business and significantly increase our administrative costs related to customer payment processing.

The termination of our ability to process payments on any material payment solution would significantly impair our ability to operate our business and significantly increase our administrative costs related to customer payment processing.

If we fail to maintain our compliance with the data protection and documentation standards adopted by our payment processors and applicable to us, these processors could terminate their agreements with us, and we could lose our ability to offer our customers a credit card or other payment option.

If these processors increase their payment processing fees because we experience excessive chargebacks or refunds or for other reasons, it could adversely affect our business and operating results.

Increases in payment processing fees would increase our operating expense and adversely affect our operating results.

Increases in payment processing fees would increase our expense and adversely affect our operating results.

We process, store and use personal data and other data, which subjects us to governmental regulation and other legal obligations, including in the United States, the European Union, or the E.U., the United Kingdom, or the U.K., Canada, and Australia, related to privacy, and our actual or perceived failure to comply with such laws, regulations and contractual obligations could result in significant liability and reputational harm.

2 unchanged sentences

With respect to E.U.

team members, contractors and other personnel, as well as for our customers’ and prospective customers’ personal data, such as contact and business information, we are subject to the E.U.

General Data Protection Regulation, or the GDPR, and applicable national implementing legislation of the GDPR, and the U.K.

team members, contractors and other personnel, as well as for our customers’ and prospective customers’ personal data, such as contact and business information, we are subject to the GDPR and applicable national implementing legislation of the GDPR, and the U.K.

General Data Protection Regulation and U.K.

4 unchanged sentences

GDPR impose stringent data protection requirements and, where we are acting as a controller, includes requirements to:

provide detailed disclosures about how personal data is

collected and processed (in a concise, intelligible and easily accessible form);

provide detailed disclosures about how personal data is collected and processed (in a concise, intelligible and easily accessible form);

demonstrate that an appropriate legal basis is in place or otherwise exists to justify data processing activities;

9 unchanged sentences

As we are required to comply with both the GDPR and the U.K.

GDPR, we could be subject to parallel enforcement actions with respect to breaches of the GDPR or U.K.

GDPR, we could be subject to parallel enforcement actions with respect to

Table of Conte n t s

breaches of the GDPR or U.K.

GDPR which affects both E.U.

10 unchanged sentences

Data Privacy Framework, or the DPF, which permits certified U.S.-based organizations to receive transfers of personal data from the E.E.A.

and the U.K, has been subject to proposed legal challenges before the CJEU.

and the U.K, has previously been subject to proposed legal challenges before the CJEU.

Thus, the Standard Contractual Clauses remain an important data transfer mechanism for transfers to countries outside of the E.E.A.

6 unchanged sentences

to the United States, or impact the manner in which we provide our services, which could adversely affect our business.

In addition, if participation in the DPF is deemed appropriate, then we would be required to update documentation and processes, which may result in further compliance costs.

In addition, following the U.K.’s withdrawal from the E.U., the E.U.

issued an adequacy decision in June 2021 in favor of the U.K.

permitting data transfers from the E.U.

However, this adequacy decision is subject to a four-year term set to expire in 2025, and the E.U.

could intervene during the term if it determines that the data protection laws in the U.K.

are not sufficient.

If the adequacy decision is not renewed after its term, or the E.U.

intervenes during the term, data may not be able to flow freely from the E.U.

unless additional measures are taken.

In which case, we may be required to find alternative solutions for the compliant transfer of personal data into the U.K.

from the E.U.

As supervisory authorities continue to issue further guidance on personal data (including regarding data export and circumstances in which we cannot use the Standard Contractual Clauses), we could suffer additional costs, complaints, or regulatory investigations or fines, and if we are otherwise unable to transfer personal data between and among countries and regions in which we operate, it could affect the manner in which we provide our services, the geographical location or segregation of our relevant systems and operations, and could adversely affect our financial results.

Loss, retention or misuse of certain information and alleged violations of laws and regulations relating to privacy and data security, and any relevant claims, may expose us to potential liability and may require us to expend significant resources on data security and in responding to and defending such allegations and claims.

We are also subject to evolving E.U.

6 unchanged sentences

Regulation of cookies and similar technologies, and any decline of cookies or similar online tracking technologies as a means to identify and potentially target users, may lead to broader restrictions and impairments on our marketing and personalization activities and may negatively impact our efforts to understand users.

Table of Conte n t s

We depend on a number of third parties in relation to the operation of our business, a number of which process personal data on our behalf or as our sub-processor.

5 unchanged sentences

GDPR outlined above.

Additionally, we are subject to the California Consumer Privacy Act, or the CCPA, as expanded by the California Privacy Rights Act, or the CPRA, which increases privacy rights for California consumers and imposes obligations on companies that process their personal data.

The CCPA, among other things, requires covered companies to, among other things, provide new disclosures to California consumers and affords such consumers new privacy rights such as the ability to opt out of certain sales of personal data and expanded rights to access and deletion of their personal data, opt out of certain personal data sharing, and receive detailed information about how their personal data is collected, used and shared.

The CCPA provides for civil penalties for violations, as well as a private right of action for security

breaches that may increase the likelihood of, and the risks associated with, security breach litigation and the CPRA expanded consumers’ rights with respect to certain personal data and established a state agency to oversee implementation and enforcement efforts, potentially resulting in further uncertainty and requiring us to incur additional costs and expenses in an effort to comply.

Additionally, we are subject to the CCPA, as expanded by the California Privacy Rights Act, or the CPRA, which increases privacy rights for California consumers and imposes obligations on companies that process their personal data.

The CCPA requires covered companies to, among other things, provide new disclosures to California consumers and affords such consumers new privacy rights such as the ability to opt out of certain sales of personal data and expanded rights to access and deletion of their personal data, opt out of certain personal data sharing, and receive detailed information about how their personal data is collected, used and shared.

The CCPA provides for civil penalties for violations, as well as a private right of action for security breaches that may increase the likelihood of, and the risks associated with, security breach litigation and the CPRA expanded consumers’ rights with respect to certain personal data and established a state agency to oversee implementation and enforcement efforts, potentially resulting in further uncertainty and requiring us to incur additional costs and expenses in an effort to comply.

The CCPA has also prompted a number of passed laws and proposals for new federal and state privacy legislation that, if passed, could increase our potential liability and compliance costs, particularly in the event of a data breach, and adversely affect our business, including how we use personal data, our financial condition, and the results of our operations or prospects.

11 unchanged sentences

Despite our compliance efforts, we may become subject to claims that we have violated the PCI-DSS based on past, present, and future business practices.

Our actual or perceived failure to comply with the PCI-DSS can subject us to fines, termination of banking relationships, and increased transaction fees.

Our actual or perceived failure to comply

Table of Conte n t s

with the PCI-DSS can subject us to fines, termination of banking relationships, and increased transaction fees.

In addition, there is no guarantee that PCI-DSS compliance will prevent illegal or improper use of our payment systems or the theft, loss or misuse of payment card data or transaction information.

7 unchanged sentences

Any significant change to applicable laws, regulations or industry practices regarding the use or disclosure of our users’ data, or regarding the manner in which the express or implied consent of users for the use and disclosure of such data is obtained – or in how these applicable laws, regulations or industry practices are interpreted and enforced by state, federal and international privacy regulators – could require us to modify our services and features, possibly in a material manner, may subject us to regulatory enforcement actions and fines, and may limit our ability to develop new services and features that make use of the data that our users voluntarily share with us.

In addition to U.S.

and foreign privacy laws, we are subject to a variety of new and evolving legal and regulatory requirements related to data, content, content moderation, and safety, such as the EU Digital Services Act, or DSA, which imposes obligations on hosting service providers including requirements related to content moderation, transparency reporting, and user complaint mechanisms.

Similar platform regulations have been enacted in other jurisdictions, including the UK.

Compliance with the DSA and similar laws could subject us to increased compliance costs and operational requirements, and includes significant penalties for non-compliance of up to 6% of global annual turnover and provides for the ability of civil society organizations and non-governmental organizations to commence class action lawsuits.

The interpretation and enforcement of these requirements remain subject to uncertainty, and failure to comply could result in fines, enforcement actions, or limitations on our ability to operate in affected jurisdictions, which could adversely affect our business, financial condition, and results of operations.

We are subject to various governmental export controls, trade sanctions, and import laws and regulations that could impair our ability to compete in international markets or subject us to liability if we violate these controls.

3 unchanged sentences

For example, Trade Controls targeting Russia and Belarus, impose a license requirement for the export of our product to those countries, and have sanctioned various entities and individuals located there, while recent sanctions restrict the provision of certain cloud services to Russia.

Those Trade Controls are unprecedented and expansive, and may continue to evolve.

Those Trade Controls are unprecedented and expansive, and may

Table of Conte n t s

continue to evolve.

Further, our products incorporating encryption functionality may be subject to special controls applying to encryption items and/or certain reporting requirements.

22 unchanged sentences

As we increase our international sales and business, our risks under these laws may increase.

Table of Conte n t s

Any allegations or actual violation of the FCPA or other applicable anti-bribery, anti-corruption laws, and anti-money laundering laws could result in whistleblower complaints, sanctions, settlements, prosecution, enforcement actions, fines, damages, adverse media coverage, investigations, loss of export privileges, severe criminal or civil sanctions, or suspension or debarment from U.S.

19 unchanged sentences

Additionally, any actual or perceived privacy, data protection, or data security incident, or even any perceived defect with regard to our practices or measures in these areas, may negatively impact public sector demand for our products.

federal government and other government entities are in the

process of implementing specific policies and obligations relating to the use of AI, and we will need to continue to monitor these developments to ensure our products that we sell to government entities remain compliant with such applicable regulations.

federal government and other government entities are in the process of implementing specific policies and obligations relating to the use of AI, and we will need to continue to monitor these developments to ensure our products that we sell to government entities remain compliant with such applicable regulations.

Additionally, we rely on certain partners to provide technical support services to certain of our government entity customers to resolve any issues relating to our products.

2 unchanged sentences

Governments routinely investigate and audit government contractors’ administrative processes, and any unfavorable audit could result in the government refusing to continue buying our subscriptions, a reduction of revenue, or fines or civil or criminal liability if the audit uncovers improper or illegal activities, which could adversely affect our results of operations in a material way.

Our success depends on our ability to provide users of our products and services with access to an abundance of useful, efficient, high-quality code which in turn depends on the quality and volume of code contributed by our open source contributors.

We believe that one of our competitive advantages is the quality, quantity and collaborative nature of the code on GitLab, and that access to open source code is one of the main reasons users visit GitLab.

Table of Conte n t s

One of our competitive advantages is our ability to provide users of our products and services with access to an abundance of useful, efficient, high-quality code which in turn depends on the quality and volume of code contributed by our open source contributors.

We believe that one of our competitive advantages is the quality, quantity and collaborative nature of the code on GitLab, and that access to open source code is an important reason why users visit GitLab.

In furtherance of the foregoing competitive advantages and access, we seek to foster a broad and engaged contributor community, and we encourage individuals, companies, governments, and institutions to use our products and services to learn, code and work.

1 unchanged sentence

Additionally, if we are not able to address user concerns regarding the safety and security of our products and services or if we are unable to successfully prevent abusive or other hostile behavior on The DevSecOps platform, the size of our customer base and contributor engagement may decline.

If there is a decline in the number of contributors, customer or contributor growth rate or engagement, including as a result of the loss of influential contributors and companies who provide innovative code on GitLab, paying customers of our online services may be deterred from using our products or services or reduce their spending with us or cease doing business with us, which would harm our business and operating results.

If there is a decline in the number of contributors, customer or contributor growth rate or engagement, including as a result of the loss of influential contributors and companies who provide innovative code on GitLab, or due to the increased adoption of AI, paying customers of our online services may be deterred from using our products or services or reduce their spending with us or cease doing business with us, which would harm our business and operating results.

Seasonality may cause fluctuations in our sales and results of operations.

Historically, we have experienced seasonality in new customer contracts, as we typically enter into a higher percentage of subscription agreements with new customers and renewals with existing customers in the last two fiscal quarters of each year.

We believe that this results from the procurement, budgeting, and deployment cycles of many of our customers, particularly our enterprise customers, along with variables outside of our and our customers’ control, such as macroeconomic and general economic conditions, including inflation, volatile interest rates, uncertainty with respect to the federal budget and debt ceiling and potential government shutdowns related thereto, and volatility of the global debt and equity markets, and actual or perceived instability in the global banking sector.

We believe that this results from the procurement, budgeting, and deployment cycles of many of our customers, particularly our enterprise customers, along with variables outside of our and our customers’ control, such as macroeconomic and general economic conditions, including inflation, tariffs, volatile interest rates, uncertainty with respect to the federal budget, debt ceiling and potential government shutdowns, and volatility of the global debt and equity markets, and actual or perceived instability in the global banking sector.

We expect that this seasonality, which can itself at times be unpredictable, will continue to affect our bookings, deferred revenue, and our results of operations in the future and might become more pronounced as we continue to target larger enterprise customers.

1 unchanged sentence

Further, we recognize a significant portion of our subscription revenue over the term of the relevant subscription period.

As a result, much of the subscription revenue we report each fiscal

quarter is the recognition of deferred revenue from subscription contracts entered into during previous fiscal quarters.

As a result, much of the subscription revenue we report each fiscal quarter is the recognition of deferred revenue from subscription contracts entered into during previous fiscal quarters.

Consequently, a decline in new or renewed subscriptions in any one fiscal quarter will not be fully or immediately reflected in revenue in that fiscal quarter and will negatively affect our revenue in future fiscal quarters.

3 unchanged sentences

The length of our sales cycle, from initial contact from a prospective customer to contractually committing to our paid subscriptions can vary substantially from customer to customer based on deal complexity as well as whether a sale is made directly by us.

It is difficult to predict exactly when, or even if, we will make a sale to a potential customer or if we can increase sales to our existing customers, the timing of our customers’ decisions to make a purchase, greater deal scrutiny by our customers, changes our customers experienced, or may experience, in their businesses, and other variables some of which are outside of our and our customers’ control, such as macroeconomic and general economic conditions, including inflation, volatile interest rates, uncertainty with respect to the federal budget and debt ceiling and potential government shutdowns related thereto, and volatility of the global debt and equity markets, and actual or perceived instability in the global banking sector.

Table of Conte n t s

including inflation, tariffs, volatile interest rates, uncertainty with respect to the federal budget, debt ceiling and potential government shutdowns, and volatility of the global debt and equity markets, and actual or perceived instability in the global banking sector.

Our results of operations depend in part on sales to new large customers and increasing sales to existing customers.

5 unchanged sentences

The loss of key personnel, including key members of our management team, as well as certain of our key marketing, sales, finance, support, product development, human resources, or technology personnel, could disrupt our operations and have an adverse effect on our ability to grow our business.

On December 5, 2024, Sytse Sijbrandij, our co-founder, resigned from his position as our Chief Executive Officer.

In connection with his resignation, Mr.

Sijbrandij was appointed as the Executive Chair of our board of directors.

On December 5, 2024, we also announced that William Staples had been appointed as our Chief Executive Officer.

While we conducted this transition in an orderly manner, any change in the leadership of the company is a significant event and may result in additional volatility in our stock price and could disrupt our operations and have an adverse effect on our ability to grow our business.

Competition for highly skilled personnel in our industry is intense, and we may not be successful in hiring or retaining qualified personnel to fulfill our current or future needs.

2 unchanged sentences

Further, many of the companies with which we compete for experienced personnel have greater resources than we have.

Our competitors also may be successful in recruiting and hiring members of our

management team or other key team members, and it may be difficult for us to find suitable replacements on a timely basis, on competitive terms, or at all.

Our competitors also may be successful in recruiting and hiring members of our management team or other key team members, and it may be difficult for us to find suitable replacements on a timely basis, on competitive terms, or at all.

We have in the past, and may in the future, be subject to allegations that team members we hire have been improperly solicited, or that they have divulged proprietary or other confidential information or that their former employers own such team member’s inventions or other work product, or that they have been hired in violation of non-compete provisions or non-solicitation provisions.

5 unchanged sentences

If we do not continue to develop our corporate culture as we grow and evolve, it could harm our ability to foster the innovation, creativity, and teamwork that we believe is important to support our growth.

As our organization grows and we are required to implement more complex organizational structures, we may find it increasingly difficult to maintain the beneficial aspects of our corporate culture, which could negatively impact our future success.

As our organization grows and we are required to implement more complex organizational structures, we

Table of Conte n t s

may find it increasingly difficult to maintain the beneficial aspects of our corporate culture, which could negatively impact our future success.

We engage our team members in various ways, including direct hires, through PEOs and as independent contractors.

20 unchanged sentences

If we are unable to hire and train a sufficient number of effective sales personnel, or the sales personnel we hire are not successful in obtaining new customers or increasing sales to our existing customer base, our business, operating results, and financial condition will be adversely affected.

Table of Conte n t s

We are a remote-only company, meaning that our team members work remotely which poses a number of risks and challenges that can affect our business, operating results, and financial condition.

12 unchanged sentences

Our customers, partners, team members, contributors or the public at large may, from time to time, disagree with, or find objectionable, our policies and practices or organizational decisions that we make or with the actions of members of our management team.

As a result of these disagreements and any

negative publicity associated therewith, we could lose customers or partners, or we may have difficulty attracting or retaining team members or contributors and such disagreements may divert resources and the time and attention of management from our business.

As a result of these disagreements and any negative publicity associated therewith, we could lose customers or partners, or we may have difficulty attracting or retaining team members or contributors and such disagreements may divert resources and the time and attention of management from our business.

Our culture of transparency may also result in customers, partners, team members, contributors or the public at large having greater insight into our policies and practices or organizational decisions.

3 unchanged sentences

We plan to expand our operations internationally in the future.

Outside of the United States, we currently have direct and indirect subsidiaries in Canada, Germany, France, Ireland, Israel, the Netherlands, Spain, the United Kingdom, Australia, India, Japan, South Korea, and Singapore, and have team members in over 60 countries.

Outside of the United States, we currently have direct and indirect subsidiaries in Canada, Germany, France, India, Ireland, Israel, the Netherlands, Spain, the United Kingdom, Australia, India, Japan, South Korea, and Singapore, and have team members in over 60 countries.

We also have a joint venture in China.

1 unchanged sentence

• establishing and maintaining effective controls at foreign locations and the associated increased costs;

Table of Conte n t s

• adapting our technologies, products, and services to non-U.S.

24 unchanged sentences

Our participation in this joint venture in China is subject to general, as well as industry-specific, economic, political, tax, and legal developments and risks in China.

The Chinese government exercises significant control over the Chinese economy, including but not limited to controlling capital investments, allocating resources, setting monetary policy, controlling and monitoring foreign exchange rates, implementing and overseeing tax regulations, providing preferential treatment to certain industry segments or companies and issuing necessary licenses to conduct business.

Table of Conte n t s

implementing and overseeing tax regulations, providing preferential treatment to certain industry segments or companies and issuing necessary licenses to conduct business.

In addition, we could face additional risks resulting from changes in China’s data privacy and cybersecurity requirements, including China’s adoption of the Personal Information Protection Law, or PIPL, which went into effect on November 1, 2021.

15 unchanged sentences

GAAP, we currently consolidate the joint venture’s financials within our own and rely on the joint venture’s management for accurate and timely delivery of the joint venture’s financials.

Therefore, we face reputational and brand

risk as a result of any negative publicity faced by the joint venture entity.

Therefore, we face reputational and brand risk as a result of any negative publicity faced by the joint venture entity.

Any such reputational and brand risk can harm our business and operating results.

9 unchanged sentences

Failure to maintain effective systems of internal controls and disclosure controls could have a material adverse effect on our business, operating results, and financial condition.

Table of Conte n t s

As a public company, we are subject to the reporting requirements of the Exchange Act, the Sarbanes-Oxley Act, and the rules and regulations of the applicable listing standards of the Nasdaq Global Select Market.

1 unchanged sentence

In order to maintain and improve the effectiveness of our ICFR and DC&P, we have expended, and anticipate that we will continue to expend, significant resources, including accounting related costs and significant management oversight.

As disclosed in our previously issued Annual Report on Form 10-K for the year ended January 31, 2024 , we had identified a material weakness in our ICFR.

A material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of our annual or interim financial statements will not be prevented or detected on a timely basis.

During fiscal year 2024, we determined that a material weakness exists due to a lack of policies and procedures related to the operation of control activities and inadequate communication of information to control owners and operators related to the objectives and responsibilities for internal control in a manner which supports the internal control environment at the company.

In particular:

• We did not design and maintain effective controls over certain information technology (“IT”) general controls for information systems used in the financial reporting processes related to revenue.

In particular, we did not design and maintain effective (i) program change management controls to ensure that IT programs, data changes and migrations affecting financial IT applications and underlying records are identified, tested, authorized and implemented appropriately and (ii) user access controls to ensure appropriate segregation of duties, restricted user and privileged access to our financial applications, data and programs to the appropriate personnel.

The ineffective design and operation of IT general controls resulted in the ineffective operation of automated controls and manual controls using reports and information from the impacted information systems used in the financial reporting processes related to revenue.

We have remediated this material weakness during fiscal year 2025 through implemented actions that enhanced our control environment.

Our independent registered public accounting firm, KPMG LLP, who audited the consolidated financial statements included in this Annual Report on Form 10-K, has issued an unqualified opinion on the effectiveness of the Company’s ICFR as of January 31, 2025 .

Maintaining effective ICFR and DC&P requires ongoing attention and resources.

Our current controls may become inadequate because of changes in conditions in our business, personnel, IT systems and applications, or other factors.

If we identify additional material weaknesses or fail to maintain effective controls, it could adversely affect our operating results, cause us to fail to meet our reporting obligations, result in a restatement of our financial statements, or adversely affect the results of periodic management evaluations and annual independent registered public accounting firm attestation reports.

If we identify material weaknesses or fail to maintain effective controls, it could adversely affect our operating results, cause us to fail to meet our reporting obligations, result in a restatement of our financial statements, or adversely affect the results of periodic management evaluations and annual independent registered public accounting firm attestation reports.

As a public company that is a large accelerated filer, our independent registered public accounting firm is required to provide an annual attestation report on the effectiveness of our ICFR, which has required, and will continue to require, increased costs, expenses, and management resources.

14 unchanged sentences

If we need to engage in such additional equity or debt financings, we may not be able to raise needed cash on terms acceptable to us or at all.

Financing may be on terms that are dilutive or potentially dilutive to our stockholders, and the prices at which new investors would be willing to purchase our securities may be significantly lower than the current price per share of our Class A common stock.

Financing may be on terms that are dilutive or potentially dilutive to our stockholders, and

Table of Conte n t s

the prices at which new investors would be willing to purchase our securities may be significantly lower than the current price per share of our Class A common stock.

The holders of new debt or equity securities may also have rights, preferences, or privileges that are senior to those of existing holders of our common stock.

If new sources of financing are required, but are insufficient or unavailable, we will be

required to modify our growth and operating plans based on available funding, if any, which would harm our ability to grow our business.

If new sources of financing are required, but are insufficient or unavailable, we will be required to modify our growth and operating plans based on available funding, if any, which would harm our ability to grow our business.

If we raise additional funds through equity or convertible debt issuances, our existing stockholders may suffer significant dilution and these securities could have rights, preferences, and privileges that are superior to those of holders of our common stock.

1 unchanged sentence

Such terms may involve restrictive covenants making it difficult to engage in capital raising activities and pursue business opportunities, including potential acquisitions.

The trading prices of technology companies have been highly volatile as a result of recent global events, including volatile interest rates and inflation and the ongoing armed conflicts in different regions of the world, which may reduce our ability to access capital on favorable terms or at all.

The trading prices of technology companies have been highly volatile as a result of recent global events, including volatile interest rates, inflation, tariffs and the ongoing armed conflicts in different regions of the world, which may reduce our ability to access capital on favorable terms or at all.

In addition, a sustained adverse market event resulting from such global events could adversely affect our business and the value of our Class A common stock.

6 unchanged sentences

In the current global tax policy environment, any changes in laws, regulations, guidance and/or interpretations related to these assertions could adversely affect our effective tax rates, cause us to respond by making changes to our business structure, or result in other costs to us which could adversely affect our operations and financial results.

In December 2017, the U.S.

federal government enacted the tax reform legislation known as the Tax Cuts and Jobs Act, or the 2017 Tax Act.

The 2017 Tax Act significantly changed the existing U.S.

corporate income tax laws by, among other things, lowering the U.S.

corporate tax rate, implementing a partially territorial tax system, and imposing a one-time deemed repatriation tax on certain post-1986 foreign earnings.

Recently the U.S.

Treasury Department issued regulations for the purpose of interpreting the 2017 Tax Act, including regulations disallowing foreign tax credits for taxes which are dissimilar to income taxes, limiting the deductibility of interest, and requiring the capitalization of research and development expenses.

Due to the reconciliation process used to pass the 2017 Tax Act, many provisions are in the process of being phased out, and it is uncertain whether many of the provisions in the 2017 Tax Act will be restored.

The Inflation Reduction Act of 2022, enacted on August 16, 2022, further amended the U.S.

federal tax code, imposing a 15% minimum tax on “adjusted financial statement income” of certain corporations as well as an excise tax on the repurchase or redemption of stock by certain corporations, beginning in the 2023 tax year.

Over the last several years, the Organization for Economic Cooperation and Development, or the OECD, has been working on a Base Erosion and Profit Shifting project that, if implemented, would change various aspects of the existing framework under which our tax obligations are determined in many of the countries in which we do business.

The OECD has a framework to implement a global minimum corporate tax of 15% for companies with global revenues and profits above certain thresholds (referred to as Pillar 2), with certain aspects of Pillar 2 effective January 1, 2024 and other aspects effective January

While it is uncertain whether the United States will enact legislation to adopt Pillar 2, certain countries in which we operate have adopted legislation.

On December 15, 2022, the European Union member states agreed to implement the OECD’s global minimum tax rate of 15%.

In July 2025, the U.S.

federal government enacted the One Big Beautiful Bill Act, or OBBBA, implementing significant corporate tax reforms.

OBBBA provides immediate deductibility for domestic research and experimental expenses for tax years beginning after December 31, 2024, with elections available to accelerate deductions for previously capitalized research and experimental expenses from 2022 through 2024.

Corporations may deduct remaining unamortized amounts either fully in their first taxable year beginning after December 31, 2024, or ratably over two years.

OBBBA increased the tax rate associated with international operations and reduced the tax benefit associated with certain foreign-derived deduction eligible income of United States-domiciled corporations.

OBBBA also increased the Base Erosion and Anti-Abuse Tax rate associated with payments from United States corporations to foreign subsidiaries treated as Controlled Foreign Corporations.

The Treasury Department is expected to issue extensive guidance addressing implementation and transition rules.

From time to time, the United States Congress may enact technical corrections to OBBBA.

The outcome of such guidance and technical corrections and their impact on us is uncertain at this time.

Table of Conte n t s

The Organization for Economic Cooperation and Development, or the OECD, implemented a model treaty framework which includes a global minimum corporate tax of 15% for companies with global revenues and profits above certain thresholds (referred to as Pillar 2), with certain aspects of Pillar 2 effective January 1, 2024 and other aspects effective January 1, 2025.

While the United States has withdrawn support for Pillar 2, certain countries in which we operate have adopted legislation.

As of the filing of this Form 10-K, over 60 countries have enacted or drafted legislation to adopt a minimum “Top Up” tax which allows international jurisdictions to tax their domestic income if the worldwide tax on such income is less than a minimum threshold.

While the OECD has recommended that the worldwide system of taxation implemented by the United States is compliant under its framework, certain OECD member countries may implement laws which nevertheless impose top-up taxes.

Similarly, the European Union and several countries have issued proposals that would apply to various aspects of the current tax framework under which we are taxed.

These proposals include changes to the existing framework to calculate income tax, as well as proposals to change or impose new types of non-income taxes, including taxes based on a percentage of revenue.

These include proposals to change or impose new types of non-income taxes, including taxes based on a percentage of revenue.

For example, several jurisdictions have proposed or enacted taxes applicable to digital services, which include business activities on digital advertising and online marketplaces, and which apply to our business.

7 unchanged sentences

Our existing corporate structure has been implemented in a manner we believe is in compliance with current tax laws.

However, the taxing authorities of the jurisdictions in which we operate may challenge our methodologies, including for valuing developed technology or intercompany arrangements, which could impact our worldwide effective tax rate and adversely affect our financial condition and results of operations, possibly with retroactive effect.

However, the taxing authorities of the jurisdictions in which we operate may challenge our methodologies, including for valuing developed technology or classifying the nature of intercompany arrangements, which could impact our worldwide effective tax rate and adversely affect our financial condition and results of operations, possibly with retroactive effect.

Moreover, changes to our corporate structure could impact our worldwide effective tax rate and adversely affect our financial condition and results of operations.

9 unchanged sentences

The relevant taxing authorities may disagree with our determinations as to the income and expenses attributable to specific jurisdictions.

If such a disagreement were to occur, and our position was not sustained, we could be required to pay additional taxes, interest and penalties, which could result in one-time tax charges, higher effective tax rates, reduced cash flows and lower overall profitability of our business, with some changes possibly affecting our tax obligations in future or past years.

If such a disagreement were to occur, and our position was not sustained, we could be required to pay additional taxes, interest

Table of Conte n t s

and penalties, which could result in one-time tax charges, higher effective tax rates, reduced cash flows and lower overall profitability of our business, with some changes possibly affecting our tax obligations in future or past years.

We regularly assess the likelihood of outcomes resulting from possible examinations to determine the adequacy of our provision for income taxes and have reserved for potential adjustments that may result from these examinations.

20 unchanged sentences

• litigation involving us, our industry or both, or investigations by regulators into our operations or those of our competitors;

Table of Conte n t s

• developments or disputes concerning our intellectual property rights or our solutions, or third-party proprietary rights;

4 unchanged sentences

• effects of public health crises, pandemics, and epidemics;

• general economic conditions, changes in the capital markets generally, inflation, and slow or negative growth of our markets and instability in the global banking sector;

• general economic conditions, changes in the capital markets generally, inflation, tariffs, and slow or negative growth of our markets and instability in the global banking sector;

• other events or factors, including those resulting from political instability, regulatory uncertainty, war, incidents of terrorism or responses to these events, including those related to the ongoing armed conflicts in different regions of the world.

8 unchanged sentences

We may also issue our shares of our capital stock or securities convertible into shares of our capital stock from time to time in connection with a financing, acquisition, investment, or otherwise.

We cannot guarantee that our stock repurchase program will be fully consummated or that it will preserve or enhance long-term stockholder value.

Although our Board has authorized a stock repurchase program, the program does not require us to repurchase any specific dollar amount or to acquire any specific number of shares of our Class A common stock and may be modified, suspended, or terminated at any time.

We cannot guarantee that the program will be fully consummated or that it will preserve or enhance long-term stockholder value.

Any failure to repurchase stock after we have announced our intention to do so may negatively impact our reputation, investor confidence in us, or our stock price.

The program could also affect the trading price of

Table of Conte n t s

our Class A common stock, increase volatility, and reduce the market liquidity of our Class A common stock, and any announcement of a termination or change of this program may result in a decrease in the trading price of our Class A common stock.

In addition, any repurchases made under this program will reduce the amount of cash we have available to fund working capital, capital expenditures, strategic transactions, and other general corporate requirements.

The dual class structure of our common stock will have the effect of concentrating voting control with those stockholders who hold our Class B capital stock, including our directors, executive officers, and beneficial owners of 5% or greater of our outstanding capital stock who hold in the aggregate a majority of the voting power of our capital stock, which will limit or preclude your ability to influence corporate matters, including the election of directors and the approval of any change of control transaction.

1 unchanged sentence

As of January 31, 2026, the holders of our outstanding Class B common stock hold a substantial majority of the voting power of our outstanding capital stock, with our directors, executive officers, and holders of more than 5% of our common stock, and their respective affiliates, holding a majority of the voting power of our capital stock.

by a vote of the holders of two-thirds of the then outstanding shares of Class B common stock and (iv) the first date on which the number of shares of outstanding Class B common stock (including shares of Class B common stock subject to outstanding stock options) is less than 5% of the aggregate number of shares of outstanding common stock.

Because of the ten-to-one voting ratio between our Class B and Class A common stock, the holders of our Class B common stock collectively will continue to control a majority of the combined voting power of our common stock and therefore will be able to control all matters submitted to our stockholders for approval until the earlier of (i) October 14, 2031, (ii) the death or disability, as defined in our restated certificate of incorporation, of Sytse Sijbrandij, (iii) the date specified by a vote of the holders of two-thirds of the then outstanding shares of Class B common stock and (iv) the first date on which the number of shares of outstanding Class B common stock (including shares of Class B common stock subject to outstanding stock options) is less than 5% of the aggregate number of shares of outstanding common stock.

This concentrated control will limit or preclude your ability to influence corporate matters for the foreseeable future, including the election of directors, amendments of our organizational documents, and any merger, consolidation, sale of all or substantially all of our assets, or other major corporate transaction requiring stockholder approval.

8 unchanged sentences

The trading market for our Class A common stock will depend in part on the research and reports that industry or financial analysts publish about us or our business.

We do not control these analysts or the content and opinions included in their reports.

We do not control these analysts or the

Table of Conte n t s

content and opinions included in their reports.

If any of the analysts who cover us issues an inaccurate or unfavorable opinion regarding our stock price, our stock price may decline.

19 unchanged sentences

• provide for a dual class common stock structure in which holders of our Class B common stock may have the ability to control the outcome of matters requiring stockholder approval, even if they own significantly less than a majority of the outstanding shares of our common stock, including the election of directors and other significant corporate transactions, such as a merger or other sale of our company or its assets;

Table of Conte n t s

• prohibit stockholder action by written consent, which requires all stockholder actions to be taken at a meeting of our stockholders;

16 unchanged sentences

Alternatively, if a court were to find the choice of forum provisions contained in our restated certificate of incorporation or amended and restated bylaws to be inapplicable or unenforceable in an action, we may incur additional costs associated with resolving such action in other jurisdictions, which could harm our business, financial condition, and operating results.

Table of Conte n t s

General Risk Factors

7 unchanged sentences

our demand generation activities, and the efficiency and effect of those activities, may be negatively affected.

Recent macroeconomic conditions, including inflation and volatile interest rates, have, and may continue to, put pressure on overall spending for our products and services, and may cause our customers to modify spending priorities or delay or abandon purchasing decisions, thereby lengthening sales cycles, and may make it difficult for us to forecast our sales and operating results and to make decisions about future investments.

Recent macroeconomic conditions, including inflation, tariffs and volatile interest rates, have, and may continue to, put pressure on overall spending for our products and services, and may cause our customers to modify spending priorities or delay or abandon purchasing decisions, thereby lengthening sales cycles, and may make it difficult for us to forecast our sales and operating results and to make decisions about future investments.

These and other potential effects on our business may be significant and could materially harm our business, operating results and financial condition.

1 unchanged sentence

Additionally, all of the aforementioned risks may be further increased if we do not implement a disaster recovery plan or the disaster recovery plans we or our partners implement prove to be inadequate.

We are and could continue to be subject to securities class action litigation and shareholder derivative suits.

Securities class action litigation, and ensuing shareholder derivative suits, are often instituted against companies following periods of volatility in the market price of a company’s securities.

See Part I, Item 3 of this Form 10-K for additional information regarding our pending legal proceedings.

Such suits may seek, as applicable, direct, indirect, consequential, punitive or other penalties or monetary damages, injunctive relief, and/or attorneys’ fees.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors