6 unchanged sentences
A summary of our risks includes, but is not limited to, the following:
−Removed: • The effects of the COVID-19 pandemic have affected how we and our customers are operating our businesses, and the duration and extent to which this will impact our future results of operations and overall financial performance remains uncertain.
−Removed: • Adverse general economic and market conditions and reductions in workforce identity and customer identity spending may reduce demand for our products, which could harm our revenue, results of operations and cash flows.
+Added: • Adverse general economic, market and industry conditions and reductions in workforce identity and customer identity spending may reduce demand for our products, which could harm our revenue, results of operations and cash flows.
• We have experienced rapid growth in recent periods, which makes it difficult to forecast our revenue and evaluate our business and future prospects.
−Removed: • Our recent growth rates may not be indicative of our future growth.
+Added: • We have experienced rapid growth in recent periods, and our prior growth rates may not be indicative of our future growth.
As our costs increase, we may not be able to generate sufficient revenue to achieve and, if achieved, maintain profitability.
6 unchanged sentences
• Customer growth could fall below expectations.
+Added: • The effects of the COVID-19 pandemic have affected how we and our customers are operating our businesses, and the duration and extent to which this will impact our future results of operations and overall financial performance remains uncertain.
• We may experience quarterly fluctuations in our results of operations due to a number of factors that make our future results difficult to predict and could cause our results of operations to fall below analyst or investor expectations.
−Removed: • There are risks related to our ability to successfully integrate Auth0 and realize potential benefits from the acquisition.
• If there are interruptions or performance problems associated with our technology or infrastructure, our existing customers may experience service outages, and our new customers may experience delays in the deployment of our platform.
−Removed: • An application, data security or network incident may allow unauthorized access to our systems or data or our customers’ data, disable access to our service, harm our reputation, create additional liability and adversely impact our financial results.
+Added: • In the past we have experienced and in the future we may experience cybersecurity incidents that may allow unauthorized access to our systems or data or our customers’ data, disable access to our service, harm our reputation, create additional liability and adversely impact our financial results.
• Any actual or perceived failure by us to comply with the privacy or security provisions of our privacy policy, our contracts and/or legal or regulatory requirements could result in proceedings, actions or penalties against us.
+Added: • The stock price of our Class A common stock may be volatile or may decline.
• The dual class structure of our common stock has the effect of concentrating voting control with those stockholders who held our capital stock prior to the completion of our IPO, including our directors, executive officers, and their affiliates, who held in the aggregate 41.7% of the voting power of our capital stock as of January 31, 2023.
2 unchanged sentences
We may not have sufficient cash flow from our business to pay our indebtedness.
+Added: • We depend on our executive officers and other key employees, and the loss of one or more of these employees or an inability to attract and retain other highly skilled employees could harm our business.
Risks Related to Our Business and Industry
−Removed: The effects of the COVID-19 pandemic have materially affected how we and our customers are operating our businesses, and the duration and extent to which this will impact our future results of operations and overall financial performance remains uncertain.
−Removed: The extent of the impact of COVID-19 on our future operational and financial performance remains uncertain and will depend on certain developments, including the duration and spread of COVID-19 and variants of concern, the manufacture, distribution, efficacy and public acceptance of COVID-19 treatments and vaccines, related public health measures, including vaccine mandates, and their impact on the global economy, our customers, employees and vendors.
−Removed: While some governments around the world have lifted restrictions and distributed vaccines, there remains significant uncertainty around the recovery due to the challenging logistics of distributing the vaccines globally, as well as the unknown impact of emerging variants of COVID-19.
−Removed: This pandemic has resulted in a widespread health crisis that is adversely affecting broader economies and financial markets.
−Removed: As a result of the COVID-19 pandemic, for most of fiscal 2021, we temporarily closed our offices, required our employees to work from home and implemented significant travel restrictions.
−Removed: We shifted our customer, employee and industry events, including our annual user conferences Oktane20 Live and Oktane21 Live, to virtual-only formats.
−Removed: In fiscal 2022, as the administration of vaccines increased, we reopened our offices to partial capacity, allowing our employees to voluntarily return, and in fiscal 2023, we are shifting to hybrid in-person and virtual sales formats and experiences for future annual user conferences.
−Removed: The conditions caused by the COVID-19 pandemic have and may continue to affect the rate of IT spending and have and could adversely affect our current and potential customers’ ability or willingness to purchase our offerings.
−Removed: It has and could continue to delay current and prospective customers’ purchasing decisions, adversely impact our ability to provide professional services to our customers, delay the provisioning of our offerings, lengthen payment terms, reduce the value or duration of our subscription contracts, or affect customer attrition rates, all of which could adversely affect our future sales, operating results and overall financial performance.
−Removed: Our operations have been and may continue to be affected by a range of external factors related to the COVID-19 pandemic that are not within our control.
−Removed: For example, many cities, counties, states and countries imposed or may impose a wide range of restrictions on our employees’, partners’, customers’ and potential customers’ physical movement to limit the spread of COVID-19.
−Removed: If the COVID-19 pandemic has a substantial impact on our employees’, partners’, customers’ or potential customers’ attendance or productivity, our results of operations and overall financial performance may be harmed.
−Removed: The duration and extent of the impact from the COVID-19 pandemic depends on future developments that cannot be accurately predicted at this time, such as the efficacy, global availability and acceptance of COVID-19 vaccines, the severity and transmission rate of the virus and emerging variants of concern, the extent and effectiveness of containment actions and the impact of these and other factors on our employees, customers, partners and vendors as well as the global economy.
−Removed: Despite our best efforts to manage the impact of such events effectively, our business still may be harmed.
−Removed: Adverse general economic and market conditions and reductions in workforce identity and customer identity spending may reduce demand for our products, which could harm our revenue, results of operations and cash flows.
+Added: Adverse general economic, market and industry conditions and reductions in workforce identity and customer identity spending may reduce demand for our products, which could harm our revenue, results of operations and cash flows.
Our revenue, results of operations and cash flows depend on the overall demand for our products.
−Removed: Concerns about the COVID-19 pandemic, the systemic impact of a widespread recession (in the United States or internationally), energy costs, geopolitical issues or the availability and cost of credit have and could continue to lead to increased market volatility, decreased consumer confidence and diminished growth expectations in the U.S.
+Added: Concerns about the inflation and interest rate environment, the COVID-19 pandemic, the systemic impact of a widespread recession (in the United States or internationally), energy costs, geopolitical issues, such as Russia’s invasion of Ukraine, or the availability and cost of credit have and could continue to lead to increased market volatility, decreased consumer confidence and diminished growth expectations in the U.S.
economy and abroad, which in turn could result in reductions in workforce identity and customer identity spending by our existing and prospective customers.
1 unchanged sentence
Prolonged economic slowdowns may result in customers requesting us to renegotiate existing contracts on less advantageous terms to us than those currently in place or defaulting on payments due on existing contracts or not renewing at the end of the contract term.
−Removed: Our customers may merge with other entities who use alternative identity solutions and, during weak economic times, there is an increased risk that one or more of our customers will file for bankruptcy protection,
−Removed: either of which may harm our revenue, profitability and results of operations.
+Added: For example, rising interest rates in the United States have begun to affect businesses across many industries, including ours, by increasing the costs of labor, employee healthcare and other components, which may further constrain our, our customers’ and prospective customers’ budgets.
+Added: To the extent there is a sustained general economic downturn and our platforms and services are perceived by customers or potential customers as costly, or too difficult to deploy or migrate to, our revenue may be disproportionately affected by delays or reductions in spending.
+Added: Our customers may merge with other entities who use alternative identity solutions and, during weak economic times, there is an increased risk that one or more of our customers will file for bankruptcy protection, either of which may harm our revenue, profitability and results of operations.
We also face risk from international customers that file for bankruptcy protection in foreign jurisdictions, particularly given that the application of foreign bankruptcy laws may be more difficult to predict.
7 unchanged sentences
If we do not address these risks successfully, our results of operations could differ materially from our estimates and forecasts or the expectations of investors, causing our business to suffer and our stock price to decline.
−Removed: We have experienced rapid growth in recent periods, and our recent growth rates may not be indicative of our future growth.
+Added: We have experienced rapid growth in recent periods, and our prior growth rates may not be indicative of our future growth.
As our costs increase, we may not be able to generate sufficient revenue to achieve and, if achieved, maintain profitability.
1 unchanged sentence
In future periods, we may not be able to sustain revenue growth consistent with recent history, or at all.
−Removed: We believe our revenue growth depends on a number of factors, such as macroeconomic conditions and the economic impact of the COVID-19 pandemic, as well as, but not limited to, our ability to:
+Added: We believe our revenue growth depends on a number of factors, such as macroeconomic conditions including the inflation and interest rate environment, budget constraints and the economic impact of the COVID-19 pandemic, as well as, but not limited to, our ability to:
• price our platform effectively so that we are able to attract and retain customers without compromising our profitability;
15 unchanged sentences
As we continue to develop as a public company, we may incur additional legal, accounting and other expenses that we did not incur historically.
−Removed: If our revenue does not increase to offset these increases in our operating expenses, we will not be profitable in future periods.
+Added: If our revenue does not increase to
+Added: offset these increases in our operating expenses, we will not be profitable in future periods.
While historically, our total revenue has grown, not all components of our total revenue have grown consistently.
27 unchanged sentences
Our competitors vary in size and in the breadth and scope of the products and services offered.
−Removed: However, many of our competitors have substantial competitive advantages such as significantly greater financial, technical, sales and marketing, distribution, customer support or other resources, larger intellectual property portfolios, longer operating histories, greater resources to make strategic acquisitions and greater name recognition than we do.
+Added: However, many of our competitors have substantial competitive advantages such as significantly greater financial, technical, sales and marketing, distribution, customer support or other resources, larger intellectual property portfolios, longer operating
+Added: histories, greater resources to make strategic acquisitions and greater name recognition than we do.
Our principal competitor is Microsoft.
18 unchanged sentences
If we are unable to successfully develop new products, enhance our existing products to meet customer requirements, or otherwise gain market acceptance, our business, results of operations and financial condition would be harmed.
−Removed: Further, to grow our business, we must convince developers to adopt and build their applications using our APIs and products.
+Added: Further, to grow our business, we must convince developers to adopt and build their applications using our application programming interfaces (“APIs”) and products.
We believe that these developer-built applications facilitate greater usage and customization of our products.
6 unchanged sentences
In the past, some of our customers have elected not to renew their agreements with us, and it is difficult to accurately predict long-term customer retention and expansion rates.
−Removed: Our customer retention and expansion may decline or fluctuate as a result of a number of factors, including our customers’ satisfaction with our products, our product support, our prices and pricing plans, particularly in light of COVID-19-related economic conditions, the prices of competing software products, reductions in our customers’ spending levels, user adoption of our platform, deployment success, utilization rates by our customers, new product releases and changes to the packaging of our product offerings.
+Added: Our customer retention and expansion may decline or fluctuate as a result of a number of factors, including our customers’ satisfaction with our products, our product support, our prices and pricing plans, particularly in light of COVID-19-related economic conditions, the inflation and interest rate environment and increased costs, the prices of competing software products, reductions in our customers’ spending levels, user adoption of our platform, deployment success, utilization rates by our customers, new product releases and changes to the packaging of our product offerings.
If our customers do not purchase additional subscriptions or renew their subscriptions, renew on less favorable terms or fail to add more users, our revenue may decline or grow less quickly than anticipated, which would harm our future results of operations.
6 unchanged sentences
If we fail to meet or exceed such expectations for these or any other reasons, the market price of our Class A common stock could fall substantially, and we could face costly lawsuits, including securities class action suits.
+Added: The effects of the COVID-19 pandemic have materially affected how we and our customers are operating our businesses, and the duration and extent to which this will impact our future results of operations and overall financial performance remains uncertain.
+Added: The extent of the impact of COVID-19 on our future operational and financial performance remains uncertain and will depend on certain developments, including the duration and spread of COVID-19 and variants of concern, the manufacture, distribution, efficacy and public acceptance of COVID-19 treatments and vaccines, related public health measures, including vaccine mandates, and their impact on the global economy, our customers, employees and vendors.
+Added: While some governments around the world have lifted restrictions and distributed vaccines, there remains significant uncertainty around the recovery, as well as the unknown impact of emerging variants of COVID-19.
+Added: This pandemic has resulted in a widespread health crisis that is adversely affecting broader economies and financial markets.
+Added: The conditions caused by the COVID-19 pandemic have and may continue to affect the rate of IT spending and have and could adversely affect our current and potential customers’ ability or willingness to purchase our offerings.
+Added: It has and could continue to delay current and prospective customers’ purchasing decisions, adversely impact our ability to provide professional services to our customers, delay the provisioning of our offerings, lengthen payment terms, reduce the value or duration of our subscription contracts, or affect customer attrition rates, all of which could adversely affect our future sales, operating results and overall financial performance.
+Added: The duration and extent of the impact from the COVID-19 pandemic depends on future developments that cannot be accurately predicted at this time, such as the efficacy, global availability and acceptance of COVID-19 vaccines, the severity and transmission rate of the virus and emerging variants of concern, the extent and effectiveness of containment actions and the impact of these and other factors on our employees, customers, partners and vendors as well as the global economy.
+Added: Although global economic conditions have generally improved with the rollout of COVID-19 vaccines, business activity may not recover as quickly as anticipated, including as a result of inflationary pressures and the responses by central banking authorities to control such inflation, rising interest rates, debt and equity market fluctuations, diminished liquidity and credit availability, increased
+Added: unemployment rates, decreased investor and consumer confidence, political turmoil and supply chain challenges.
+Added: Despite our best efforts to manage the impact of such events effectively, our business still may be harmed.
We may experience quarterly fluctuations in our results of operations due to a number of factors that make our future results difficult to predict and could cause our results of operations to fall below analyst or investor expectations.
4 unchanged sentences
• the timing and success of new product introductions by us or our competitors or any other change in the competitive landscape of our market;
−Removed: • pricing pressure as a result of competition, COVID-19 or otherwise;
+Added: • pricing pressure as a result of competition, the inflation and interest rate environment and increased costs, COVID-19 or otherwise;
• seasonal buying patterns for IT spending;
12 unchanged sentences
• expenses related to real estate, including our office leases, and other fixed expenses;
−Removed: • general economic conditions in either domestic or international markets, including geopolitical uncertainty and instability.
+Added: • general economic conditions in either domestic or international markets, including the inflation and interest rate environment, geopolitical uncertainty and instability.
Any one or more of the factors above may result in significant fluctuations in our results of operations.
14 unchanged sentences
In addition, we have limited experience in acquiring other businesses.
−Removed: If we acquire additional businesses, we may not be able to successfully integrate and retain the acquired personnel, integrate the acquired operations and technologies, adequately test and assimilate the internal control processes of the acquired business in accordance with the requirements of Section 404 of the Sarbanes-Oxley Act of 2002 (“Sarbanes-Oxley Act”), or effectively manage the combined business following the acquisition.
+Added: If we acquire additional businesses, we may not be able to successfully integrate and retain the acquired personnel, integrate the acquired operations and technologies, and adequately test and assimilate the internal control processes of the acquired business in accordance with the requirements of Section 404 of the Sarbanes-Oxley Act of 2002 (“Sarbanes-Oxley Act”), or effectively manage the combined business following the acquisition.
+Added: For example, we have experienced and continue to experience aspects of such challenges in connection with our May 2021 acquisition of Auth0.
We may not be able to find and identify desirable acquisition targets or we may not be successful in entering into an agreement with any particular target.
14 unchanged sentences
In addition, if an acquired business fails to meet our expectations, our business, results of operations and financial condition could suffer.
−Removed: For further risks related to our acquisition of Auth0, please see below under “Risks Related to the Acquisition of Auth0.”
Because our long-term success depends, in part, on our ability to expand the sales of our products to customers located outside of the United States, our business will be susceptible to risks associated with international operations.
−Removed: We currently have sales personnel outside the United States and maintain offices outside the United States in the Americas, Asia-Pacific and Europe, and we plan to expand our international operations.
−Removed: We also have added several offices outside the United States through our acquisition of Auth0.
+Added: We currently have sales personnel outside the United States and maintain offices outside the United States in the Americas, Asia-Pacific and Europe, and we plan to continue to expand our international operations.
Our international revenue was 20% and 22% of our total revenue in fiscal 2022 and fiscal 2023, respectively.
3 unchanged sentences
• health epidemics, such as COVID-19, influenza and other highly communicable diseases or viruses;
−Removed: • macroeconomic conditions and the economic impact of the COVID-19 pandemic;
+Added: • macroeconomic conditions, including the inflation and interest rate environment and the economic impact of the COVID-19 pandemic;
• unexpected costs and errors in the localization of our products, including translation into foreign languages and adaptation for local practices and regulatory requirements;
2 unchanged sentences
• costs and liabilities related to compliance with the numerous and ever-growing landscape of U.S.
−Removed: and international data privacy and cybersecurity regimes, many of which involve disparate standards and enforcement approaches;
+Added: and international data privacy and cybersecurity regimes, many of which involve disparate standards and enforcement approaches, including implementation of the recently-announced agreement in principle between the European Union and United States to implement a successor framework to the EU-U.S.
+Added: Privacy Shield, to address cross-border data flows;
• greater risk that our foreign employees or partners will fail to comply with U.S.
8 unchanged sentences
• political, economic and social instability, war, terrorist activities or armed conflict, including Russia's invasion of Ukraine;
−Removed: • global economic uncertainty caused by global political events, including the United Kingdom's exit from the European Union, and similar geopolitical developments;
+Added: • global economic uncertainty caused by global political events;
• fluctuations in exchange rates that may increase the volatility of our foreign-based revenue and expense;
39 unchanged sentences
This expansion will require us to invest significant financial and other resources.
−Removed: Our business will be harmed if our
−Removed: efforts do not generate a corresponding increase in revenue.
+Added: Our business will be harmed if our efforts do not generate a corresponding increase in revenue.
We may not achieve anticipated revenue growth from expanding our direct sales force if we are unable to hire and develop talented direct sales personnel, if our new direct sales personnel are unable to achieve desired productivity levels in a reasonable period of time or if we are unable to retain our existing direct sales personnel.
22 unchanged sentences
We believe that developing and maintaining awareness of our brand in a cost-effective manner is critical to achieving widespread acceptance of our existing and future products and is an important element in attracting new customers.
+Added: For example, in the fourth quarter of fiscal 2023, we rebranded our Okta and Auth0 product offerings, which we now refer to as Workforce Identity Cloud and Customer Identity Cloud.
Furthermore, we believe that the importance of brand recognition will increase as competition in our market increases.
5 unchanged sentences
In the past, we have at times adjusted our prices either for individual customers in connection with long-term agreements or for a particular product.
−Removed: We expect that we may need to change our pricing in future periods and potentially in response to COVID-19 pricing pressures.
+Added: We expect that we may need to change our pricing in future periods and potentially in response to COVID-19 pricing pressures, the inflation and interest rate environment and increased costs.
Further, as competitors introduce new products that compete with ours or reduce their prices, we may be unable to attract new customers or retain existing customers based on our historical pricing.
5 unchanged sentences
If we raise additional equity or convertible debt financing, our security holders may experience significant dilution of their ownership interests.
−Removed: If we engage in additional debt financing, we may be required to accept terms that restrict our ability to incur additional indebtedness, force us to maintain specified liquidity or other ratios or restrict our ability to pay dividends or make acquisitions.
+Added: If we engage in additional debt financing, we may be required to accept terms that restrict our ability to incur additional indebtedness, force us to maintain specified
+Added: liquidity or other ratios or restrict our ability to pay dividends or make acquisitions.
If we need additional capital and cannot raise it on acceptable terms, or at all, we may not be able to, among other things:
10 unchanged sentences
In addition, such insurance may not be available to us in the future on economically reasonable terms, or at all.
−Removed: Further, our insurance may not cover all
−Removed: claims made against us and defending a suit, regardless of its merit, could be costly and divert management’s attention.
−Removed: Risks Related to the Acquisition of Auth0
−Removed: The ongoing integration of Auth0 may cause a disruption in our business.
−Removed: The ongoing integration following the acquisition of Auth0 (the “Acquisition”) could cause disruptions to our business or business relationships, which could have an adverse impact on results of operations.
−Removed: Parties with which we have business relationships may experience uncertainty as to the future of such relationships and may delay or defer certain business decisions, seek alternative relationships with third parties or seek to alter their present business relationships with us.
−Removed: Parties with whom we otherwise may have sought to establish business relationships may seek alternative relationships with third parties.
−Removed: The ongoing integration of Auth0 may place a significant burden on our management and internal resources.
−Removed: The diversion of management’s attention away from day-to-day business concerns and any difficulties encountered in the integration process could adversely affect our financial results.
−Removed: We have incurred and expect to continue to incur significant costs, expenses and fees for professional services and other transaction costs in connection with the Acquisition.
−Removed: We may also incur unanticipated costs in the integration of Auth0’s business with our business.
−Removed: The substantial majority of these costs will be non-recurring expenses relating to the Acquisition.
−Removed: We also could be subject to litigation related to the Acquisition, which could result in significant costs and expenses.
−Removed: We may not realize potential benefits from the Acquisition because of difficulties related to integration, the achievement of synergies, and other challenges.
−Removed: Prior to the consummation of the Acquisition, we and Auth0 operated independently, and there can be no assurances that our businesses can be combined in a manner that allows for the achievement of substantial benefits.
−Removed: The ongoing integration process may require significant time and resources, and we may not be able to manage the process successfully as our ability to acquire and integrate larger or more complex companies, products or technologies in a successful manner is unproven.
−Removed: If we are not able to successfully integrate Auth0’s businesses with ours or pursue our customer and product strategy successfully, the anticipated benefits of the Acquisition may not be realized fully or may take longer than expected to be realized.
−Removed: Further, it is possible that there could be a loss of our and/or Auth0’s key employees and customers, disruption of either company’s or both companies’ ongoing businesses or unexpected issues, higher than expected costs and an overall post‑completion process that takes longer than originally anticipated.
−Removed: Specifically, the following issues, among others, must be addressed in combining Auth0’s operations with ours in order to realize the anticipated benefits of the Acquisition:
−Removed: • combining the companies’ corporate functions;
−Removed: • combining Auth0’s business with our business in a manner that permits us to achieve the synergies anticipated to result from the Acquisition, the failure of which would result in the anticipated benefits of the Acquisition not being realized in the timeframe currently anticipated or at all;
−Removed: • maintaining existing agreements with customers, distributors, providers, talent and vendors and avoiding delays in entering into new agreements with prospective customers, distributors, providers, talent and vendors;
−Removed: • determining whether and how to address possible differences in corporate cultures and management philosophies;
−Removed: • integrating the companies’ administrative and information technology infrastructure;
−Removed: • developing products and technology that allow value to be unlocked in the future;
−Removed: • evaluating and forecasting the financial impact of the Acquisition transaction.
−Removed: In addition, at times the attention of certain members of our management and resources may be focused on integration of the businesses of the two companies and diverted from day‑to‑day business operations, which may disrupt our ongoing business and the business of the combined company.
−Removed: We may incur significant, non‑recurring costs in connection with the Acquisition and integrating the operations of Okta and Auth0, including costs to maintain employee morale and to retain key employees.
−Removed: Management cannot ensure that the elimination of duplicative costs or the realization of other efficiencies will offset the transaction and integration costs in the long term or at all.
−Removed: Purchase price accounting in connection with our Acquisition requires estimates that may be subject to change and could impact our consolidated financial statements and future results of operations and financial position.
−Removed: Pursuant to the acquisition method of accounting, the purchase price we paid for Auth0 has been allocated to the underlying Auth0 tangible and intangible assets acquired and liabilities assumed based on their respective fair market values with any excess purchase price allocated to goodwill.
−Removed: The acquisition method of accounting is dependent upon certain valuations and other studies that are preliminary.
−Removed: Accordingly, the purchase price allocation as of the Acquisition date is preliminary.
−Removed: We currently anticipate that all the information needed to identify and measure values assigned to the assets acquired and liabilities assumed will be obtained and finalized during the one‑year measurement period following the date of completion of the Acquisition.
−Removed: Differences between these preliminary estimates and the final acquisition accounting may occur, and these differences could have a material impact on the consolidated financial statements and the combined company’s future results of operations and financial position.
−Removed: Auth0 may have liabilities that are not known to us.
−Removed: Auth0 may have liabilities that we failed, or were unable, to discover, or that we underestimated, in the course of performing our due diligence investigations of Auth0’s business and we, as the successor owner of such acquired company, might be responsible for those liabilities.
−Removed: Such potential liabilities could include employment-related obligations under applicable law or other benefits arrangements, legal or regulatory claims, tax liabilities, warranty or similar liabilities to customers, product liabilities, claims related to infringement of third-party intellectual property rights, and claims by or amounts owed to vendors or other third parties.
−Removed: We cannot assure you that the indemnification available to us under the Merger Agreement with respect to the Acquisition will be sufficient in amount, scope or duration to fully offset the possible liabilities associated with Auth0’s business or property that we assumed upon consummation of the Acquisition.
−Removed: We may learn additional information about Auth0 that materially adversely affects us, such as unknown or contingent liabilities and liabilities related to compliance with applicable laws.
−Removed: Any such liabilities, individually or in the aggregate, could have a material adverse effect on our business, results of operations and financial condition.
+Added: Further, our insurance may not cover all claims made against us and defending a suit, regardless of its merit, could be costly and divert management’s attention.
+Added: Actions that we are taking to restructure our business to improve profitability may not be as effective as anticipated.
+Added: During the first quarter of fiscal 2024, we announced a world-wide restructuring plan intended to reduce operating expenses and improve profitability.
+Added: We may encounter challenges in the execution of these efforts, and these challenges could impact our ability to execute on our business initiatives and could impact our financial results.
+Added: If we are unable to realize the expected outcomes from our restructuring efforts, our business and operating results may be harmed.
+Added: Increased and complex scrutiny of environmental, social and governance (“ESG”) matters may require us to incur additional costs or otherwise adversely impact our business.
+Added: Increased attention to climate change;
+Added: diversity, equity and inclusion;
+Added: and other ESG issues, as well as societal expectations regarding voluntary ESG initiatives and disclosures, may result in increased costs (including but not limited to increased costs related to compliance, stakeholder engagement and contracting), impact our reputation, or otherwise affect our business performance.
+Added: In addition, organizations that provide information to investors on corporate governance and related matters have developed ratings processes for evaluating companies on ESG matters.
+Added: Such ratings are used by some investors to inform their investment or voting decisions.
+Added: Unfavorable ESG ratings could lead to negative investor sentiment toward us and/or our industry, which could have a negative impact on our access to and costs of capital.
+Added: To the extent ESG matters negatively impact our reputation, we may also not be able to compete as effectively to recruit or retain employees.
+Added: We may take certain actions, including the establishment of ESG-related goals or targets, to improve our ESG profile and/or respond to stakeholder demand;
+Added: however, such actions may be costly or be subject to numerous conditions that are outside our control, and we cannot guarantee that such actions will have the desired effect.
+Added: Moreover, while we may create and publish voluntary disclosures regarding ESG matters from time to time, many of the statements in those voluntary disclosures are based on hypothetical expectations and assumptions that may or may not be representative of current or actual risks or events or forecasts of expected risks or events, including the costs associated therewith.
+Added: Such expectations and assumptions are necessarily uncertain and may be prone to error or subject to misinterpretation given the long timelines involved and the lack of an established single approach to identifying, measuring and reporting on many ESG matters.
+Added: Such disclosures may also be at least partially reliant on third-party information that we have not independently verified or cannot be independently
+Added: In addition, we expect there will likely be increasing levels of regulation, disclosure-related and otherwise, with respect to ESG matters, and increased regulation will likely lead to increased compliance costs as well as scrutiny that could heighten all of the risks identified in this risk factor.
+Added: Such ESG matters may also impact our customers, which may adversely impact our business, financial condition, or results of operations.
Risks Related to Intellectual Property, Infrastructure Technology, Data Privacy and Security
10 unchanged sentences
In the future, these services may not be available to us on commercially reasonable terms, or at all.
−Removed: Any loss of the right to use any of these services could result in decreased functionality of our products until equivalent technology is either developed by us or, if available from another provider, is identified, obtained and
−Removed: integrated into our infrastructure.
+Added: Any loss of the right to use any of these services could result in decreased functionality of our products until equivalent technology is either developed by us or, if available from another provider, is identified, obtained and integrated into our infrastructure.
If we do not accurately predict our infrastructure capacity requirements, our customers could experience service shortfalls.
1 unchanged sentence
Any of the above circumstances or events may harm our reputation, cause customers to terminate their agreements with us, impair our ability to obtain subscription renewals from existing customers, impair our ability to grow our customer base, result in the expenditure of significant financial, technical and engineering resources, subject us to financial penalties and liabilities under our service level agreements, and otherwise harm our business, results of operations and financial condition.
−Removed: An application, data security or network incident may allow unauthorized access to our systems or data or our customers’ data, disable access to our service, harm our reputation, create additional liability and adversely impact our financial results.
−Removed: Increasingly, companies are subject to a wide variety of attacks on their systems and networks on an ongoing basis.
−Removed: In addition to threats from traditional computer “hackers,” malicious code (such as malware, viruses, worms and ransomware), employee or contractor theft or misuse, password spraying, phishing and denial-of-service attacks, we and our third-party service providers now also face threats from sophisticated nation-state and nation-state supported actors who engage in attacks (including advanced persistent threat intrusions) that add to the risks to our systems (including those hosted on AWS or other cloud services), internal networks, our customers’ systems and the information that they store and process.
+Added: In the past we have experienced and in the future we may experience cybersecurity incidents that may allow unauthorized access to our systems or data or our customers’ data, disable access to our service, harm our reputation, create additional liability and adversely impact our financial results.
+Added: Increasingly, companies, including Okta, are subject to a wide variety of attacks on their systems and networks on an ongoing basis.
+Added: In addition to threats from traditional computer “hackers,” malicious code (such as malware, viruses, worms and ransomware), employee or contractor theft or misuse, password spraying, phishing and denial-of-service attacks, we and our third-party service providers now also face threats from sophisticated nation-state and nation-state-supported actors who engage in attacks (including advanced persistent threat intrusions) that add to the risks to our systems (including those hosted on AWS’ or other cloud services providers’ systems), internal networks, our customers’ systems and the information that they store and process.
For example, like other companies, we have experienced numerous cybersecurity attacks and have had to expend increasing amounts of human and financial capital to respond.
3 unchanged sentences
The security measures we have integrated into our internal systems and platform, which are designed to detect unauthorized activity and prevent or minimize security breaches, may not function as expected or may not be sufficient to protect our internal networks and platform against certain attacks.
−Removed: In addition, techniques used to sabotage or to obtain unauthorized access to networks in which data is stored or through which data is transmitted change frequently, become more complex over time and generally are not recognized until launched against a target.
+Added: In addition, techniques used to sabotage or to obtain unauthorized
+Added: access to networks in which data is stored or through which data is transmitted change frequently, become more complex over time and generally are not recognized until launched against a target.
As a result, we and our third-party service providers may be unable to anticipate these techniques or implement adequate preventative measures quickly enough to prevent either an electronic intrusion into our systems or services or a compromise of customer data, employee data or other protected information.
−Removed: Our customers’ use of Okta to access business systems and store data concerning, among others, their employees, contractors, partners and customers is essential to their use of our platform, which stores, transmits and processes customers’ proprietary information and personal data.
−Removed: If a breach of customer data on our platform were to occur, as a result of third-party action, technology limitations, employee or contractor error, malfeasance or otherwise, and the confidentiality, integrity or availability of our customers’ data or systems was disrupted, we could incur significant liability to our customers and to individuals or businesses whose information was being stored by our customers, and our platform may be perceived as less desirable, which could negatively affect our business and damage our reputation.
+Added: Our customers’ use of Okta to access business systems and store data concerning, among others, their employees, contractors, partners and customers is essential to their use of our platform, which stores, transmits and processes customers’ proprietary information and users’ personal data.
+Added: Okta has experienced and likely will in the future experience attacks targeting such customer data.
+Added: When such breaches occur, as a result of third-party action, technology limitations, employee or contractor error, malfeasance or otherwise, and if the confidentiality, integrity or availability of our customers’ data or systems is disrupted, we could incur significant liability to our customers and to individuals or businesses whose information was being stored by our customers, and our platform may be perceived as less desirable, which could negatively affect our business and damage our reputation.
Because techniques used to obtain unauthorized access to, or to sabotage, systems change frequently and generally are not recognized until launched against a target, we, our third-party service providers and our customers may be unable to anticipate these techniques or to implement adequate preventive measures.
Further, because we do not control our third-party service providers, or the processing of data by our third-party service providers, we cannot ensure the integrity or security of measures they take to protect customer information and prevent data loss.
−Removed: In addition, security breaches impacting our platform could result in a risk of loss or unauthorized disclosure of this information, or the denial of access to this information, which, in turn, could lead to enforcement actions, litigation, regulatory or governmental audits, investigations and possible liability, and increased requests by individuals regarding their personal data.
+Added: In addition, security breaches impacting our platform have in certain cases resulted in and could in the future result in a risk of loss or unauthorized disclosure of this information, or the denial of access to this information, which, in turn, could lead to enforcement actions, litigation, regulatory or governmental audits, investigations and possible liability, and increased requests by individuals regarding their personal data.
Security breaches could also damage our relationships with and ability to attract customers and partners, and trigger service availability, indemnification and other contractual obligations.
Security incidents may also cause us to incur significant investigation, mitigation, remediation, notification and other expenses.
−Removed: Furthermore, as a well-known provider of identity and security solutions, any such breach, including a breach of our customers’ systems, could compromise systems secured by our products, creating system disruptions or slowdowns and exploiting security vulnerabilities of our or our customers’ systems, and the information stored on our or our customers’ systems could be accessed, publicly disclosed, altered, lost or stolen, which could subject us
−Removed: to liability and cause us financial harm.
−Removed: For example, in December 2021, a third party reported a remote code execution vulnerability in the Java logging library known as “log4j” that affected many systems worldwide.
−Removed: We have reviewed the use of this library within our software product portfolio and in our IT environment and have taken steps to mitigate the vulnerability.
−Removed: There is no guarantee that our preventative and mitigation actions with respect to this vulnerability and others like it will fully eliminate the risk of a malicious compromise of our or our customers’ systems.
+Added: Furthermore, as a well-known provider of identity and security solutions, any such breach, including a breach of our customers’ systems, could compromise systems secured by our products, creating system disruptions or slowdowns and exploiting security vulnerabilities of our or our customers’ systems, and the information stored on our or our customers’ systems could be accessed, publicly disclosed, altered, lost or stolen, which could subject us to liability and cause us financial harm.
+Added: For example, the January 2022 compromise of one of our third-party service providers by a threat actor, even though not material and not a breach of our product or systems, nonetheless was widely publicized and focused attention on the security of our systems and the systems of our third-party service providers.
+Added: Our disclosures concerning security incidents also may become the subject of litigation, and our disclosures concerning the January 2022 compromise, for example, have become the subject of lawsuits, as discussed in Item 3 , “Legal Proceedings” below.
+Added: While we have taken a number of remediation steps, there is no guarantee that our preventative and mitigation actions with respect to this incident and others like it will fully eliminate the risk of a malicious compromise of our, our third-party service providers’ or our customers’ systems.
While we maintain cybersecurity insurance, our insurance may be insufficient to cover all liabilities incurred in these incidents, and any incidents may result in loss of, or increased costs of, our cybersecurity insurance.
2 unchanged sentences
Any of these negative outcomes could adversely impact market acceptance of our products and could harm our business, results of operations and financial condition.
−Removed: Third parties may attempt to fraudulently induce employees, contractors, customers or our customers’ users into disclosing sensitive information such as user names, passwords or other information or otherwise compromise the security of our internal networks, electronic systems and/or physical facilities in order to gain access to our data or our customers’ data, which could result in significant legal and financial exposure, a loss of confidence in the security of our platform, interruptions or malfunctions in our operations, account lock outs, and, ultimately, harm to our future business prospects and revenue.
+Added: Third parties have induced and may continue to fraudulently induce employees, contractors, customers or our customers’ users into disclosing sensitive information such as user names, passwords or other information or otherwise compromise the security of our applications, internal networks, electronic systems and/or physical facilities in order to gain access to our data or our customers’ data, which could result in significant legal and financial exposure, a loss of confidence in the security of our platform, interruptions or malfunctions in our
+Added: operations, account lock outs, and, ultimately, harm to our future business prospects and revenue.
We may be required to expend significant capital and financial resources to protect against such threats or to alleviate problems caused by breaches in security.
8 unchanged sentences
In addition, some of our customers rely on our authorization under FedRAMP to help satisfy their own legal and regulatory compliance requirements which, in addition to state or international regulations, may require us to undertake additional actions and expense to ensure compliance.
−Removed: We also expect that there will continue to be new proposed laws, regulations, self-regulatory and industry standards concerning privacy, data protection and information security in the United States, China, the European Union and other jurisdictions, and we cannot yet determine the impact such future laws, regulations and standards may have on our business.
−Removed: For example, the California Consumer Privacy Act (“CCPA”) took effect on January 1, 2020, which broadly defines personal information and gives California residents expanded privacy rights and protections and provides for civil penalties for violations and a private right of action for data breaches.
−Removed: on November 3, 2020, California voters passed the California Privacy Rights Act (“CPRA”) into law.
−Removed: The CPRA will take substantial effect on January 1, 2023 with enforcement scheduled for July 1, 2023 and will significantly modify the CCPA and create a new state agency that will be vested with authority to implement and enforce the CCPA and the CPRA.
−Removed: Since the CPRA passed, in March 2021, Virginia enacted the Virginia Consumer Data Protection Act (“CDPA”) and, in June 2021, Colorado enacted the Colorado Privacy Act (“CPA”), both of which are comprehensive privacy statutes that share similarities with the CCPA and CPRA.
−Removed: Some observers have noted the CCPA, CPRA, CDPA and CPA mark the beginning of a trend toward more stringent privacy legislation in the United States, including a potential federal privacy law, all of which could increase our potential liability and adversely affect our business.
−Removed: Additionally, in August 2021, the National People’s Congress of the People's Republic of China adopted the Personal Information Protection Law (“PIPL”), which took effect on November 1, 2021.
−Removed: The PIPL, which introduces a legal framework similar to the GDPR (as defined and further described below), marks the introduction of a comprehensive system for the protection of personal information in China.
−Removed: We cannot yet determine the impact that the PIPL may have on our business;
−Removed: however, we may incur substantial expense in complying with any new obligations, we could be subject to significant fines if we are found to not comply with the PIPL, and we may be required to make significant changes in our business operations and product and services development, all of which may adversely affect our revenues and our business overall.
+Added: We also expect that there will continue to be new proposed laws, regulations, self-regulatory and industry standards concerning privacy, data protection and information security in the United States, China, the European Union, India and other jurisdictions, and we cannot yet determine the impact such future laws, regulations and standards may have on our business.
+Added: For example, the California Consumer Privacy Act (“CCPA”), which took effect on January 1, 2020, and the California Privacy Rights Act (“CPRA”), which took effect on January 1, 2023 and significantly modifies the CCPA, broadly define personal information and give California residents expanded privacy rights and protections and provide for civil penalties for violations and a private right of action for data breaches.
+Added: The CPRA also creates a new state agency that is vested with authority to implement and enforce the CCPA and the CPRA.
+Added: Since the CPRA passed, Virginia, Colorado, Utah and Connecticut have each passed their own comprehensive privacy statutes that share similarities with the CCPA and CPRA and will take effect in 2023.
+Added: Some observers see this influx of state privacy regimes as a trend toward more stringent privacy legislation in the United States, including a potential federal privacy law, all of which could increase our potential liability and adversely affect our business.
Future laws, regulations, standards and other obligations, and changes in the interpretation of existing laws, regulations, standards and other obligations could impair our or our customers’ ability to collect, use or disclose information relating to consumers, which could decrease demand for our applications, restrict our business operations, or increase our costs and impair our ability to maintain and grow our customer base and increase our revenue.
2 unchanged sentences
With respect to cybersecurity in the United States, we are closely monitoring the development of rules and guidance pursuant to various executive orders that may apply to us, including, for example, pursuant to Executive Order 14028 for “critical software.” While the rules and guidance coming from the Order are still being developed, we could be categorized as a provider of critical software, which may increase our compliance costs and delay or prevent our ability to execute contracts with customers, including in particular with government entities.
−Removed: Any failure or perceived failure by us to comply with federal, state or foreign laws or regulations, industry standards, contractual obligations or other legal obligations, compliance frameworks that Okta has contractually committed to comply with, or any actual or suspected privacy or security incident, even if unfounded, whether or not resulting in unauthorized access to, or acquisition, release or transfer of personal data or other data, may result in enforcement actions and prosecutions, private litigation, fines, penalties and censure, claims for damages by customers and other affected individuals, or adverse publicity and could cause our customers to lose trust in us, which could have an adverse effect on our reputation and business.
+Added: Any failure or perceived failure by us to comply with federal, state or foreign laws or regulations, industry standards, contractual obligations or other legal obligations, compliance frameworks that Okta has contractually
+Added: committed to comply with, or any actual or suspected privacy or security incident, even if unfounded, whether or not resulting in unauthorized access to, or acquisition, release or transfer of personal data or other data, may result in enforcement actions and prosecutions, private litigation, fines, penalties and censure, claims for damages by customers and other affected individuals, or adverse publicity and could cause our customers to lose trust in us, which could have an adverse effect on our reputation and business.
We publicly post our privacy policies and practices concerning our processing, use and disclosure of the personal data provided to us by our website visitors and by our customers, and other individuals with whom we interact.
5 unchanged sentences
This, in turn, may reduce the value of our service, and slow or eliminate the growth of our business, or cause our business to contract.
+Added: Privacy is a mission-critical issue for Okta and for our customers.
+Added: We have attained multiple privacy certifications, such as the Asia-Pacific Economic Cooperation Privacy Recognition for Processors, and the European Union Cloud Code of Conduct, Level 2.
+Added: If we fail to maintain our privacy certifications, or if we fail to seek expansion of their applicability to acquired and/or newly-developed products, we may fail to meet our contractual commitments and we may fail to retain our existing customers or attract new customers, and our business, results of operations and financial condition could suffer.
We may face particular privacy, data security and data protection risks in Europe due to stringent data protection and privacy laws, including the European General Data Protection Regulation, and increased scrutiny over EU-U.S.
data transfers.
−Removed: We are subject to the EU General Data Protection Regulation 2016/679 (“GDPR”) that took effect on May 25, 2018, and, as a result of the United Kingdom’s exit from the European Union, as of January 1, 2021, the UK General Data Protection Regulation and Data Protection Act 2018 (“UK Data Protection Laws”).
+Added: We are subject to the EU General Data Protection Regulation 2016/679 (“GDPR”) and the UK General Data Protection Regulation and Data Protection Act 2018 (“UK Data Protection Laws”).
The GDPR and UK Data Protection Laws have enhanced data protection obligations for processors and controllers of personal data, including, for example, expanded disclosures about how personal data is to be used, limitations on retention of information, mandatory data breach notification requirements and onerous new obligations on services providers.
15 unchanged sentences
Use of the SCCs must now be assessed on a case-by-case basis taking into account the legal regime applicable in the destination country, in particular applicable surveillance laws and rights of individuals and additional measures and/or contractual provisions may need to be put in place.
−Removed: The European Commission has now issued new SCCs that account for the CJEU’s “Schrems II” decision.
−Removed: Although we believe we continue to satisfy regulatory requirements through our use of SCCs, these latest developments may require major changes to our data transfer policy, including the need to conduct legal, technical, and security assessments for each data transfer from the EEA to a country outside of the EEA.
−Removed: This means that we may be unsuccessful in maintaining legitimate means for our transfer and receipt of personal data from the EEA.
−Removed: We may, in addition to other impacts, experience additional costs associated with increased compliance burdens, and we and our customers face the potential for regulators in the EEA to apply different standards to the transfer of personal data from the EEA to the United States, and to block, or require ad hoc verification of measures taken with respect to, certain data flows from the EEA to the United States.
+Added: In June 2021, the European Commission issued new SCCs that account for the CJEU’s “Schrems II” decision.
+Added: The new SCCs must be used for relevant new data transfers, and existing SCCs arrangements were required to be migrated to the new SCCs by December 27, 2022.
+Added: These new SCCs only apply to the transfer of personal data outside the EEA, and not the United Kingdom.
+Added: The United Kingdom’s Information Commissioner’s Office released revised UK standard contractual clauses that can be used from March 21, 2022, with a two-year grace period.
+Added: and EU officials are actively seeking a solution to replace the Privacy Shield.
+Added: On March 25, 2022, the U.S.
+Added: and European Commission announced that they had agreed in principle to a new “Trans-Atlantic Data Privacy Framework” to enable trans-Atlantic data flows and address the concerns raised in the Schrems II decision.
+Added: There is no clear timeline for the enactment of this new framework.
+Added: Moreover, once enacted, the new framework is likely to be subject to legal challenges and may be struck down by the CJEU.
+Added: Although we believe we continue to satisfy regulatory requirements through our use of SCCs, these latest developments may require major changes to our data transfer policy, including the need to conduct legal, technical, and security assessments for each data transfer from the EEA and UK to a country outside of the EEA and UK.
+Added: This means that we may be unsuccessful in maintaining legitimate means for our transfer and receipt of personal data from the EEA and UK.
+Added: We may, in addition to other impacts, experience additional costs associated with increased compliance burdens, and we and our customers face the potential for regulators in the EEA and UK to apply different standards to the transfer of personal data from the EEA and UK to the United States, and to block, or require ad hoc verification of measures taken with respect to, certain data flows from the EEA and UK to the United States.
We also anticipate being required to engage in new contract negotiations with third parties that aid in processing data on our behalf, and entering into the new SCCs.
−Removed: We may experience reluctance or refusal by current or prospective European customers to use our products, and we may find it necessary or desirable to make further changes to our handling of personal data of EEA residents.
+Added: We may experience reluctance or refusal by current or prospective European customers to use our products, and we may find it necessary or desirable to make further changes to our handling of personal data of EEA and UK residents.
There are few viable alternatives to the SCCs, and the law in this area remains dynamic.
These recent developments will require us to review and may require us to amend the legal mechanisms by which we make and/or receive personal data transfers to/in the United States.
−Removed: The regulatory environment applicable to the handling of EEA residents' personal data, and our actions taken in response, may cause us to assume additional liabilities or incur additional costs and could result in our business, operating results and financial condition being harmed.
−Removed: We and our customers may face a risk of enforcement actions by data protection authorities in the EEA relating to personal data transfers to us and by us from the EEA.
+Added: The regulatory environment applicable to the handling of EEA and UK residents' personal data, and our actions taken in response, may cause us to assume additional liabilities or incur additional costs and could result in our business, operating results and financial condition being harmed.
+Added: We and our customers may face a risk of enforcement actions by data protection authorities in the EEA and UK relating to personal data transfers to us and by us from the EEA and UK.
Any such enforcement actions could result in substantial costs and diversion of resources, distract management and technical personnel and negatively affect our business, operating results and financial condition.
We also continue to see jurisdictions imposing data localization laws, which require personal information, or certain subcategories of personal information to be stored in the jurisdiction of origin.
−Removed: These regulations may deter
−Removed: customers from using cloud-based services such as ours, and may inhibit our ability to expand into those markets or prohibit us from continuing to offer services in those markets without significant additional costs.
−Removed: We and our customers are at risk of enforcement actions taken by certain EU data protection authorities until such point in time that we may be able to ensure that all transfers of personal data to us in the United States from the EU are conducted in compliance with all applicable regulatory obligations, the guidance of data protection authorities and evolving best practices.
−Removed: Any investigation or charges by EU data protection authorities could have a negative effect on our existing business and on our ability to attract and retain new customers.
−Removed: We may find it necessary to establish systems to maintain EU personal data within the EU, which may involve substantial expense and may cause us to need to divert resources from other aspects of our business, all of which may adversely affect our business.
+Added: These regulations may deter customers from using cloud-based services such as ours, and may inhibit our ability to expand into those markets or prohibit us from continuing to offer services in those markets without significant additional costs.
+Added: We and our customers are at risk of enforcement actions taken by certain EEA and UK data protection authorities until such point in time that we may be able to ensure that all transfers of personal data to us in the United States from the EEA and UK are conducted in compliance with all applicable regulatory obligations, the guidance of data protection authorities and evolving best practices.
+Added: Any investigation or charges by EEA and UK data protection authorities could have a negative effect on our existing business and on our ability to attract and retain new customers.
+Added: We may find it necessary to establish systems to maintain EEA and UK personal data within the EEA and UK, which may involve substantial expense and may cause us to need to divert resources from other aspects of our business, all of which may adversely affect our business.
We function as a HIPAA Business Associate for certain of our customers and, as such, are subject to strict privacy and data security requirements.
If we fail to comply with any of these requirements, we could be subject to significant liability, all of which can adversely affect our business as well as our ability to attract and retain new customers.
−Removed: The Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act (“HITECH”), and their respective implementing regulations under HIPAA, imposes specified requirements relating to the privacy, security and transmission of individually identifiable health information.
+Added: The Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), as amended by the Health Information Technology for Economic and Clinical Health Act (“HITECH”), and their respective implementing regulations under HIPAA, imposes specified requirements relating to the privacy, security and transmission of individually identifiable health information.
Among other things, HITECH makes HIPAA’s security standards directly applicable to business associates.
10 unchanged sentences
Significant changes to HIPAA, including interpretation and application of HIPAA, could negatively impact our business.
+Added: If we fail to maintain our security attestations and certifications, our business, results of operations and financial condition may suffer.
+Added: Security is a mission-critical issue for Okta and for our customers.
+Added: We have attained multiple certifications, including SOC 2 Type II certifications, CSA Star Level 2 Attestation, ISO/IEC 27001:2013, ISO/IEC 27018:2019 certifications, and agency FedRAMP Moderate Authorities to Operate.
+Added: We also support FIPS 140-2 encryption requirements.
+Added: If we fail to maintain our security attestations and certifications, or if we fail to seek expansion of their applicability to acquired and/or newly-developed products, we may fail to meet our contractual commitments and we may fail to retain our existing customers or attract new customers, and our business, results of operations and financial condition could suffer.
We provide service level commitments under our customer contracts.
28 unchanged sentences
As we continue to expand the number of our customers and products available to our customers, we may not be able to scale our technology to accommodate the increased capacity requirements, which may result in interruptions or delays in service.
−Removed: In addition, the failure of third-party virtual data centers, or third-party internet service providers, or other third-party service providers whose services are integrated with our platform, to meet our capacity requirements could result in interruptions or delays in access to our platform or impede our ability to scale our operations.
+Added: In addition, the failure of third-party virtual data centers, third-party internet service providers, or other third-party service providers whose services are integrated with our platform, to meet our capacity requirements could result in interruptions or delays in access to our platform or impede our ability to scale our operations.
In the event that our third-party service agreements are terminated, or there is a lapse of service, interruption of internet service provider connectivity or damage to such facilities, we could experience interruptions in access to our platform as well as delays and additional expense in arranging new facilities and services.
29 unchanged sentences
We will not be able to protect our intellectual property if we are unable to enforce our rights or if we do not detect unauthorized use of our intellectual property.
−Removed: Despite our precautions, it may be possible for unauthorized third parties to copy our products and use information that we regard as proprietary to create products that compete with ours.
+Added: Despite our precautions, it may be possible for unauthorized third parties to copy our products and use information that we regard as proprietary to create products that compete
Some contract provisions protecting against unauthorized use, copying, transfer and disclosure of our products may be unenforceable under the laws of certain jurisdictions and foreign countries.
60 unchanged sentences
Our subscription model also makes it difficult for us to rapidly increase our revenue through additional sales in any period, as revenue from new customers is generally recognized over the applicable service period.
−Removed: Additionally, due to the complexity of certain of our customer contracts, the actual revenue recognition treatment required under Accounting Standards Update No.
−Removed: 2014-09, Revenue from Contracts with Customers (Topic 606) , will depend on contract-specific terms and may result in greater variability in revenue from period to period.
+Added: Additionally, due to the complexity of certain of our customer contracts, the actual revenue recognition treatment required under relevant accounting principles generally accepted in the United States (“GAAP”) will depend on contract-specific terms and may result in greater variability in revenue from period to period.
In addition, a decrease in new subscriptions or renewals in a reporting period may not have an immediate impact on billings for that period.
18 unchanged sentences
In addition, we use channel partners to sell our products and conduct business on our behalf abroad.
−Removed: We or such partners may have direct or indirect interactions with officials and employees of government agencies or state-
−Removed: owned or affiliated entities and under certain circumstances we could be held liable for the corrupt or other illegal activities of such partners, and our employees, representatives, contractors, partners, and agents, even if we do not explicitly authorize such activities.
+Added: We or such partners may have direct or indirect interactions with officials and employees of government agencies or state-owned or affiliated entities and under certain circumstances we could be held liable for the corrupt or other illegal activities of such partners, and our employees, representatives, contractors, partners, and agents, even if we do not explicitly authorize such activities.
We have implemented an anti-corruption compliance program but cannot ensure that all our employees and agents, as well as those companies to which we outsource certain of our business operations, will not take actions in violation of our policies and applicable law, for which we may be ultimately held responsible.
16 unchanged sentences
Our international operations may give rise to potentially adverse tax consequences.
−Removed: We are expanding our international operations and staff to better support our growth into the international markets.
−Removed: Our corporate structure and associated transfer pricing policies anticipate future growth into the international markets.
+Added: We are expanding our international operations and staff to better support our growth into certain international markets.
+Added: Our corporate structure and associated transfer pricing policies anticipate future growth into certain international markets.
The amount of taxes we pay in different jurisdictions may depend on the application of the tax laws of the various jurisdictions, including the United States, to our international business activities, changes in tax rates, new or revised tax laws or interpretations of existing tax laws and policies and our ability to operate our business in a manner consistent with our corporate structure and intercompany arrangements.
3 unchanged sentences
Changes in tax laws or regulations in the various tax jurisdictions we are subject to that are applied adversely to us or our customers could increase the costs of our products and harm our business.
−Removed: New income, sales, use, value-added or other tax laws, statutes, rules, regulations or ordinances could be enacted at any time.
+Added: New income, sales, use, value-added or other taxes, tax laws, statutes, rules, regulations or ordinances could be enacted at any time.
Those enactments could harm our domestic and international business operations, and our business and financial performance.
1 unchanged sentence
These events could require us or our customers to pay additional tax amounts on a prospective or retroactive basis, as well as require us or our customers to pay fines and/or penalties and interest for past amounts deemed to be due.
−Removed: If we raise our prices to offset the costs of these changes, existing and potential future customers may elect not to purchase our products in the future.
−Removed: Additionally,
−Removed: new, changed, modified or newly interpreted or applied tax laws could increase our customers’ and our compliance, operating and other costs, as well as the costs of our products.
+Added: If we raise our prices to offset the costs of these additional taxes, existing and potential future customers may elect not to purchase our products in the future.
+Added: Additionally, new, changed, modified or newly interpreted or applied tax laws could increase our customers’ and our compliance, operating and other costs, as well as the costs of our products.
Further, these events could decrease the capital we have available to operate our business.
28 unchanged sentences
Since we do not know whether or when we will generate the U.S.
−Removed: federal taxable income necessary to use our remaining net operating losses, these net operating loss carryforwards generated prior to our tax year ended January 31, 2018 could expire unused.
+Added: federal taxable income necessary to use our remaining net operating losses, these net operating loss carryforwards generated prior to our fiscal 2018 could expire unused.
If we fail to maintain an effective system of disclosure controls and internal control over financial reporting, our ability to produce timely and accurate financial statements or comply with applicable regulations could be impaired.
15 unchanged sentences
Further, such changes could potentially affect our reporting of transactions completed before such changes are effective.
−Removed: Accounting principles generally accepted in the United States (“GAAP”) are subject to interpretation by the Financial Accounting Standards Board (“FASB”), the SEC and various bodies formed to promulgate and interpret appropriate accounting principles.
+Added: GAAP are subject to interpretation by the Financial Accounting Standards Board (“FASB”), the SEC and various bodies formed to promulgate and interpret appropriate accounting principles.
A change in these principles or interpretations could have a significant effect on our reported financial results, and could affect the reporting of transactions completed before the announcement of a change.
3 unchanged sentences
We base our estimates on historical experience and on various other assumptions that we believe to be reasonable under the circumstances, as provided in the section titled “Management’s Discussion and Analysis of Financial Condition and Results of Operations.” The results of these estimates form the basis for making judgments about the carrying values of assets, liabilities and equity, and the amount of revenue and expenses that are not readily apparent from other sources.
−Removed: Significant assumptions and estimates used in preparing our consolidated financial statements include, but are not limited to those related to the valuation of goodwill and purchased intangible assets arising from business combinations, revenue recognition, period of benefit for deferred commissions, incremental borrowing rates for operating leases, effective interest rates for convertible notes, valuation of deferred income taxes and valuation of certain equity awards assumed.
−Removed: Our results of operations may be adversely affected if our assumptions change or if actual circumstances differ from those in our assumptions, which could cause our results of operations to fall below the expectations of securities analysts and investors, resulting in a decline in the trading price of our Class A common stock.
+Added: Significant assumptions and estimates used in preparing our consolidated financial statements include, but are not limited to those referenced in the section titled “Management’s Discussion and Analysis of Financial Condition and Results of Operations.” Our results of operations may be adversely affected if our assumptions change or if actual circumstances differ from those in our assumptions, which could cause our
+Added: results of operations to fall below the expectations of securities analysts and investors, resulting in a decline in the trading price of our Class A common stock.
Risks Related to Ownership of Our Class A Common Stock
The stock price of our Class A common stock may be volatile or may decline.
−Removed: Prior to our IPO, there was no public market for shares of our Class A common stock.
−Removed: The market prices of the securities of other newly public companies have historically been highly volatile, and our stock price has been volatile since our IPO.
+Added: The trading price of our Class A common stock has been, and in the future, may be, subject to substantial volatility and wide fluctuations.
+Added: For example, from February 1, 2022 through January 31, 2023, the trading price of our Class A common stock has ranged from $44.12 per share to $203.79 per share.
The market price of our Class A common stock may fluctuate significantly in response to numerous factors, many of which are beyond our control, including, but not limited to:
• overall performance of the equity markets and/or publicly-listed technology companies;
+Added: • volatility in the market prices and trading volumes of technology and high-growth companies generally, or those in our industry in particular;
• actual or anticipated fluctuations in our revenue or other financial or operating metrics;
−Removed: • changes in the financial projections we provide to the public or our failure to meet these projections;
+Added: • our ability to meet or exceed forward-looking guidance we have given, our ability to give forward-looking guidance consistent with past practices, and changes to or withdrawal of previous guidance or long-range targets;
• failure of securities analysts to initiate or maintain coverage of us, changes in financial estimates and/or recommendations by any securities analysts who follow our company;
• our failure to meet the estimates or the expectations of securities analysts or investors;
+Added: • actions and investment positions taken by institutional and other stockholders, including activist investors;
• recruitment or departure of key personnel;
• significant security breaches, technical difficulties or interruptions of our service;
−Removed: • the economy as a whole and market conditions in our industry;
+Added: • the economy as a whole, the inflation and interest rate environment and market and industry conditions;
• rumors and market speculation involving us or other companies in our industry;
5 unchanged sentences
In addition, stock markets have experienced extreme price and volume fluctuations that have affected and continue to affect the market prices of equity securities of many companies.
−Removed: Stock prices of many companies have fluctuated in a manner unrelated or disproportionate to the operating performance of those companies.
+Added: Stock prices of many companies, including technology companies and high-growth, unprofitable companies in particular, have fluctuated in a manner unrelated or disproportionate to the operating performance of those companies.
In the past, stockholders have instituted securities class action litigation following periods of market volatility.
−Removed: If we were to
−Removed: become involved in securities litigation, it could subject us to substantial costs, divert resources and the attention of management from our business, and harm our business.
+Added: Our involvement in securities litigation could subject us to substantial costs, divert resources and the attention of management from our business, and harm our business.
The dual class structure of our common stock has the effect of concentrating voting control with those stockholders who held our capital stock prior to the completion of our IPO, including our directors, executive officers, and their affiliates, who held in the aggregate 41.7% of the voting power of our capital stock as of January 31, 2023.
13 unchanged sentences
Accordingly, these shares will be able to be freely sold in the public market upon issuance, subject to applicable vesting requirements.
−Removed: Furthermore, a substantial number of shares of our Class A common stock is reserved for issuance upon the exercise of the Notes (as defined below) and the Warrants (as defined below) issued at the time of the issuance of the 2023 Notes (as defined below).
+Added: Furthermore, a substantial number of shares of our Class A common stock is reserved for issuance upon the exercise of the Notes (as defined below) and the Warrants (as defined below).
If we elect to satisfy our conversion obligation on the Notes solely in shares of our Class A common stock upon conversion of the Notes, we will be required to deliver the shares of our Class A common stock, together with cash for any fractional share, on the second business day following the relevant conversion date.
38 unchanged sentences
If we are unable to generate such cash flow, we may be required to adopt one or more alternatives, such as selling assets, restructuring debt or obtaining additional debt financing or equity capital on terms that may be onerous or highly dilutive.
−Removed: Our ability to refinance any future indebtedness will depend on the capital markets and our financial condition at such time.
+Added: Our ability to refinance or raise any future indebtedness will depend on the capital markets and our financial condition at such time.
We may not be able to engage in any of these activities or engage in these activities on desirable terms, which could result in a default on our debt obligations.
19 unchanged sentences
In addition, if we incur additional indebtedness, the risks related to our business and our ability to service or repay our indebtedness would increase.
−Removed: The conditional conversion feature of the Notes, if triggered, may adversely affect our financial condition and results of operations.
−Removed: In the event the conditional conversion feature of the Notes is triggered, holders of the Notes will be entitled to convert the Notes, as applicable, at any time during specified periods at their option.
+Added: The conversion features of the Notes, if triggered, may adversely affect our financial condition and results of operations.
+Added: In the event the conditional conversion features of the 2025 Notes and the 2026 Notes are triggered, holders of the Notes will be entitled to convert the Notes, as applicable, at any time during specified periods at their option.
If one or more holders elect to convert their Notes, unless we elect to satisfy our conversion obligation by delivering solely shares of our Class A common stock (other than paying cash in lieu of delivering any fractional share), we would be required to settle a portion or all of our conversion obligation through the payment of cash, which could adversely affect our liquidity.
−Removed: As disclosed in Note 9 to our consolidated financial statements, the conditional conversion features of the 2023 Notes were triggered as of January 31, 2022, and the 2023 Notes are currently convertible at the option of the holders, in whole or in part, between February 1, 2022 and April 30, 2022.
−Removed: Whether the 2023 Notes will be convertible following such fiscal quarter will depend on the continued satisfaction of this condition or another conversion condition in the future.
The conditional conversion features of the 2025 Notes were triggered as of January 31, 2021 and the 2025 Notes were convertible at the option of the holders between February 1, 2021 and April 30, 2021;
1 unchanged sentence
From the date of issuance through January 31, 2023, the conditions allowing holders of the 2026 Notes to convert were not met.
−Removed: In addition, even if holders do not elect to convert their Notes, we could be required under applicable accounting rules to reclassify all or a portion of the outstanding principal of the notes as a current rather than long-term liability, which would result in a material reduction of our net working capital.
−Removed: The 2023 Notes were classified as current liabilities on the consolidated balance sheet as of January 31, 2022.
+Added: In addition, even if holders do not elect to convert their Notes, we could be required under applicable accounting rules to reclassify all or a portion of the outstanding principal of the Notes as a current rather than long-term liability, which would result in a material reduction of our net working capital and could limit our ability to raise future capital.
Transactions relating to our Notes may affect the value of our Class A common stock.
The conversion of some or all of the Notes would dilute the ownership interests of existing stockholders to the extent we satisfy our conversion obligation by delivering shares of our Class A common stock upon any conversion of such Notes.
−Removed: Our Notes may become in the future convertible at the option of their holders under certain circumstances.
+Added: Our 2025 Notes and 2026 Notes may become in the future convertible at the option of their holders under certain circumstances.
If holders of our Notes elect to convert their notes, we may settle our conversion obligation by delivering to them a significant number of shares of our Class A common stock, which would cause dilution to our existing stockholders.
−Removed: In addition, in connection with the issuance of the 2023 Notes, we entered into convertible note hedges (“Note Hedges”) with certain financial institutions (the “2023 Notes Option Counterparties”).
−Removed: We also entered into warrant transactions with the 2023 Notes Option Counterparties pursuant to which we sold warrants for the purchase of our Class A common stock (“Warrants”).
−Removed: The Note Hedges are expected generally to reduce the potential dilution to our Class A common stock upon any conversion or settlement of the 2023 Notes and/or offset any cash payments we are required to make in excess of the principal amount of converted 2023 Notes, as the case may be.
+Added: In addition, in connection with the issuance of the 2023 Notes, we entered into warrant transactions with certain financial institutions (the “2023 Notes Option Counterparties”) pursuant to which we sold warrants for the purchase of our Class A common stock (“Warrants”).
The Warrant transactions could separately have a dilutive effect to the extent that the market price per share of our Class A common stock exceeds the strike price of any Warrants unless, subject to the terms of the Warrant transactions, we elect to cash settle the Warrants.
−Removed: Through January 31, 2022, Note Hedges corresponding to approximately 6.8 million shares have been terminated or settled.
−Removed: As of January 31, 2022, Note Hedges giving us the option to purchase approximately 0.4 million shares (subject to adjustment) remained outstanding.
Through January 31, 2023, we have terminated Warrants corresponding to approximately 6 million shares.
4 unchanged sentences
This activity could cause a decrease in the market price of our Class A common stock.
−Removed: The accounting method for convertible debt securities that may be settled in cash, such as the Notes, could have a material effect on our reported financial results.
−Removed: Under FASB Accounting Standards Codification 470-20, Debt with Conversion and Other Options (“ASC 470-20”), an entity must separately account for the liability and equity components of convertible debt instruments (such as the Notes) that may be settled entirely or partially in cash upon conversion in a manner that reflects the issuer’s economic interest cost.
−Removed: ASC 470-20 requires the value of the conversion options of the Notes, representing the equity component, to be recorded as additional paid-in capital within stockholders’ equity in our consolidated balance sheet and as a discount to the Notes, which reduces their initial carrying value.
−Removed: The carrying value of the Notes, net of the applicable discount recorded, will be accreted up to the principal amount of the Notes, as the case may be, from the issuance date until maturity, which will result in non-cash charges to interest expense in our consolidated statements of operations.
−Removed: Accordingly, we will report lower net income or higher net loss in our financial results because ASC 470-20 requires interest to include both the current period’s accretion of the debt discount and the instrument’s coupon interest, which could adversely affect our reported or future financial results, the trading price of our Class A common stock and the respective trading price of the Notes.
−Removed: Accounting standards in the future will result in changes to the current ASC 470-20 accounting model.
−Removed: The FASB issued an accounting standards update that eliminates the liability and equity component separation model for convertible debt instruments with a cash conversion feature.
−Removed: Among other potential impacts, this change is expected to reduce reported interest expense, increase reported net income or lower net loss and result in a reclassification of certain balance sheet amounts from stockholders' equity to liabilities as it relates to the Notes.
General Risk Factors
3 unchanged sentences
From time to time, there may be changes in our executive management team resulting from the hiring or departure of executives.
−Removed: For example, our former Chief Financial Officer stepped down from his role in June 2021, and our current Chief Financial Officer served on an interim basis from June 2021 until his permanent appointment in January 2022.
+Added: For example, our President, Worldwide Field Operations retired at the end of our fiscal year and our Executive Vice Chairman and co-founder is on sabbatical through October 2023.
Such changes in our executive management team may be disruptive to our business.
19 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.