What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2025-03-05 compared with 2024-03-01 · 363 added, 494 removed, 376 unchanged (70% of the section changed)

6 unchanged sentences

A summary of our risks includes, but is not limited to, the following:

• Adverse general economic, market and industry conditions and reductions in workforce identity and customer identity spending have, in the past, and may, in the future, reduce demand for our products, which could harm our revenue, results of operations and cash flows.

• In the past we have experienced cybersecurity incidents that allowed unauthorized access to our systems or data or our customers’ data, harmed our reputation, created additional liability and adversely impacted

our financial results.

We may experience similar incidents in the future which may also include disabling access to our service.

• Adverse general economic, market and industry conditions and reductions in workforce identity and customer identity spending have, in the past, and may, in the future, reduce demand for our solutions, which could harm our revenue, results of operations and cash flows.

• We have experienced rapid growth in prior periods, and any failure to effectively manage future growth could harm our business and future prospects.

• Our prior growth rates may not be indicative of our future growth.

As our costs increase, we may not be able to generate sufficient revenue to achieve and, if achieved, maintain profitability.

• We have a history of losses, and we expect to incur losses for the foreseeable future.

• If we fail to manage our growth effectively, we may be unable to execute our business plan, maintain high levels of service and customer satisfaction or adequately address competitive challenges.

• If we fail to manage our growth effectively or fail to execute our business plan, we may not be able to maintain high levels of service and customer satisfaction or adequately address competitive challenges.

• We face intense competition, especially from larger, well-established companies, and we may lack sufficient financial or other resources to maintain or improve our competitive position.

• If we are unable to attract new customers, sell additional products to our existing customers or develop new products and enhancements to our products that achieve market acceptance, our revenue growth and profitability will be harmed.

• Our business depends on our customers renewing their subscriptions and purchasing additional licenses or subscriptions from us.

Any material decline in our Dollar-Based Net Retention Rate would harm our future results of operations.

• Customer growth has slowed in recent periods and could fall below expectations.

• We have a history of losses, and we may not be consistently profitable in the future.

• Our business depends on our ability to retain existing customers, and our revenues and results of operations could be adversely impacted if they do not renew their subscriptions or purchase additional licenses or subscriptions with us.

• If we are unable to grow our customer base, our revenue growth and profitability could be harmed.

• We may experience quarterly fluctuations in our results of operations due to a number of factors that make our future results difficult to predict and could cause our results of operations to fall below analyst or investor expectations.

• If there are interruptions or performance problems associated with our technology or infrastructure, our existing customers may experience service outages, and our new customers may experience delays in the deployment of our platform.

• We have, in the past, failed or been perceived to have failed to fully comply with the privacy or security provisions of our privacy policy, our contracts and/or legal or regulatory requirements, which could result in proceedings, actions or penalties against us.

• Interruptions or performance problems that impact the functionality of our technology, systems, or infrastructure could result in delays in the deployment of our platforms.

• In the past, we have experienced cybersecurity incidents that allowed unauthorized access to our systems or data or our customers’ data, harmed our reputation, created additional liability, and adversely impacted our financial results.

We and our third-party service providers may experience similar incidents in the future which may also include disabling access to our service.

• We and our third-party service providers have, in the past, failed or been perceived to have failed to fully comply with the privacy or security provisions of our privacy policy, our contracts and/or legal or regulatory requirements, which could result in proceedings, actions or penalties against us.

We may experience similar incidents in the future.

• If we are unable to ensure that our solutions integrate or interoperate with a variety of operating systems, platforms, services, software applications devices, mobile phones and other hardware form factors that are developed by others, our platforms may become less competitive and our results of operations may be harmed.

• Real or perceived errors, failures, vulnerabilities or bugs in our solutions, including deployment complexity, have, in the past and could, in the future, harm our business and results of operations.

• Because we generally recognize revenue from our subscriptions and support services over the term of the relevant service period, a decrease in sales during a reporting period may not be immediately reflected in our results of operations for that period.

• The stock price of our Class A common stock may be volatile or may decline.

1 unchanged sentence

This will limit or preclude your ability to influence corporate matters, including the election of directors, amendments of our organizational documents, and any merger, consolidation, sale of all or substantially all of our assets, or other major corporate transaction requiring stockholder approval.

• Servicing our debt may require a significant amount of cash.

We may not have sufficient cash flow from our business to pay our indebtedness.

• Transactions relating to our convertible notes may affect the value of our Class A common stock.

• We depend on our executive officers and other key employees, and the loss of one or more of these employees or an inability to attract and retain other highly skilled employees could harm our business.

Risks Related to Our Business and Industry

Adverse general economic, market and industry conditions and reductions in workforce identity and customer identity spending have, in the past, and may, in the future, reduce demand for our products, which could harm our revenue, results of operations and cash flows.

Our revenue, results of operations and cash flows depend on the overall demand for our products.

issues, such as Russia’s invasion of Ukraine, or the availability and cost of credit have and could continue to lead to increased market volatility, decreased consumer confidence and diminished growth expectations in the U.S.

economy and abroad, which in turn could result in reductions in workforce identity and customer identity spending by our existing and prospective customers.

Adverse general economic, market and industry conditions and reductions in workforce identity and customer identity spending have, in the past, and may, in the future, reduce demand for our solutions, which could harm our revenue, results of operations and cash flows.

Our revenue, results of operations and cash flows depend on the overall demand for our solutions.

Concerns about the inflation and interest rate environment, the instability of financial institutions, health epidemics, the systemic impact of a widespread recession (in the United States or internationally), energy costs, geopolitical issues, such as Russia’s invasion of Ukraine, or the availability and cost of credit have and could continue to lead to increased market volatility, decreased consumer confidence and diminished growth expectations in the U.S.

economy and abroad, which in turn could result in reductions in spending on our platforms by our existing and prospective customers.

These economic conditions can occur abruptly.

Prolonged economic slowdowns may result in customers requesting us to renegotiate existing contracts on less advantageous terms to us than those currently in place or defaulting on payments due on existing contracts or not renewing at the end of the contract term.

For example, rising interest rates in the United States have begun to affect businesses across many industries, including ours, by increasing the costs of labor, employee healthcare and other components, which may further constrain our, our customers’ and prospective customers’ budgets.

For example, rising interest rates in the United States have affected businesses across many industries, including ours, by increasing the costs of labor, employee healthcare and other components, which may further constrain our, our customers’ and prospective customers’ budgets.

To the extent there is a sustained general economic downturn, and our platforms and services are perceived by customers or potential customers as costly, or too difficult to deploy or migrate to, our revenue may be disproportionately affected by delays or reductions in spending.

Our customers may merge with other entities who use alternative identity solutions and, during weak economic times, there is an increased risk that one or more of our customers will file for bankruptcy protection, either of which may harm our revenue, profitability and results of operations.

We also face risk from international customers that file for bankruptcy protection in foreign jurisdictions, particularly given that the application of foreign bankruptcy laws may be more difficult to predict.

In addition, we may determine that the cost of pursuing any claim may outweigh the recovery potential of such claim.

As a result, if economic growth in countries where we do business slows or if such countries experience further economic recession, it could harm our business, revenue, results of operations and cash flows.

We have experienced rapid growth in prior periods, and any failure to effectively manage future growth could harm our business and future prospects.

We have experienced rapid growth since our founding in 2009.

As we continue efforts to expand our business globally, we have faced new macroeconomic conditions, as well as operational and organizational challenges, that make it difficult to forecast our revenue and evaluate our business and future prospects.

We have encountered and will continue to encounter risks and uncertainties that growing companies frequently experience in rapidly changing industries and macroeconomic environments, including the risks and uncertainties described in this document.

Additionally, the sales cycle for the evaluation and implementation of our platform, which typically extends for multiple months for enterprise deals, may also cause us to experience a delay between increasing operating expenses and the generation of corresponding revenue, if any.

Accordingly, we may be unable to prepare accurate internal financial forecasts or replace anticipated revenue that we do not receive as a result of delays arising from these factors, and our results of operations in future reporting periods may be below the expectations of investors.

If we do not address these risks successfully, our results of operations could differ materially from our estimates and forecasts or the expectations of investors, causing our business to suffer and our stock price to decline.

Our prior growth rates may not be indicative of our future growth.

As our costs increase, we may not be able to generate sufficient revenue to achieve and, if achieved, maintain profitability.

From fiscal 2022 to fiscal 2023, our revenue grew from $1,300 million to $1,858 million, an increase of 43%, and from fiscal 2023 to fiscal 2024, our revenue grew from $1,858 million to $2,263 million, an increase of 22%.

In future periods, we may not be able to sustain revenue growth consistent with recent history, or at all.

We believe our revenue growth depends on a number of factors, such as macroeconomic conditions including the inflation and interest rate environment and budget constraints, as well as, but not limited to, our ability to:

• price our platform effectively so that we are able to attract and retain customers without compromising our profitability;

• attract new customers, successfully deploy and implement our platform, upsell or otherwise increase our existing customers’ use of our platform, obtain customer renewals and provide our customers with excellent customer support;

• increase our network of channel partners;

• adequately expand our sales force, and maintain or increase our sales force’s productivity;

• protect against security breaches of, technical difficulties with, or interruptions to, the delivery and use of our platform and products, and any negative market perception or customer reactions related to, or arising from the disclosure of, such breaches, difficulties or interruptions;

• successfully identify and enter into agreements with suitable acquisition targets, integrate any acquisitions and integrate acquired technologies into our existing products or use them to develop new products;

• successfully introduce new products, enhance existing products and address new use cases;

• introduce our platform to new markets outside of the United States;

• successfully compete against larger companies and new market entrants;

• increase awareness of our brand on a global basis.

If we are unable to accomplish any of these tasks, our revenue growth will be harmed.

We also expect our operating expenses to increase in future periods, and if our revenue growth does not increase to offset these anticipated increases in our operating expenses, our business, financial position and results of operations will be harmed, and we may not be able to achieve or maintain profitability.

We have a history of losses, and we expect to incur losses for the foreseeable future.

We have incurred significant net losses in each year since our inception, including net losses of $848 million, $815 million and $355 million in fiscal 2022, 2023 and 2024, respectively.

We expect to continue to incur net losses for the foreseeable future.

We expect our operating expenses to significantly increase over the next several years as we hire additional personnel, particularly in sales and marketing, expand and improve the effectiveness of our distribution channels, expand our operations and infrastructure, both domestically and internationally, pursue business combinations and continue to develop our platform.

If our revenue does not increase to offset these increases in our operating expenses, we will not be profitable in future periods.

While historically, our total revenue has grown, not all components of our total revenue have grown consistently.

Further, in future periods, our revenue growth could slow or our revenue could decline for a number of reasons, including slowing demand for our software, increasing competition, any failure to gain or retain channel partners, a decrease in the growth of our overall market, or our failure, for any reason, to continue to capitalize on growth opportunities.

As a result, our past financial performance should not be considered indicative of our future performance.

Any failure by us to achieve or sustain profitability on a consistent basis could cause the value of our common stock to decline.

If we fail to manage our growth effectively, we may be unable to execute our business plan, maintain high levels of service and customer satisfaction or adequately address competitive challenges.

We have experienced, and may continue to experience, rapid growth and organizational change, which has placed, and may continue to place, significant demands on our management and our operational and financial resources.

For example, our headcount has grown from 5,030 employees as of January 31, 2022 to 5,908 employees as of January 31, 2024.

In order to manage our growth and better align our organizational structure and resources with our business priorities, we may undertake restructuring plans from time to time.

For example, during the first quarter of each of fiscal 2024 and fiscal 2025, we announced separate world-wide restructuring plans intended to reduce operating expenses and improve profitability that involved a reduction of our workforce by approximately 300 and 400 full-time employees, respectively.

We may encounter challenges in the execution of these restructuring efforts, such as adverse impacts on employee morale or attrition beyond the intended reductions, and these challenges could impact our ability to execute on our business initiatives, which could cause our restructuring efforts to not be as effective as anticipated and harm our financial results.

We have also experienced significant growth in the number of customers, users and logins and in the amount of data that our SaaS infrastructure supports.

Finally, our organizational structure is becoming more complex as we improve our operational, financial and management controls as well as our reporting systems and procedures.

We will require significant capital expenditures and the allocation of valuable management resources to grow and change in these areas without undermining our culture of rapid innovation, teamwork and attention to customer success, which has been central to our growth so far.

If we fail to manage our anticipated growth and change in a manner that preserves the key aspects of our corporate culture, the quality of our platform may suffer, which could negatively affect our brand and reputation and harm our ability to retain and attract customers and employees.

We have established international offices in the Americas, Asia-Pacific and Europe, and we plan to continue to expand our international operations in the future.

Our expansion has placed, and our expected future growth will continue to place, a significant strain on our managerial, customer operations, research and development, marketing and sales, administrative, financial and other resources.

If we are unable to manage our continued growth successfully, our business and results of operations could suffer.

Our prior revenue growth rates may not be indicative of our future growth or performance.

We have experienced revenue growth rates of 43%, 22% and 15% during fiscal 2023, 2024 and 2025, respectively.

Our revenue for any quarterly or annual period should not be relied upon as an indication of our future revenue or revenue growth for any future period, as we may not be able to sustain revenue growth consistent with recent history, or at all.

Revenue growth depends on several factors, including pricing our platforms to attract new and retain existing customers;

managing demand for our solutions;

competing against larger companies and new market entrants;

capitalizing on new acquisitions, technologies or growth opportunities;

and other conditions described in these risk factors.

If we are unable to grow our revenue, it will be difficult to maintain our profitability, or maintain or increase our cash flow on a consistent basis.

We expect our operating expenses to increase in future periods as we continue to expand our business.

If our revenue growth does not increase to offset these anticipated increases in our operating expenses, our business, financial position and results of operations will be harmed, and we may not be able to achieve or consistently maintain profitability.

Additionally, the sales cycle for the evaluation and implementation of our platforms, which typically extends for multiple months for enterprise deals, may also cause us to experience a delay between increasing operating expenses and generating corresponding revenue, if any.

We may not be able to prepare accurate internal financial forecasts or replace anticipated revenue that we lost as a result of such delays, and our results of operations in future reporting periods could differ materially from our

estimates and forecasts, or may not meet the expectations of our investors, which could cause our business to suffer and our stock price to decline.

If we fail to manage our growth effectively or fail to execute our business plan, we may not be able to maintain high levels of service and customer satisfaction or adequately address competitive challenges.

We have experienced rapid growth and organizational change, which has placed, and may continue to place, significant demands on our management and our operational and financial resources.

In order to manage future growth and better align our organizational structure and resources with our business priorities, we may undertake restructuring plans from time to time.

For example, in recent years we have announced restructuring plans intended to reduce operating expenses and improve profitability that involved reductions of our workforce.

We have in the past encountered, and may in the future encounter, challenges in the execution of these restructuring efforts, such as adverse impacts on employee morale or attrition beyond the intended reductions, and these challenges could impact our ability to execute on our business initiatives, which could cause our restructuring efforts to not be as effective as anticipated and harm our financial results.

In addition, as we expand our business, it is important that we continue to maintain a high level of customer service and satisfaction.

2 unchanged sentences

We face intense competition, especially from larger, well-established companies, and we may lack sufficient financial or other resources to maintain or improve our competitive position.

The markets for our products are rapidly evolving, highly competitive and subject to shifting customer needs and frequent introductions of new technologies.

The markets for our solutions are rapidly evolving, highly competitive, and subject to shifting customer needs and frequent introductions of new technologies.

As the markets in which we operate continue to mature and new technologies and competitors enter such markets, we expect competition to intensify.

Our competitor categories include, but are not limited to:

We compete with both cloud-based and on-premise enterprise application software providers including, but not limited to:

authentication providers;

3 unchanged sentences

other customer identity and access management providers;

• Solutions developed in-house by our potential customers.

We compete with both cloud-based and on-premise enterprise application software providers.

Our competitors vary in size and in the breadth and scope of the products and services offered.

However, many of our competitors have substantial competitive advantages such as significantly greater financial, technical, sales and marketing, distribution, customer support or other resources, larger intellectual property portfolios, longer operating histories, greater resources to make strategic acquisitions and greater name recognition than we do.

and solutions developed in-house by our potential customers.

Our principal competitor is Microsoft.

With the continuing merger and acquisition activity in the technology industry, particularly transactions involving security or identity and access management technologies, there is a greater likelihood that we will compete with other large technology companies in the future in both the workforce identity and customer identity markets.

In addition, some of our larger competitors have substantially broader product offerings and leverage their relationships based on other products or incorporate functionality into existing products to gain business in a manner that discourages users from purchasing our products, including through selling at zero or negative margins, product bundling or closed technology platforms.

Potential customers may also prefer to purchase from their existing suppliers rather than a new supplier regardless of product performance or features.

These larger competitors often have broader product lines and market focus and as a result are not as susceptible to downturns in a particular market.

Our competitors may also seek to acquire new offerings or repurpose their existing offerings to provide identity solutions with subscription models.

Conditions in our market could change rapidly and significantly as a result of technological advancements, partnering by our competitors or continuing market consolidation.

New start-up companies that innovate and large competitors that are making significant investments in research and development may invent similar or superior products and technologies that compete with our products.

In addition, some of our competitors may enter into new alliances with each other or may establish or strengthen cooperative relationships with systems integrators, third-party consulting firms or other parties.

Any such consolidation, acquisition, alliance or cooperative relationship could lead to pricing pressure and our loss of market share and could result in a competitor with greater financial, technical, marketing, service and other resources, all of which could harm our ability to compete.

Furthermore, organizations may be more willing to incrementally add solutions to their existing infrastructure from competitors than to replace their existing infrastructure with our products.

These competitive pressures in our market or our failure to compete effectively may result in price reductions, fewer orders, reduced revenue and gross margins, increased net losses, and loss of market share.

Any failure to meet and address these factors could harm our business, results of operations and financial condition.

If we are unable to attract new customers, sell additional products to our existing customers or develop new products and enhancements to our products that achieve market acceptance, our revenue growth and profitability will be harmed.

To increase our revenue and achieve and maintain profitability, we must add new customers or sell additional products to our existing customers.

Numerous factors, however, may impede our ability to add new customers and sell additional products to our existing customers, including our failure to convert new organizations into paying customers, failure to attract, effectively train, retain and motivate sales and marketing personnel, failure to develop or expand relationships with channel partners, failure to successfully deploy products for new customers and provide quality customer support, failure to ensure the effectiveness of our marketing programs, or any negative market perception stemming from past or future security breaches.

In addition, if prospective customers do not perceive our platform to be of sufficiently high value and quality, we will not be able to attract the number and types of new customers that we are seeking.

In addition, our ability to attract new customers and increase revenue from existing customers depends in large part on our ability to enhance and improve our existing products and to introduce compelling new products that reflect the changing nature of our markets.

The success of any enhancement to our products depends on several factors, including timely completion and delivery, competitive pricing, adequate quality testing, integration with existing technologies and our platform and overall market acceptance.

If we are unable to successfully develop new products, enhance our existing products to meet customer requirements, or otherwise gain market acceptance, our business, results of operations and financial condition would be harmed.

Further, to grow our business, we must convince developers to adopt and build their applications using our APIs and products.

We believe that these developer-built applications facilitate greater usage and customization of our products.

If these developers stop developing on or supporting our platform, we will lose the benefit of network effects that have contributed to the growth in our number of customers, and our business (including the performance levels of our products), results of operations and financial condition could be harmed.

Our business depends on our customers renewing their subscriptions and purchasing additional licenses or subscriptions from us.

Any material decline in our Dollar-Based Net Retention Rate would harm our future results of operations.

To continue to grow our business, it is important that our customers renew their subscriptions when existing contract terms expire and that we expand our commercial relationships with our existing customers.

Our customers have no obligation to renew their subscriptions, and our customers may decide not to renew their subscriptions with a similar contract period, at the same prices and terms or with the same or a greater number of users.

We have experienced significant growth in the number of users of our platform, but we do not know whether we will continue to achieve similar user growth rates in the future.

Many of our competitors have significantly greater financial, technical, sales and marketing, distribution, customer support or other resources, larger intellectual property portfolios, longer operating histories, greater resources to make strategic acquisitions, more established relationships with third-party service providers, and greater name recognition than we do.

They may also have a larger customer base, many of which may prefer to purchase from the same competitor rather than replace their existing infrastructure with our solutions.

Some of our larger competitors have substantially broader product offerings, or greater resources to acquire new offerings or repurpose existing offerings to provide identity solutions with subscription models.

As a result, they can leverage their relationships based on other solutions, or incorporate functionality into existing solutions, to gain business in a manner that discourages users from purchasing our solutions, including selling at zero or negative margins, bundling products or maintaining closed technology platforms.

In addition, larger competitors, as well as new start-up companies that innovate, make significant investments in research and development and may invent similar or superior solutions that compete with our solutions.

These competitive pressures or our failure to compete effectively may result in price reductions, fewer orders, reduced revenue and gross margins, increased net losses, and loss of market share, which could harm our business, results of operations and financial condition.

We have a history of losses, and we may not be consistently profitable in the future.

While we achieved profitability in fiscal 2025, we have incurred net losses of $355 million and $815 million in fiscal 2024 and 2023, respectively.

We will need to generate and sustain increased revenue levels in future periods in order to become consistently profitable, and even if we do, we may not be able to maintain or increase our level of profitability.

We may incur losses in the future for a number of reasons, including the risks described in these risk factors, an increase in operating expense, and other unknown risks.

Any failure by us to sustain profitability on a consistent basis could cause the value of our common stock to decline.

Our business depends on our ability to retain existing customers, and our revenues and results of operations could be adversely impacted if they do not renew their subscriptions or purchase additional licenses or subscriptions with us.

Our ability to increase and maintain revenue growth depends, in part, on our ability to retain and expand our commercial relationships with our existing customers.

This requires that our existing customers continue to use our platforms, either by purchasing additional subscriptions or by renewing their subscriptions when existing contract terms expire.

Our customers have no obligation to renew their subscriptions after the expiration of their subscription period.

They may decide not to renew their subscriptions with a similar contract period, at the same prices and terms, or with the same or a greater number of users.

In the past, some of our customers have elected not to renew their agreements with us, and it is difficult to accurately predict long-term customer retention and expansion rates.

Our customer retention and expansion has, in the past, and may, in the future, decline or fluctuate as a result of a number of factors, including our customers’ satisfaction with our products, our product support, our prices and pricing plans, particularly in light of macroeconomic conditions, the inflation and interest rate environment and increased costs, the prices of competing software products, reductions in our customers’ spending levels, user adoption of our platform, deployment success, negative sentiment stemming from cybersecurity incidents, utilization rates by our customers, new product releases and changes to the packaging of our product offerings.

If our customers do not purchase additional subscriptions or renew their subscriptions, renew on less favorable terms or fail to add more users, our revenue may decline or grow less quickly than anticipated, which would harm our future results of operations.

Furthermore, if our contractual subscription terms were to shorten it could lead to increased volatility of, and diminished visibility into, future recurring revenue.

If our sales of new or recurring subscriptions and software-related support service contracts decline from existing customers, our revenue and revenue growth may decline, and our business will suffer.

Customer growth has slowed in recent periods and could fall below expectations.

We have experienced significant growth in the number of our customers since our founding, but this growth has slowed in recent periods.

As we increase our focus on sales to the world’s largest organizations, we do not expect customer growth to continue at the same pace as it has previously.

This could cause customer growth to fall below analyst or investor expectations.

If we fail to meet or exceed such expectations for this or any other reason, the market price of our Class A common stock could fall substantially, and we could face costly lawsuits, including securities class action suits.

Customer retention and expansion has, in the past, and may, in the future, decline or fluctuate as a result of a number of factors, such as customers’ satisfaction with our solutions;

our prices and pricing plans, including as compared to those of competing software solutions;

unfavorable macroeconomic conditions;

reductions in customer spending levels;

negative sentiment stemming from cybersecurity incidents;

customer utilization rates;

new offerings;

and changes to the packaging of our product offerings.

If existing customers do not purchase additional subscriptions or renew their subscriptions, renew on less favorable terms or fail to add more users, our revenue may decline or grow less quickly than anticipated, which would harm our future results of operations.

If we are unable to grow our customer base, our revenue growth and profitability could be harmed.

We aim to increase our revenue and achieve and maintain profitability by growing our customer base, particularly through sales to larger organizations.

As our market matures and product offerings evolve, we believe that competitors will introduce lower cost or differentiated solutions that compete, or are perceived to compete, with our solutions.

If prospective customers view the cost or features of competitors’ solutions as preferable to ours, or do not perceive our solutions to be of sufficiently high value and quality, we could fail to attract the number and types of new customers we are seeking.

Prospective customers’ decisions to purchase our solutions depends on a variety of other factors, including those specified under the risk factor titled “ Our business depends on our ability to retain existing customers, and our revenues and results of operations could be adversely impacted if they do not renew their subscriptions or purchase additional licenses or subscriptions with us ,” and described elsewhere in these risk factors.

Any failure to attract new customers could impede our success in selling new subscriptions and adversely impact our business, financial condition and results of operations.

We may experience quarterly fluctuations in our results of operations due to a number of factors that make our future results difficult to predict and could cause our results of operations to fall below analyst or investor expectations.

Our quarterly results of operations fluctuate from quarter to quarter as a result of a number of factors, many of which are outside of our control and may be difficult to predict, including, but not limited to:

• the level of demand for our platform;

• our ability to attract new customers, obtain renewals from existing customers and upsell or otherwise increase our existing customers’ use of our platform;

• the timing and success of new product introductions by us or our competitors or any other change in the competitive landscape of our market;

• security breaches of, technical difficulties with, or interruptions to, the delivery and use of our platform and products, and any negative market perception or customer reactions related to, or arising from the disclosure of, such breaches, difficulties or interruptions;

• pricing pressure as a result of competition, the inflation and interest rate environment and increased costs;

Our results of operations fluctuate from quarter to quarter as a result of a number of factors, many of which are outside of our control and may be difficult to predict, including, but not limited to:

• fluctuations in demand for, or pricing of, our platforms, including as a result of macroeconomic conditions or competition;

• our ability to retain and increase sales to existing customers, attract new customers or otherwise increase the use of our platforms;

• the timing and success of introductions of new solutions by us or our competitors, or any other change in the competitive landscape of our market;

• security breaches of, technical difficulties with, or interruptions to, the delivery and use of our solutions, and any negative market perception or customer reactions related to, or arising from the disclosure of, such breaches, difficulties or interruptions;

• seasonal buying patterns for IT spending;

1 unchanged sentence

• changes in remaining performance obligations (“RPO”) due to seasonality, the timing of and compounding effects of renewals, invoice duration, size and timing, new business linearity between quarters and within a quarter, average contract term or fluctuations due to foreign currency movements, all of which may impact implied growth rates;

• errors in our forecasting of the demand for our products, which could lead to lower revenue, increased costs or both;

• increases in and timing of sales and marketing and other operating expenses that we may incur to grow and expand our operations and to remain competitive;

• our ability to comply with privacy laws and requirements;

• errors in our forecasting of the demand for our solutions, which could lead to lower revenue, increased costs or both;

• increases in and timing of sales and marketing and other operating expenses that we may incur to grow our brand, expand our operations and remain competitive;

• our ability to comply with applicable laws and requirements, including data privacy and cybersecurity regimes;

• costs related to the acquisition of businesses, talent, technologies or intellectual property, including potentially significant amortization costs and possible write-downs;

• credit or other difficulties confronting our channel partners;

• adverse litigation judgments, settlements of litigation and other disputes or other litigation-related or dispute-related costs;

• credit or other difficulties confronting our third-party service providers, including channel partners;

• costs related to litigation, including adverse judgments, settlements and other disputes;

• the impact of new accounting pronouncements and associated system implementations;

2 unchanged sentences

• expenses related to real estate, including our office leases, and other fixed expenses;

• health epidemics, such as COVID-19, influenza and other highly communicable diseases or viruses;

• general economic conditions in either domestic or international markets, including the inflation and interest rate environment, geopolitical uncertainty and instability.

• general economic, market and industry conditions in domestic or international markets, including the inflation and interest rate environment, geopolitical uncertainty and instability.

Any one or more of the factors above may result in significant fluctuations in our results of operations.

You should not rely on our past results as an indicator of our future performance.

The variability and unpredictability of our quarterly results of operations or other operating metrics could result in our failure to meet our expectations or those of analysts that cover us or investors with respect to revenue or

other metrics for a particular period.

If we fail to meet or exceed such expectations for these or any other reasons, the market price of our Class A common stock could fall substantially, and we could face costly lawsuits, including securities class action suits.

Our ability to introduce new products and features is dependent on adequate research and development resources and our ability to successfully complete acquisitions.

Our ability to introduce new solutions is dependent on adequate research and development resources and, in part, on our ability to successfully complete acquisitions.

If we do not adequately fund our research and development efforts or complete acquisitions successfully, we may not be able to compete effectively and our business and results of operations may be harmed.

To remain competitive, we must continue to develop new products, applications and enhancements to our existing platform.

To remain competitive, we must continue to develop new solutions, applications and enhancements to our existing portfolio.

This is particularly true as we further expand and diversify our capabilities.

Maintaining adequate research and development resources, such as the appropriate personnel and development technology, to meet the demands of the market is essential.

If we elect not to or are unable to develop products internally, we may choose to expand into a certain market or strategy via an acquisition for which we could potentially pay too much or fail to successfully integrate into our operations.

Further, many of our competitors expend a considerably greater amount of funds on their respective research and development programs, and those that do not may be acquired by larger companies that could allocate greater resources to our competitors’ research and development programs.

If we elect not to or are unable to develop solutions internally, we may choose to expand into a certain market or strategy via an acquisition for which we could potentially pay too much or fail to successfully integrate into our operations.

Further, many of our competitors expend a considerably greater amount of funds on their respective research and development programs, and those that do not have, in some cases, been acquired by larger companies that allocate greater resources to our competitors’ research and development programs.

Our failure to maintain adequate research and development resources or to compete effectively with the research and development programs of our competitors would give an advantage to such competitors and may harm our business, results of operations and financial condition.

Even if we maintain adequate research and development resources, we may be unable to monetize newly developed products or features such that we can recoup our research and development expenditures.

For example, if we develop a new product feature but our competitors give an equivalent feature away for free, we may need to also include our newly developed feature for free as part of an existing product offering to remain competitive in the marketplace.

Even if we maintain adequate research and development resources, we may be unable to monetize newly developed solutions or features such that we can recoup our research and development expenditures.

For example, if we develop a new feature but our competitors give an equivalent feature away for free, we may need to also include our newly developed feature for free as part of an existing product offering to remain competitive in the marketplace.

Such a loss of anticipated revenue to offset our research and development expenditures may harm our business, results of operations and financial condition.

Future acquisitions, investments, partnerships or alliances could be difficult to identify and integrate, divert the attention of management personnel, disrupt our business, dilute stockholder value and harm our results of operations and financial condition.

We have in the past acquired, and we may in the future seek to acquire or invest in, businesses, products, teams or technologies that we believe could complement or expand our current platform, enhance our technical capabilities or otherwise offer growth opportunities.

We have in the past acquired, and we may in the future seek to acquire or invest in, businesses, products, teams or technologies that we believe could complement or expand our current platforms, enhance our technical capabilities, or otherwise offer growth opportunities.

The pursuit of potential acquisitions may divert the attention of management and cause us to incur various expenses in identifying, investigating and pursuing suitable acquisitions, whether or not they are consummated.

If we acquire additional businesses, we may not be able to successfully integrate and retain the acquired personnel;

integrate the acquired operations and technologies;

adequately test and assimilate the internal control processes of the acquired business in accordance with the requirements of Section 404 of the Sarbanes-Oxley Act of 2002 (“Sarbanes-Oxley Act”);

or effectively manage the combined business.

We may also be required to assume liabilities or incur unforeseen costs, such as those arising from the acquired company’s failure to comply with legal or regulatory requirements and litigation matters.

Any acquisition or strategic transaction we do consummate could fail to produce the benefits we hope to achieve, which could disrupt our own business or those of our partners and customers, or result in future impairment charges.

In particular, from time to time we invest in private growth stage companies for strategic reasons and to support key business initiatives.

All of our venture investments are subject to a risk of partial or total loss of investment capital, and we may not realize a return on these investments.

In addition, we have limited experience in acquiring other businesses.

If we acquire additional businesses, we may not be able to successfully integrate and retain the acquired personnel, integrate the acquired operations and technologies, and adequately test and assimilate the internal control processes of the acquired business in accordance with the requirements of Section 404 of the Sarbanes-Oxley Act of 2002 (“Sarbanes-Oxley Act”), or effectively manage the combined business following the acquisition.

For example, we have experienced aspects of such challenges in connection with our May 2021 acquisition of Auth0.

We may not be able to find and identify desirable acquisition targets or we may not be successful in entering into an agreement with any particular target.

Acquisitions could also result in dilutive issuances of equity securities, use of our available cash or the incurrence of debt, or in adverse tax consequences or unfavorable accounting treatment, which could harm our results of operations.

In addition, from time to time we invest in private growth stage companies for strategic reasons and to support key business initiatives, and we may not realize a return on these investments.

All of our venture investments are subject to a risk of partial or total loss of investment capital.

Acquisitions and strategic transactions involve numerous risks, including:

• delays or reductions in customer purchases for both us and the acquired business;

• disruption of partner and customer relationships;

• potential loss of key employees of the acquired company;

• claims by and disputes with the acquired company’s employees, customers, stockholders or third parties;

• unknown liabilities or risks associated with the acquired business, product or technology, such as contractual obligations, potential security vulnerabilities of the acquired company and its products and services, potential intellectual property infringement, costs arising from the acquired company’s failure to comply with legal or regulatory requirements and litigation matters;

• acquired technologies or products may not comply with legal or regulatory requirements and may require us to make additional investments to make them compliant;

• acquired technologies or products may not be able to provide the same support service levels that we generally offer with our other products;

• acquired businesses, technologies or products could be viewed unfavorably by our partners, our customers, our stockholders or securities analysts;

• unforeseen integration or other expenses;

• future impairment of goodwill or other acquired intangible assets.

In addition, if an acquired business fails to meet our expectations, our business, results of operations and financial condition could suffer.

Because our long-term success depends, in part, on our ability to expand the sales of our products to customers located outside of the United States, our business will be susceptible to risks associated with international operations.

We currently have sales personnel outside the United States and maintain offices outside the United States in the Americas, Asia-Pacific and Europe, and we plan to continue to expand our international operations.

Our international revenue was 22% and 21% of our total revenue in fiscal 2023 and fiscal 2024, respectively.

We may not be able to identify desirable acquisition targets, or we may not be successful in entering into an agreement with any particular target.

Acquisitions could also result in dilutive issuances of equity securities, use of our available cash or the incurrence of debt, or in adverse tax consequences or unfavorable accounting treatment.

If an acquired business fails to meet our expectations, our business, results of operations and financial condition could suffer.

Because our long-term success depends, in part, on our ability to expand the sales of our solutions to customers located outside of the United States, our business will be susceptible to risks associated with international operations.

We currently have sales personnel outside the United States and maintain offices outside the United States in the Americas, Asia-Pacific and Europe, and our international revenue was 21% of our total revenue in fiscal 2024 and fiscal 2025.

Any international expansion efforts that we may undertake may not be successful.

In addition, conducting international operations subjects us to new risks, some of which we have not generally faced in the United States.

These risks include, among other things:

• macroeconomic conditions, including the inflation and interest rate environment;

• unexpected costs and errors in the localization of our products, including translation into foreign languages and adaptation for local practices and regulatory requirements;

• lack of familiarity and burdens of complying with foreign laws, legal standards, privacy standards, regulatory requirements, tariffs and other barriers;

• laws and business practices favoring local competitors or commercial parties;

• costs and liabilities related to compliance with the numerous and ever-growing landscape of U.S.

and international data privacy and cybersecurity regimes, many of which involve disparate standards and enforcement approaches, to address cross-border data flows;

• greater risk that our foreign employees or partners will fail to comply with U.S.

and foreign laws;

• practical difficulties of enforcing intellectual property rights in countries with fluctuating laws and standards and reduced or varied protection for intellectual property rights in some countries;

We may face challenges, including those not generally faced in the United States, such as managing and staffing international operations, and becoming familiar with varying technology standards, local laws and business practices.

Conducting international operations also subjects us to, among other risks described in these risk factors:

• political, economic and social uncertainties, including macroeconomic conditions;

• unexpected changes in, or costs and liabilities related to, compliance with foreign legal and regulatory requirements, such as data privacy and cybersecurity regimes;

intellectual property rights protections;

and requirements relating to the localization of our solutions;

• restrictive governmental actions focusing on cross-border trade, including taxes, trade laws, tariffs, import and export restrictions or quotas, barriers, sanctions, custom duties or other trade restrictions;

• unexpected changes in legal and regulatory requirements;

• difficulties in managing systems integrators and technology partners.

• differing technology standards;

• longer accounts receivable payment cycles and difficulties in collecting accounts receivable;

• difficulties in managing and staffing international operations and differing employer/employee relationships and local employment laws;

• political, economic and social instability, war, terrorist activities or armed conflict, including Russia's invasion of Ukraine;

• global economic uncertainty caused by global political events;

• health epidemics, such as COVID-19, influenza and other highly communicable diseases or viruses;

• fluctuations in exchange rates that may increase the volatility of our foreign-based revenue and expense;

• potentially adverse tax consequences, including the complexities of foreign value added tax (or other tax) systems and restrictions on the repatriation of earnings.

Additionally, operating in international markets also requires significant management attention and financial resources.

We cannot be certain that the investment and additional resources required in establishing operations in other countries will produce desired levels of revenue or profitability.

We have not engaged in currency hedging activities to limit risk of exchange rate fluctuations.

Changes in exchange rates affect our costs and earnings, and may also affect the book value of our assets located outside the United States and the amount of our stockholders’ equity.

If we invest substantial time and resources to expand our international operations and are unable to do so successfully and in a timely manner, our business and results of operations will suffer.

Establishing operations in international markets also requires significant management attention and financial resources, and we cannot guarantee that these investments will produce desired levels of revenue or profitability.

If we fail to expand our operations successfully and in a timely manner, our business and results of operations will suffer.

If we fail to adapt to rapid technological change, our ability to remain competitive could be impaired.

The industry in which we compete is characterized by rapid technological change, frequent introductions of new products and evolving industry standards.

Our ability to attract new customers and increase revenue from existing customers will depend in significant part on our ability to anticipate industry standards and trends and continue to enhance existing products or introduce or acquire new products on a timely basis to keep pace with technological developments.

The success of any enhancement or new product depends on several factors, including the timely completion and market acceptance of the enhancement or new product.

Any new product we develop or acquire might not be introduced in a timely or cost-effective manner and might not achieve the broad market acceptance necessary to generate significant revenue.

If any of our competitors implements new technologies before we are able to implement them, those competitors may be able to provide more effective products than ours at lower prices.

Any delay or failure in the introduction of new or enhanced products could harm our business, results of operations and financial condition.

The industry in which we compete is characterized by rapid technological change, frequent introductions of new solutions and evolving industry standards.

Our ability to attract new customers and increase revenue from existing customers will depend in significant part on our ability to anticipate industry standards and trends.

We must continue to enhance existing solutions, or introduce or acquire new solutions on a timely basis to keep pace with technological developments.

The success of any enhancement or new solution depends on several factors, including the timely completion and market acceptance of the enhancement or new solution.

Any new solution we develop or acquire might not be introduced in a timely or cost-effective manner and might not achieve the broad market acceptance necessary to generate significant revenue.

If any of our competitors implements new technologies before we are able to implement them, those competitors may be able to provide more effective

solutions than ours at lower prices.

Any delay or failure in the introduction of new or enhanced solutions that gain market acceptance and meet customer requirements could harm our business, results of operations and financial condition.

Our financial results may fluctuate due to increasing variability in our sales cycles.

1 unchanged sentence

These assumptions are based upon historical trends for sales cycles and conversion rates associated with our existing customers.

As we continue to focus on sales to larger organizations and in light of the current macroeconomic environment, our sales cycles are lengthening in certain circumstances and becoming less predictable, which may harm our financial results.

Other factors that may influence the length and variability of our sales cycle include, among other things:

• the need to raise awareness about the uses and benefits of our platform, including our customer identity products;

• the need to allay privacy, regulatory and security concerns;

• the discretionary nature of purchasing and budget cycles and decisions;

• the competitive nature of evaluation and purchasing processes;

• announcements or planned introductions of new products, features or functionality by us or our competitors;

• often lengthy purchasing approval processes.

Our increasing focus on sales to larger organizations may further increase the variability of our financial results.

If we are unable to close one or more of such expected significant transactions in a particular period, or if such an expected transaction is delayed until a subsequent period, our results of operations for that period, and for any future periods in which revenue from such transaction would otherwise have been recognized, may be harmed.

We are increasingly focused on sales to larger organizations, which often involve lengthy purchasing approval processes and less predictable sales cycles.

The length of sales cycles may be further impacted by the current macroeconomic environment and by the discretionary nature of customer spending.

Customers may also take prolonged evaluation periods of our platforms, or their features or functionality, and those of our competitors.

As a result, it is difficult to predict exactly when, or even if, we will make a sale.

If we are unable to close one or more of expected significant transactions in a particular period, or if such an expected transaction is delayed until a subsequent period, our results of operations for that period, and for any future periods in which revenue from such transaction would otherwise have been recognized, may be harmed.

Our growth depends, in part, on the success of our strategic relationships with third parties.

To grow our business, we anticipate that we will continue to depend on relationships with third parties, such as channel partners.

Identifying partners, and negotiating and documenting relationships with them, requires significant time and resources.

Our competitors may be effective in causing third parties to favor their products or services over subscriptions to our platform.

To grow our business, we expect to continue to depend on relationships with third parties, such as channel partners.

Identifying partners, negotiating and maintaining relationships with them requires significant time and resources.

Our ability to compete in the marketplace depends, in part, on whether third parties successfully market, resell, implement or support our solutions for their customers.

For example, some of our channel partners sell or provide integration and administration services for our competitors’ solutions.

They may choose to devote greater resources to our competitors that are more effective in incentivizing them to favor their solutions over ours.

In addition, acquisitions of such partners by our competitors could result in a decrease in the number of our current and potential customers, as these partners may no longer facilitate the adoption of our applications by potential customers.

Further, some of our partners are or may become competitive with certain of our products and may elect to no longer integrate with our platform.

If we are unsuccessful in establishing or maintaining our relationships with third parties, our ability to compete in the marketplace or to grow our revenue could be impaired, and our results of operations may suffer.

Some of our partners compete with certain of our solutions and may elect to no longer integrate with our platforms or sell our solutions.

Our growth also depends on our ability to incentivize third-party developers to adopt and build their applications using our APIs and solutions.

We believe that these applications facilitate greater usage and customization of our solutions.

If these third-party developers stop developing on or supporting our platforms, we will lose the benefit of network effects that have contributed to the growth in our number of customers.

If we are unsuccessful in establishing or maintaining our relationships with third parties, our ability to grow our revenue could be impaired, and our results of operations may suffer.

Even if we are successful, we cannot ensure that these relationships will result in increased customer usage of our applications or increased revenue.

Failure to effectively develop and expand our marketing and sales capabilities could harm our ability to increase our customer base and achieve broader market acceptance of our products.

Our ability to increase our customer base and achieve broader market acceptance of our products will depend to a significant extent on our ability to expand our marketing and sales operations.

We plan to continue expanding our direct sales force and engaging additional channel partners, both domestically and internationally.

This expansion will require us to invest significant financial and other resources.

Our business will be harmed if our efforts do not generate a corresponding increase in revenue.

We may not achieve anticipated revenue growth from expanding our direct sales force if we are unable to hire and develop talented direct sales personnel, if our new direct sales personnel are unable to achieve desired productivity levels in a reasonable period of time or if we are unable to retain our existing direct sales personnel.

We also may not achieve anticipated revenue growth from our channel partners if we are unable to attract and retain additional motivated channel partners, if any existing or future channel partners fail to successfully market, resell, implement or support our products for their customers, or if they represent multiple providers and devote greater resources to market, resell, implement and support the products and solutions of these other providers.

For example, some of our channel partners also sell or provide integration and administration services for our competitors’ products, and if such channel partners devote greater resources to marketing, reselling and supporting competing products, this could harm our business, results of operations and financial condition.

Various factors may cause our product implementations to be delayed, inefficient or otherwise unsuccessful.

Our business depends upon the successful implementation of our products by our customers.

Various factors may cause implementation of our solutions to be delayed, inefficient or otherwise unsuccessful.

Our business depends upon the successful implementation of our solutions by our customers.

Increasingly, we, as well as our customers, rely on our network of partners to deliver implementation services, and there may not be enough qualified implementation partners available to meet customer demand.

Various factors may cause implementations to be delayed, inefficient or otherwise unsuccessful.

For example, changes in the functional requirements of our customers, delays in timeline, or deviation from recommended best practices may occur during the course of an implementation project.

As a result of these and other risks, we or our customers may incur significant implementation costs in connection with the purchase, implementation and enablement of our products.

Some customer implementations may take longer than planned or fail to meet our customers’ expectations, which may delay our ability to sell additional products or result in customers canceling or failing to renew their subscriptions before our products have been fully implemented.

Unsuccessful, lengthy, or costly customer implementation and integration projects could result in claims from customers, harm to our reputation, and opportunities for competitors to displace our products, each of which could have an adverse effect on our business and results of operations.

A portion of our revenues are generated by sales to government entities, which are subject to a number of challenges and risks.

A portion of our sales are to partners that resell our services to government agencies, and we have made, and plan to continue to make, investments to support future sales opportunities in the government sector.

The sale of our services to government agencies is tied to budget cycles, and there are government requirements and authorizations that we may be required to meet.

Further, we may be subject to audits and investigations regarding

our role as a subcontractor in government contracts, and violations could result in penalties and sanctions, including contract termination, refunding or forfeiting payments, fines, and suspension or debarment from future government business.

Various other factors may cause implementations to be delayed, inefficient or otherwise unsuccessful, including significant costs to purchase, implement and enable our solutions;

changes in our customers’ functional requirements;

timeline delays;

or deviation from recommended best practices.

These and other circumstances may delay our ability to sell additional solutions or result in customers canceling or failing to renew their subscriptions before our solutions have been fully implemented.

Unsuccessful, lengthy, or costly customer implementation and integration projects could result in claims from customers, harm to our reputation, and opportunities for competitors to displace our solutions, each of which could have an adverse effect on our business and results of operations.

A portion of our revenues are generated by sales to public sector entities, which are subject to a number of challenges and risks.

We rely on partners to resell our services to public sector entities, and we have made, and plan to continue to make, investments to support future sales opportunities in the public sector.

The sale of our services to public sector entities is tied to budget cycles, and there are government requirements and authorizations that we may be required

Further, we may be subject to audits and investigations regarding our role as a subcontractor in government contracts, and violations could result in penalties and sanctions, including contract termination, refunding or forfeiting payments, fines, and suspension or debarment from future government business.

Selling to these entities can be highly competitive, expensive and time consuming, often requiring significant upfront time and expense.

Government entities often require contract terms that differ from our standard arrangements and impose additional compliance requirements, require increased attention to pricing practices, or are otherwise time consuming and expensive to satisfy.

For example, some of our government entity customers contract with us on the basis of our authorization under FedRAMP, which has, in the past, and may, in the future, require us to undertake additional actions and expense to ensure compliance.

Government entities may also have statutory, contractual or other legal rights to terminate contracts with our partners for convenience, for lack of funding or due to a default, and any such termination may adversely impact our future results of operations.

Public sector entities often require contract terms that differ from our standard arrangements and impose additional compliance requirements, require increased attention to pricing practices, or are otherwise time consuming and expensive to satisfy.

For example, some of our public sector customers contract with us on the basis of our authorization under FedRAMP, which requires us to undertake additional actions and expenses to ensure compliance.

Public sector entities may also have statutory, contractual, or other legal rights to terminate contracts with our partners for convenience, for lack of funding or due to a default, and any such termination may adversely impact our future results of operations.

If we represent that we meet certain standards, authorizations (such as FedRAMP) or requirements and do not meet them, or if such authorizations are suspended or revoked, we could be subject to increased liability from our customers, investigation by regulators, or termination rights.

Even if we do meet them, the additional costs associated with providing our service to government entities could harm our margins.

Even if we do meet them, the additional costs associated with providing our service to public sector entities could harm our margins.

Moreover, changes in underlying regulatory requirements could be an impediment to our ability to efficiently provide our service to government customers and to grow or maintain our customer base.

Any of these risks related to contracting with government entities could adversely impact our future sales and results of operations, or make them more difficult to predict .

Any of these risks related to contracting with, or as a subcontractor supporting, public sector entities could adversely impact our future sales and results of operations, or make them more difficult to predict .

If we fail to enhance our brand cost-effectively, our ability to expand our customer base will be impaired and our business, results of operations and financial condition may suffer.

We believe that developing and maintaining awareness of our brand in a cost-effective manner is critical to achieving widespread acceptance of our existing and future products and is an important element in attracting new customers.

Furthermore, we believe that the importance of brand recognition will increase as competition in our market increases.

Successful promotion of our brand will depend largely on the effectiveness of our marketing efforts and on our ability to provide reliable and useful products at competitive prices.

We believe that developing and maintaining awareness of our brand in a cost-effective manner is critical to achieving widespread acceptance of our existing and future solutions, and is an important element in attracting new customers and retaining existing customers.

Furthermore, we believe that the importance of brand recognition is likely to increase as competition in our market increases.

Successful promotion of our brand will depend largely on the effectiveness of our marketing and sales efforts, and on our ability to provide reliable and useful solutions at competitive prices and that align with our customers’ needs.

In the past, our efforts to build our brand have involved significant expenses and have not always attracted a sufficient number of new customers to be cost-effective.

Brand promotion activities may not yield increased revenue, and even if they do, any increased revenue may not offset the expenses we incur in building our brand.

If we fail to successfully promote and maintain our brand, or incur substantial expenses in an unsuccessful attempt to promote and maintain our brand, we may fail to attract new customers or retain our existing customers to the extent necessary to realize a sufficient return on our brand-building efforts, and our business, results of operations and financial condition could suffer.

We may not set optimal prices for our products.

In the past, we have at times adjusted our prices either for individual customers in connection with long-term agreements or for a particular product.

As of fiscal 2026, we are further specializing our sales force to better align with our customers and evolving market demands, which will require us to invest significant financial and other resources.

We may not achieve anticipated revenue growth if we are unable to hire and develop talented sales personnel, if our new sales personnel are unable to achieve desired productivity levels in a reasonable period of time or if we are unable to retain our existing sales personnel.

If our marketing and sales efforts are unsuccessful and we fail to enhance our brand we may fail to attract new customers or retain our existing customers to the extent necessary to realize a sufficient return on our brand-building efforts, and our business, results of operations and financial condition could suffer.

We may not set optimal prices for our solutions.

In the past, we have at times adjusted our prices either for individual customers in connection with long-term agreements or for a particular solution.

We expect that we may need to change our pricing in future periods and potentially in response to the inflation and interest rate environment and increased costs.

Further, as competitors introduce new products that compete with ours or reduce their prices, we may be unable to attract new customers or retain existing customers based on our historical pricing.

Further, as competitors introduce new solutions that compete with ours or reduce their prices, we may be unable to attract new customers or retain existing customers based on our historical pricing.

As we expand internationally, we also must determine the appropriate price to enable us to compete effectively internationally.

In addition, if our mix of products sold changes, then we may need to, or choose to, revise our pricing.

In addition, if our mix of solutions sold changes, then we may need to, or choose to, revise our pricing.

As a result, we may be required or choose to reduce our prices or change our pricing model, which could harm our business, results of operations and financial condition.

Our failure to raise additional capital or generate cash flows necessary to expand our operations and invest in new technologies in the future could reduce our ability to compete successfully and harm our results of operations.

If we are not able to consistently generate cash flows or raise additional capital necessary to expand our operations and invest in new technologies in the future could reduce our ability to compete successfully and harm our results of operations.

We may need to raise additional funds, and we may not be able to obtain additional debt or equity financing on favorable terms, if at all.

1 unchanged sentence

If we engage in additional debt financing, we may be required to accept terms that restrict our ability to incur additional indebtedness, force us to maintain specified liquidity or other ratios or restrict our ability to pay dividends or make acquisitions.

If we need additional capital and cannot raise it on acceptable terms, or at all, we may not be able to, among other things:

• develop and enhance our products;

• continue to expand our product development, sales and marketing organizations;

• hire, train and retain employees;

• respond to competitive pressures or unanticipated working capital requirements;

• pursue acquisition opportunities.

Our inability to do any of the foregoing could reduce our ability to compete successfully and harm our business, results of operations and financial condition.

If we need additional capital and

cannot raise it on acceptable terms, or at all, we may not be able to effectively grow our business or respond to competitive pressures, which could harm our business, results of operations and financial condition.

We may be subject to liability claims if we breach our contracts and our insurance may be inadequate to cover our losses.

4 unchanged sentences

Further, our insurance may not cover all claims made against us and defending a suit, regardless of its merit, could be costly and divert management’s attention.

Increased and complex scrutiny of environmental, social and governance (“ESG”) matters may require us to incur additional costs or otherwise adversely impact our business.

Increased attention to climate change;

diversity, equity and inclusion;

and other ESG issues, as well as societal expectations regarding voluntary ESG initiatives and disclosures, may result in increased costs (including but not limited to increased costs related to compliance, stakeholder engagement and contracting), impact our reputation, or otherwise affect our business performance.

In addition, organizations that provide information to investors on corporate governance and related matters have developed ratings processes for evaluating companies on ESG matters.

Such ratings are used by some investors to inform their investment or voting decisions.

Unfavorable ESG ratings could lead to negative investor sentiment toward us and/or our industry, which could have a negative impact on our access to and costs of capital.

To the extent ESG matters negatively impact our reputation, we may also not be able to compete as effectively to recruit or retain employees.

We may take certain actions, including the establishment of ESG-related goals or targets, to improve our ESG profile and/or respond to stakeholder demand;

however, such actions may be costly or be subject to numerous conditions that are outside our control, and we cannot guarantee that such actions will have the desired effect.

Moreover, while we may create and publish voluntary disclosures regarding ESG matters from time to time, many of the statements in those voluntary disclosures are based on hypothetical expectations and assumptions that may or may not be representative of current or actual risks or events or forecasts of expected risks or events, including the costs associated therewith.

Such expectations and assumptions are necessarily uncertain and may be prone to error or subject to misinterpretation given the long timelines involved and the lack of an established single approach to identifying, measuring and reporting on many ESG matters.

Such disclosures may also be at least partially reliant on third-party information that we have not independently verified or cannot be independently verified.

In addition, we expect there will likely be increasing levels of regulation, disclosure-related and otherwise, with respect to ESG matters, and increased regulation will likely lead to increased compliance costs as well as scrutiny that could heighten all of the risks identified in this risk factor.

Such ESG matters may also impact our customers, which may adversely impact our business, financial condition, or results of operations.

Evolving and complex scrutiny of sustainability matters may require us to incur additional costs or otherwise adversely impact our business.

Increased attention to environmental sustainability and social issues, as well as societal expectations regarding voluntary sustainability initiatives and disclosures, may result in increased costs (including but not limited to, increased costs related to compliance, stakeholder engagement and contracting), impact our reputation, or otherwise affect our business performance.

We have undertaken certain sustainability-related initiatives, goals and commitments, which we have communicated on our website, in our SEC filings and elsewhere.

We may undertake additional actions, including establishing certain sustainability goals or targets, to improve our sustainability profile and/or respond to demand from investors, regulators, customers and other stakeholders, both U.S.-based and internationally.

However, such actions may be costly or subject to numerous conditions that are outside our control, and we cannot guarantee that such actions will have the desired effect.

Our actual or perceived failure to achieve such goals or targets could negatively impact our reputation and impact our ability to compete as effectively to recruit or retain employees.

Risks Related to Intellectual Property, Infrastructure Technology, Data Privacy and Security

If there are interruptions or performance problems associated with our technology or infrastructure, our existing customers may experience service outages, and our new customers may experience delays in the deployment of our platform.

Our continued growth depends, in part, on the ability of our existing and potential customers to access our platform 24 hours a day, seven days a week, without interruption or degradation of performance.

We have, in the past, and may, in the future, experience disruptions, data loss or corruption, outages and other performance problems with our infrastructure or service due to a variety of factors.

These factors include, for example,

infrastructure and functionality changes, human or software errors, capacity constraints, ransomware attacks that encrypt our data and render it inaccessible or security-related incidents.

Interruptions or performance problems that impact the functionality of our technology, systems, or infrastructure could result in delays in the deployment of our platforms.

Our continued growth depends, in part, on the ability of our existing and potential customers to access our platforms 24 hours a day, seven days a week, without interruption or degradation of performance.

System interruption and a lack of integration and redundancy in our information systems and infrastructure may adversely affect our ability to operate websites, process and fulfill transactions, respond to customer inquiries, and generally maintain cost-efficient operations.

We have experienced in the past, and may experience in the future, disruptions, data loss or corruption, outages, and other performance problems with our infrastructure or service due to a variety of factors.

These factors include, for example, infrastructure and functionality changes, human or software errors, capacity constraints, ransomware attacks that encrypt our data and render it inaccessible, or security-related incidents.

In some instances, we may not be able to identify the cause or causes of these performance problems immediately, and it could take months, or even years, for such problems to become pronounced enough for us to detect or for our customers to detect and inform us.

We may not be able to maintain the level of service uptime and performance required by our customers, especially during peak usage times and as our products become more complex and our user traffic increases.

If our platform is unavailable or if our customers are unable to access our products or deploy them within a reasonable amount of time, or at all, our business would be harmed.

Since our customers rely on our service to access and complete their work, any outage on our platform would impair the ability of our customers to perform their work, which would negatively impact our brand, reputation and customer satisfaction.

Moreover, we depend on services from various third parties to maintain our infrastructure and distribute our products via the internet.

If a service provider fails to provide sufficient capacity to support our platform or otherwise experiences service outages, including intentionally blocking our internet traffic or all internet traffic, for example at the request of a national government intending to isolate its country’s network, such failure could interrupt our customers’ access to our service, which could adversely affect their perception of our platform's reliability and our revenues.

Any disruptions in these services, including as a result of actions outside of our control, would significantly impact the continued performance of our products.

We may not be able to maintain the level of service uptime and performance required by our customers, especially during peak usage times and as our solutions become more complex and our user traffic increases.

If our platforms are unavailable or if our customers are unable to access our solutions or deploy them within a reasonable amount of time, or at all, our business would be harmed.

Since our customers rely on our service to access and complete their work, any outage on our platforms would impair the ability of our customers to perform their work, which would negatively impact our brand, reputation and customer satisfaction.

Our platforms are accessed by a large number of customers, often at the same time, and we continue to expand the number of our customers and solutions available to our customers.

While we rely on third-party information technology systems, broadband and other communications systems and service providers to assist in providing access to our platforms, maintaining our infrastructure, and distributing our solutions via the internet, we may not be able to scale our technology to accommodate increased capacity requirements, which may result in

interruptions or delays in service.

If a service provider fails to provide sufficient capacity to support our platforms or otherwise experiences service outages, including intentionally blocking our internet traffic or all internet traffic, for example at the request of a national government intending to isolate its country’s network, such failure could interrupt our customers’ access to our service, which could adversely affect their perception of our platforms’ reliability and our revenues.

Any disruptions in these services, including as a result of actions outside of our control, would significantly impact the continued performance of our solutions.

In the future, these services may not be available to us on commercially reasonable terms, or at all.

Any loss of the right to use any of these services could result in decreased functionality of our products until equivalent technology is either developed by us or, if available from another provider, is identified, obtained and integrated into our infrastructure.

Any loss of the right to use any of these services could result in decreased functionality of our solutions until equivalent technology is either developed by us or, if available from another provider, is identified, obtained and integrated into our infrastructure.

If we do not accurately predict our infrastructure capacity requirements, our customers could experience service shortfalls.

2 unchanged sentences

In the past, we have experienced cybersecurity incidents that allowed unauthorized access to our systems or data or our customers’ data, harmed our reputation, created additional liability, and adversely impacted our financial results.

We may experience similar incidents in the future which may also include disabling access to our service.

Increasingly, companies, including Okta, are subject to a wide variety of attacks on their systems and networks on an ongoing basis.

We and our third-party service providers may experience similar incidents in the future which may also include disabling access to our service.

Increasingly, companies, including Okta, Inc., are subject to a wide variety of attacks on their systems and networks on an ongoing basis.

In addition to threats from traditional computer “hackers,” malicious code (such as malware, viruses, worms and ransomware), employee or contractor theft or misuse, password spraying, phishing and denial-of-service attacks, we and our third-party service providers now also face threats from sophisticated nation-state actors and organized crime groups who engage in attacks (including advanced persistent threat intrusions) that add to the risks to our systems (including those hosted on AWS’ or other cloud services providers’ systems), internal networks, our customers’ systems and the information that we and they store and process.

2 unchanged sentences

Despite significant efforts to create security barriers to such threats, it is virtually impossible for us to entirely mitigate these risks.

As a well-known provider of identity and security solutions that form a part of our customers’ security software supply chain, we pose an attractive target for such attacks.

The security measures we have integrated into our internal systems and platform, which are designed to detect unauthorized activity and prevent or minimize security breaches, may not function as expected and have not in the past been, and may not in the future be, sufficient to protect our internal networks and platform against certain attacks.

In addition, techniques used to sabotage or to obtain unauthorized access to networks in which data is stored or through which data is transmitted change frequently, become more complex over time and generally are not recognized until launched against a target.

As a provider of independent and neutral cloud-based identity solutions that form a part of our customers’ security software supply chain, we pose an attractive target for such attacks.

The security measures we have integrated into our internal systems and platforms, which are designed to detect unauthorized activity and prevent or minimize security breaches, may not function as expected and have not in the past been, and may not in the future be, sufficient to protect our internal networks and platforms against certain attacks.

In addition, techniques used to sabotage or to obtain unauthorized access to networks in which data is stored or through which data is transmitted change frequently, become more complex over time.

As a result, we and our third-party service providers have in the past been, and may in the future be, unable to anticipate these techniques or implement adequate preventative measures quickly enough to prevent either an electronic intrusion into our systems or services or a compromise of customer data, employee data or other protected information.

Our customers’ use of Okta to access business systems and store data concerning, among others, their employees, contractors, partners and customers is essential to their use of our platform, which stores, transmits and

processes customers’ proprietary information and users’ personal data.

Okta has experienced and likely will in the future experience attacks targeting such customer data.

When such breaches occur, as a result of third-party action, technology limitations, employee or contractor error, malfeasance or otherwise, and if the confidentiality, integrity or availability of our customers’ data or systems is disrupted, we could incur significant liability to our customers and to individuals or businesses whose information was being stored by our customers, and our platform may be perceived as less desirable, which could negatively affect our business and damage our reputation.

Our customers’ use of our technology to access business systems and store data concerning, among others, their employees, contractors, partners and customers is essential to their use of our platforms, which stores, transmits and processes customers’ proprietary information and users’ personal data experienced and likely will in the future experience attacks targeting such customer data.

When such breaches occur, as a result of third-party action, technology limitations, employee or contractor error, malfeasance or otherwise, and if the confidentiality, integrity or availability of our customers’ data or systems is disrupted, we could incur significant liability to our customers and to individuals or businesses whose information was being stored by our customers, and our platforms may be perceived as less desirable, which could negatively affect our business and damage our reputation.

Techniques used to obtain unauthorized access to, or to sabotage, systems change frequently and generally are not recognized until launched against a target.

1 unchanged sentence

Further, because we do not control our third-party service providers, or the processing of data by our third-party service providers, we cannot ensure the integrity or security of measures they take to protect customer information and prevent data loss.

In addition, security breaches impacting our platform have in certain cases resulted in and could in the future result in a risk of loss or unauthorized disclosure or theft of this information, or the denial of access to this information, which, in turn, could lead to enforcement actions, litigation, regulatory or governmental audits, investigations and possible liability, and increased requests by individuals regarding their personal data.

In addition, security breaches impacting our platforms have in certain cases resulted in and could in the future result in a risk of loss or unauthorized disclosure or theft of this information, or the denial of access to this information, which, in turn, could lead to enforcement actions, litigation, regulatory or governmental audits, investigations and possible liability, and increased requests by individuals regarding their personal data.

Security breaches could also damage our relationships with and ability to attract customers and partners, and trigger service availability, indemnification and other contractual obligations.

1 unchanged sentence

Security incidents may also cause us to incur significant investigation, mitigation, remediation, notification and other expenses.

Furthermore, as a well-known provider of identity and security solutions that form a part of our customers’ security software supply chain, any such breach, including a breach of our customers’ systems, could compromise systems secured by our products, creating system disruptions or slowdowns and exploiting security vulnerabilities of our or our customers’ systems, and the information stored on our or our customers’ systems could be accessed, publicly disclosed, altered, lost or stolen, which could subject us to liability and cause us financial harm.

Furthermore, as a well-known provider of identity and security solutions that form a part of our customers’ security software supply chain, any such breach, including a breach of our customers’ systems, could compromise systems secured by our solutions, creating system disruptions or slowdowns and exploiting security vulnerabilities of our or our customers’ systems, and the information stored on our or our customers’ systems could be accessed, publicly disclosed, altered, lost or stolen, which could subject us to liability and cause us financial harm.

Our disclosures concerning security incidents also may become the subject of litigation, and our disclosures concerning the January 2022 compromise, for example, have become the subject of lawsuits, as discussed in Item 3, “ Legal Proceedings ” below.

While we have taken a number of remediation steps, there is no guarantee that our preventative and mitigation actions with respect to this incident and others like it will fully eliminate the risk of a malicious compromise of our or our customers’ systems.

We have experienced cybersecurity incidents resulting from our use of and oversight over third-party service providers and may experience such incidents in the future.

We have experienced cybersecurity incidents resulting from our use of and oversight over third-party service providers and could experience such incidents in the future.

These incidents have, in the past, and may, in the future, result from our configuration of such providers’ products or from cybersecurity attacks on such providers of the same type that could affect our own systems.

While we have implemented security measures and configuration policies that seek to protect data stored with our third-party service providers, such measures and policies have not in the past been, and may not in the future be, sufficient to protect our data or our customers’ data.

For example, the January 2022 compromise of one of our third-party service providers by a threat actor, even though not material and not a breach of our product or systems, nonetheless was widely publicized and focused attention on the security of our systems and the systems of our third-party service providers.

For example, the January 2022 compromise of one of our third-party service providers by a threat actor, even though not material and not a breach of our platforms, nonetheless was widely publicized and focused attention on the security of our systems and the systems of our third-party service providers.

In addition, in October 2023, a threat actor gained unauthorized access to and stole information from inside our customer support system, which was hosted by a third-party service provider.

While we maintain cybersecurity insurance, our insurance may be insufficient to cover all liabilities incurred in these incidents, and any incidents may result in loss of, or increased costs of, our cybersecurity insurance.

These breaches, or any perceived breach, of our systems, our customers’ systems, our service providers’ systems, or other systems or networks secured by our products, whether or not any such breach is due to a vulnerability in our platform, may also undermine confidence in our platform or our industry and result in damage to our reputation and brand, negative publicity, loss of ISVs and other channel partners, customers and sales, increased costs to remedy any problem, costly litigation and other liability.

These breaches, or any perceived breach, of our systems, our customers’ systems, our service providers’ systems, or other systems or networks secured by our platforms, whether or not any such breach is due to a vulnerability in our platforms, may also undermine confidence in our platforms or our industry and result in damage to our reputation and brand, negative publicity, loss of ISVs and other channel partners, customers and sales, increased costs to remedy any problem, costly litigation and other liability.

In addition, a breach of the security measures of one of our key ISVs or other channel partners or a security software supply chain attack even many levels removed could result in the exfiltration of confidential corporate information or other data that may provide additional avenues of attack.

For example, an exploitation in an open source library that is imported and used in another framework that is used by a software product used by Okta could introduce an avenue of attack into the Okta service.

For example, an exploitation in an open source library that is imported and used in another framework that is used by a software product used by Okta, Inc.

could introduce an avenue of attack into our platforms.

If a high profile security breach occurs with respect to a comparable cloud technology provider, our customers and potential customers may lose trust in the security of the cloud business model generally, which could adversely impact our ability to retain existing customers or attract new ones, potentially causing a negative impact on our business.

negative outcomes could adversely impact market acceptance of our products and could harm our business, results of operations and financial condition.

Third parties have induced and may continue to fraudulently induce employees, contractors, customers or our customers’ users into disclosing sensitive information such as user names, passwords or other information or otherwise compromise the security of our applications, internal networks, electronic systems and/or physical facilities in order to gain access to our data or our customers’ data, which could result in significant legal and financial exposure, a loss of confidence in the security of our platform, interruptions or malfunctions in our operations, account lockouts, and, ultimately, harm to our future business prospects and revenue.

Any of these negative outcomes could adversely impact market acceptance of our solutions and could harm our business, results of operations and financial condition.

Third parties have induced and may continue to fraudulently induce employees, contractors, customers or our customers’ users into disclosing sensitive information such as user names, passwords or other information or otherwise compromise the security of our applications, internal networks, electronic systems and/or physical facilities in order to gain access to our data or our customers’ data, which could result in significant legal and financial exposure, a loss of confidence in the security of our platforms, interruptions or malfunctions in our operations, account lockouts, and, ultimately, harm to our future business prospects and revenue.

We may be required to expend significant capital and financial resources to protect against such threats or to alleviate problems caused by breaches in security.

We have, in the past, failed or been perceived to have failed to fully comply with the privacy or security provisions of our privacy policy, our contracts and/or legal or regulatory requirements, which could result in proceedings, actions or penalties against us.

We and our third-party service providers have, in the past, failed or been perceived to have failed to fully comply with the privacy or security provisions of our privacy policy, our contracts and/or legal or

regulatory requirements, which could result in proceedings, actions or penalties against us.

We may experience similar incidents in the future.

Our customers’ storage and use of data concerning, among others, their employees, contractors, partners and customers is essential to their use of our platform.

Our customers’ storage and use of data concerning, among others, their employees, contractors, partners and customers is essential to their use of our platforms.

We have implemented various features intended to enable our customers to better comply with applicable privacy and security requirements in their collection and use of data within our online service, but these features have, in the past, not ensured and may, in the future, not ensure our customers’ compliance and may not be effective against all potential privacy or related regulatory concerns.

3 unchanged sentences

In addition, we are subject to certain contractual obligations regarding the collection, use, storage, transfer, disclosure and/or processing of personal data.

Although we are working to comply with those federal, state and foreign laws and regulations, industry standards, contractual obligations and other legal obligations that apply to us, those laws, regulations, standards and obligations are evolving and may be modified, interpreted and applied in an inconsistent manner from one jurisdiction to another, and may conflict with one another, other requirements or legal obligations, our practices or the features of our platform.

In addition, some of our customers contract with us on the basis of our authorization under FedRAMP, which, in addition to state or international regulations, has, in the past, and may, in the future, require us to undertake additional actions and expense to ensure compliance.

We also expect that there will continue to be new proposed laws, regulations, self-regulatory and industry standards concerning privacy, data protection and information security in the United States, China, the European Union, India and other jurisdictions, and we cannot yet determine the impact such future laws, regulations and standards may have on our business.

For example, the California Consumer Privacy Act (“CCPA”), which took effect on January 1, 2020, and the California Privacy Rights Act (“CPRA”), which took effect on January 1, 2023 and significantly modifies the CCPA, broadly define personal information and give California residents expanded privacy rights and protections and provide for civil penalties for violations and a private right of action for data breaches.

The CPRA also created a new state agency that is vested with authority to implement and enforce the CCPA and the CPRA.

Since the CPRA passed, a number of states have passed their own comprehensive privacy statutes that share similarities with the CCPA and CPRA and, depending on the jurisdiction, will take effect in 2024 or thereafter.

Following California’s enactment of the CCPA and CPRA, a number of other states have passed new privacy laws with differing requirements and remedies for violations.

We expect that additional states will enact privacy regulations that differ from each other.

We also expect that there will continue to be new proposed laws, regulations, self-regulatory and industry standards concerning privacy, data protection, digital services, and information security in the United States, China, the European Union, India and other jurisdictions, and we cannot yet determine the impact such future laws, regulations and standards may have on our business.

In the United States, the Federal Trade Commission and state regulators enforce a variety of data privacy issues, such as promises made in privacy policies or failures to appropriately protect information about individuals, as unfair or deceptive acts or practices in or affecting commerce in violation of the Federal Trade Commission Act or similar state laws.

state level, over a dozen states have adopted new or modified privacy and security laws.

These laws create a patchwork of legislation and regulation that impose heightened transparency obligations about data collection, use, and sharing practices, add restrictions on the “sale” or “sharing” or transfer of personal information to third parties for purposes such as advertising or analytics, create new data privacy rights for consumers including the ability to limit the use of personal information for advertising, and carry significant enforcement penalties for non-compliance, including monetary and injunctive relief.

This patchwork may also give rise to conflicts or differing views of personal privacy rights.

For example, certain state laws may be more stringent or broader in scope, or offer greater individual rights, with respect to personal data than federal, international or other state laws, and such laws may differ from each other, all of which may complicate compliance efforts.

We may expend significant resources attempting to comply with conflicting and overlapping state privacy regulations, and the cost and complexity of complying with such regulations could adversely affect our business or increase our potential liability if we fail to comply.

This influx of state privacy regimes indicates a trend toward more stringent privacy legislation in the United States, including a potential federal privacy law, which could also increase our potential liability and adversely affect our business.

Future laws, regulations, standards and other obligations, and changes in the interpretation of existing laws, regulations, standards and other obligations could impair our or our customers’ ability to collect, use or disclose information relating to consumers, which could decrease demand for our applications, restrict our business operations, or increase our costs and impair our ability to maintain and grow our customer base and increase our

In Europe, the General Data Protection Regulation 2016/679 (the “GDPR”) imposes a strict data protection compliance regime in relation to the collection and processing of personal data, and various European and other foreign laws also restrict the use of cookies, tracking technologies, and certain marketing activities.

Such laws and regulations may require companies to implement privacy and security policies, permit users to exercise various data rights, inform individuals of security breaches that affect their personal data, and, in some cases, obtain individuals’ consent to use personal data for certain purposes.

If we, or the third parties on which we rely, fail to comply with federal, state and international data privacy laws and regulations our ability to successfully operate our business and pursue our business goals could be harmed.

With respect to cybersecurity in the United States, we are closely monitoring the development of rules and guidance pursuant to various executive orders that may apply to us, including, for example, pursuant to Executive Order 14028 for “critical software.” While the rules and guidance coming from the Order are still being developed, we could be categorized as a provider of critical software, which may increase our compliance costs and delay or prevent our ability to execute contracts with customers, including in particular with government entities.

Any failure by us to comply with federal, state or foreign laws or regulations, industry standards, contractual obligations or other legal obligations, compliance frameworks that Okta has contractually committed to comply with, or any actual or suspected privacy or security incident, even if unfounded, whether or not resulting in unauthorized access to, or acquisition, release or transfer of personal data or other data, may result in enforcement actions and prosecutions, private litigation, fines, penalties and censure, claims for damages by customers and other affected individuals, or adverse publicity and could cause our customers to lose trust in us, which could have an adverse effect on our reputation and business.

Additionally, plaintiffs have become increasingly more active in bringing privacy-related claims against companies.

Some of these claims allow for the recovery of statutory damages on a per violation basis, and, if viable, carry the potential for significant statutory damages, depending on the volume of data and the number of violations.

With respect to cybersecurity in the United States, the development of rules and guidance pursuant to various executive orders may apply to us, including, for example, pursuant to Executive Order 14028 for “critical software.” While the rules and guidance coming from the Order are still being developed, we are likely to be categorized as a provider of critical software, which may increase our compliance costs and delay or prevent our ability to execute contracts with customers, including in particular with government entities.

Any failure or perceived failure by us or our third-party service providers to comply with federal, state or foreign laws or regulations, industry standards, contractual obligations or other legal obligations, compliance frameworks with which Okta, Inc.

has contractually committed to comply, or any actual or suspected privacy or security incident, even if unfounded, whether or not resulting in unauthorized access to, or acquisition, release or transfer of personal data or other data, may result in investigations and enforcement actions and prosecutions, private litigation (including class action lawsuits), fines, penalties and censure, claims for damages by customers and other affected individuals, or adverse publicity and could cause our customers to lose trust in us, which could have an adverse effect on our reputation and business.

We publicly post our privacy policies and practices concerning our processing, use and disclosure of the personal data provided to us by our website visitors and by our customers, and other individuals with whom we interact.

Our publication of our privacy policies and other statements we publish that provide promises and assurances about privacy and security can subject us to potential state and federal action if they are found to be unfair, deceptive, or misrepresentative of our practices.

If our platform is perceived to cause, or is otherwise unfavorably associated with, violations of privacy or data security requirements, it may subject us or our customers to public criticism and potential legal liability.

Existing and potential privacy laws and regulations concerning privacy and data security and increasing sensitivity of consumers to unauthorized processing of personal data may create negative public reactions to technologies, products and services such as ours.

If our platforms are perceived to cause, or are otherwise unfavorably associated with, violations of privacy or data security requirements, it may subject us or our customers to public criticism and potential legal liability.

Public concerns regarding personal data processing, privacy and security may cause some of our customers’ end users to be less likely to visit their websites or otherwise interact with them.

If enough end users choose not to visit our customers’ websites or otherwise interact with them, our customers could stop using our platform.

If enough end users choose not to visit our customers’ websites or otherwise interact with them, our customers could stop using our platforms.

This, in turn, may reduce the value of our service, and slow or eliminate the growth of our business, or cause our business to contract.

Privacy is a key issue for Okta and for our customers.

We have attained multiple privacy certifications, such as the Asia-Pacific Economic Cooperation Privacy Recognition for Processors, and the European Union Cloud Code of Conduct, Level 2.

If we fail to maintain our privacy certifications, or if we fail to seek expansion of their applicability to acquired and/or newly-developed products, we may fail to meet our contractual commitments and we may fail to retain our existing customers or attract new customers, and our business, results of operations and financial condition could suffer.

We may face particular privacy, data security and data protection risks in Europe due to stringent data protection and privacy laws and increased scrutiny over EU-U.S.

data transfers.

Privacy is a key issue for Okta, Inc.

and for our customers.

We have attained multiple privacy certifications, such as the Privacy Recognition for Processors, and the European Union Cloud Code of Conduct, Level 2.

If we fail to maintain our privacy certifications, or if we fail to seek expansion of their applicability to acquired and/or newly-developed solutions, we may fail to meet our contractual commitments and we may fail to retain our existing customers or attract new customers, and our business, results of operations and financial condition could suffer.

We may face particular privacy, data security and data protection risks due to stringent data protection and privacy laws and increased scrutiny over data transfers.

We are subject to global data protection laws and regulations (“Data Protection Laws”) that may impact how we do business with customers.

Data Protection Laws, such as those applicable in the European Union, Canada and certain of its provinces, United Kingdom, Asia, and certain states in the United States, have enhanced data protection obligations for companies that handle personal data.

Obligations include, for example, expanded disclosures about how personal data is to be used, individual rights to access and delete personal data, limitations on retention of personal data, mandatory data breach notification requirements and strict obligations on service providers.

Obligations include, for example, expanded disclosures about how personal data is to be used, individual rights in relation to personal data, limitations on retention of personal data, mandatory data breach notification requirements and strict obligations on service providers, and restrictions on online marketing and the use of cookies and tracking technologies.

In addition, increasing numbers of Data Protection Laws restrict transfers of personal data outside of their country of origin to countries deemed to lack adequate privacy protections.

These types of transfers must be supported by a transfer mechanism that we may be required to implement;

for example, data transfers out of the European Economic Area may require certification to the EU-U.S.

Data Privacy Framework (“DPF”) or agreeing to the European Commission’s Standard Contractual Clauses (“SCCs”), each of which impose additional compliance obligations.

One Okta subsidiary is a certified participant of the DPF and receives European personal data in the U.S.

pursuant to the DPF and the SCCs, and by contrast, the rest of Okta relies on the SCCs for its lawful transfers of European personal data to the U.S.

The DPF and the SCCs are subject to further review by European authorities (such as the Court of Justice of the European Union) and could be invalidated in the future, requiring expenditure of additional resources to support lawful transfers of European personal data.

Additional jurisdictions continue to adopt data localization laws, which require personal data, or certain subcategories of personal data, to be stored in the jurisdiction of origin.

These types of transfers must be supported by a transfer mechanism that we may be required to implement, and in many jurisdictions there is significant legal uncertainty around the validity and sufficiency of data transfer mechanisms, and evolving legal and regulatory expectations could impose additional obligations or require expenditure of additional resources to comply with the Data Protection Laws.

Data Protection Laws are rapidly expanding and evolving, and many have extraterritorial effect, which may increase our compliance costs and expose us to greater enforcement risk.

In addition, we may be or become subject to data localization laws, which require personal data, or certain subcategories of personal data, to be stored in the jurisdiction of origin.

These regulations may deter customers from using cloud-based services such as ours and may inhibit our ability to expand into those markets or prohibit us from continuing to offer services in those markets without significant additional costs.

2 unchanged sentences

Any such enforcement actions could result in substantial costs and diversion of resources, distract management and technical personnel and negatively affect our business, results of operations and financial condition.

Non-compliance with these obligations can trigger significant fines.

For example, in Europe fines for non-compliance can be a maximum of €20 million or 4% of total worldwide annual revenue, whichever is higher.

states, fines can be up to $7,500 per violation, multiplied by the number of impacted individuals, and, in addition, some states allow a private right of action.

Non-compliance with these obligations can trigger significant fines and other penalties.

Regulatory bodies can also issue orders to cease or change data processing, enforcement notices and/or assessment notices (for a compulsory audit), and civil claims (including class actions) for compensation or damages.

In addition to fines, some U.S.

states allow a private right of action.

Given the breadth and depth of changes in data protection obligations, complying with these requirements has caused us to expend significant resources, which is likely to continue into the near future as we respond to new interpretations and enforcement actions.

In addition, new laws are continually being passed.

For example, in the European Union, a draft ePrivacy Regulation extends strict opt-in marketing rules, alters rules on third-party cookies, web beacons and similar technology and significantly increases penalties for violations.

India recently passed a comprehensive data protection law that will apply new privacy rules for the first time in that country.

In addition, new laws are continually being passed and new case law and regulatory guidance means Data Protection Laws are constantly evolving.

For example, India recently passed a comprehensive data protection law that will apply new privacy rules for the first time in that country.

In addition, the number of U.S.

2 unchanged sentences

Such laws and regulations are often subject to differing interpretations and may be inconsistent among jurisdictions.

We may incur substantial expense in complying with any new obligations, we may be required to make significant changes in our business operations and product and services development, and we may not be able to comply with some of these regulatory developments, all of which may adversely affect our revenues and our business overall.

We function as a HIPAA Business Associate for certain of our customers and, as such, are subject to strict privacy and data security requirements.

If we fail to comply with any of these requirements, we could be subject to significant liability, all of which can adversely affect our business as well as our ability to attract and retain new customers.

HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act (“HITECH”), and their respective implementing regulations under HIPAA, imposes specified requirements relating to the privacy, security and transmission of individually identifiable health information.

Among other things, HITECH makes HIPAA’s security standards directly applicable to “Business Associates”.

We function as a Business Associate for certain of our customers that are HIPAA covered entities and service providers, and in that context we are regulated as a Business Associate for the purposes of HIPAA.

The HIPAA-covered entities and service providers to which we provide services require us to enter into HIPAA-compliant Business Associate agreements with them.

These agreements impose stringent data security obligations on us.

If we are unable to comply with our obligations as a HIPAA Business Associate or under the terms of the Business Associate agreements we have executed, we could face substantial civil and even criminal liability as well as contractual liability under the applicable Business Associate agreement, all of which can have an adverse impact on our business and generate negative publicity, which, in turn, can have an adverse impact on our ability to attract and retain new customers.

Modifying the already stringent penalty structure that was present under HIPAA prior to HITECH, HITECH created four new tiers of civil monetary penalties and gave state attorneys general new authority to file civil actions for damages or injunctions in federal courts to enforce the federal HIPAA laws and seek attorneys’ fees and costs associated with pursuing federal civil actions.

In addition, many state laws govern the privacy and security of health information in certain circumstances, many of which differ from HIPAA and each other in significant ways and may not have the same effect.

Further, certain modifications have been proposed to the HIPAA privacy regulations, and we expect that there

will continue to be changes to health information privacy laws in the United States, including HIPAA, and we cannot yet determine the impact such changes to existing laws, regulations and standards may have on our business.

We could incur substantial expense in complying with any new obligations, be required to make significant changes to our business operations or to the development of new or existing solutions, and we may not be able to comply with some of these regulatory developments, all of which may adversely affect our revenues and our business overall.

If we fail to maintain our security attestations and certifications, our business, results of operations and financial condition may suffer.

Security is essential for Okta and for our customers.

A number of our product offerings have attained multiple certifications, including SOC 2 Type II Attestations, CSA Star Level 2 Attestation, ISO/IEC 27001:2013, ISO/IEC 27017:2015, ISO/IEC 27018:2019, multiple agency FedRAMP Authorities to Operate, Department of Defense Impact Level 4, are in accordance with Health Insurance Portability and Accountability Act ("HIPAA"), and comply with many other international security frameworks.

Workforce Identity Cloud also supports FIPS 140-2 encryption requirements.

Security is essential for us and for our customers.

A number of our Okta Platform product offerings have attained multiple certifications, including SOC 2 Type II Attestations, CSA Star Level 2 Certification, ISO/IEC 27001:2022, ISO/IEC 27017:2015, ISO/IEC 27018:2019 and comply with many other international frameworks.

Certain Okta Platform offerings maintain multiple agency FedRAMP Authorities to Operate and are compliant to operate at Department of Defense Impact Level 4.

Certain Okta Platform offerings maintain minimum security requirements in alignment with the Security Rule of HIPAA.

The Okta Platform also supports FIPS 140-2 encryption requirements.

If we fail to maintain our security attestations and certifications, or if we fail to seek expansion of their applicability to acquired and/or newly-developed products, we may fail to meet our contractual commitments and we may fail to retain our existing customers or attract new customers, and our business, results of operations and financial condition could suffer.

We provide service level commitments under our customer contracts.

If we fail to meet these contractual commitments, we could be obligated to provide credits for future service, or face contract termination with refunds of prepaid amounts related to unused subscriptions, which could harm our business, results of operations and financial condition.

Our customer agreements contain service level commitments, under which we guarantee specified availability of our platform.

Any failure of or disruption to our infrastructure could make our platform unavailable to our customers.

If we are unable to meet the stated service level commitments to our customers or suffer extended periods of unavailability of our platform, we may be contractually obligated to provide affected customers with service credits for future subscriptions.

If we fail to meet these contractual commitments, we could be obligated to provide credits for future service, which could harm our business, results of operations and financial condition.

Our customer agreements contain service level commitments, under which we guarantee specified availability of our platforms.

Any failure of or disruption to our infrastructure could make our platforms unavailable to our customers.

If we are unable to meet the stated service level commitments to our customers or suffer extended periods of unavailability of our platforms, we have been, and could in the future be, contractually obligated to provide affected customers with service credits for future subscriptions.

Our revenue, other results of operations and financial condition could be harmed if we suffer unscheduled downtime that exceeds the service level commitments under our agreements with our customers, and any extended service outages could adversely affect our business and reputation as customers may elect not to renew and we could lose future sales.

If we are unable to ensure that our products integrate or interoperate with a variety of operating systems, platforms, services, software applications devices, mobile phones and other hardware form factors that are developed by others, our platform may become less competitive and our results of operations may be harmed.

If we are unable to ensure that our solutions integrate or interoperate with a variety of operating systems, platforms, services, software applications devices, mobile phones and other hardware form factors that are developed by others, our platforms may become less competitive and our results of operations may be harmed.

The number of people who access the internet through mobile devices and access cloud-based software applications through mobile devices, including smartphones and handheld tablets or laptop computers, has increased significantly in the past several years and is expected to continue to increase.

While we have created mobile applications and mobile versions of our products, if these mobile applications and products do not perform well, our business may suffer.

We are also dependent on third-party application stores that may prevent us from timely updating our current products or uploading new products.

In addition, our products interoperate with servers, mobile devices and software applications predominantly through the use of protocols, many of which are created and maintained by third parties.

As a result, we depend on the interoperability of our products with such third-party services, mobile devices and mobile operating systems, as well as cloud-enabled hardware, software, networking, browsers, database technologies and protocols that we do not control.

Past and future changes in such technologies that degrade the functionality of our products or give preferential treatment to competitive services have, in the past, and could, in the future, adversely affect adoption and usage of our platform.

Any change in our customers’ preference for cloud-based identity management or any shift towards on-premises systems could also adversely affect adoption and usage of our platform.

Also, we may not be successful in developing or maintaining relationships with key participants in the mobile industry or in developing products that operate effectively with a range of operating systems, networks, devices, browsers, protocols and standards.

While we have created mobile applications and mobile versions of our solutions that are accessible on third-party application stores, if

these mobile applications and solutions do not perform well, our business may suffer.

Third-party application stores may also impose new requirements, including, for example, updates to their terms of access or policies on how we or our channel partners must collect, use, and share data.

Compliance with any such requirements could be costly or burdensome, and could prevent us from timely updating our current mobile applications or distributing new mobile applications.

If we fail to comply with these requirements, we could lose access to, or be required to remove our mobile applications from, third-party application stores.

In addition, our solutions interoperate with servers, mobile devices and software applications predominantly through the use of protocols, many of which are created and maintained by third parties.

As a result, we depend on the interoperability of our solutions with such third-party services, mobile devices and mobile operating systems, as well as cloud-enabled hardware, software, networking, browsers, database technologies and protocols that we do not control.

Past and future changes in such technologies that degrade the functionality of our solutions or give preferential treatment to competitive services have, in the past, and could, in the future, adversely affect adoption and usage of our platforms.

Any change in our customers’ preference for cloud-based identity management or any shift towards on-premises systems could also adversely affect adoption and usage of our platforms.

Also, we may not be successful in developing or maintaining relationships with key participants in the mobile industry or in developing solutions that operate effectively with a range of operating systems, networks, devices, browsers, protocols and standards.

In addition, we may face different fraud, security and regulatory risks from transactions sent from mobile devices than we do from personal computers.

If we are unable to effectively anticipate and manage these risks, or if it is difficult for our customers to access and use our platform, our business, results of operations and financial condition may be harmed.

If we are unable to effectively anticipate and manage these risks, or if it is difficult for our customers to access and use our platforms, our business, results of operations and financial condition may be harmed.

Our success also depends on the willingness of third-party developers and technology providers to build applications and provide integrations that are complementary to our service.

Without the development of these applications and integrations, both current and potential customers may not find our service sufficiently attractive, and our business, results of operations and financial condition could suffer.

Interruptions or delays in the services provided by third-party data centers or internet service providers have, in the past, and could, in the future, impair the delivery of our platform and our business could suffer.

We rely on a number of third-party service providers to operate our services, any of which, if it encounters interruptions or delays, could negatively affect our platform, damage our reputation, expose us to liability, cause us to lose customers or otherwise harm our business.

For example, we host our platform using AWS data centers and other third-party cloud infrastructure services and, in the past, service interruptions from such infrastructure providers have caused outages on our platform, which could occur again in the future.

All of our products use resources operated by us in these locations.

We rely on a number of third-party service providers to operate our services.

For example, we host our platforms using AWS data centers and other third-party cloud infrastructure services.

Our operations depend on protecting the virtual cloud infrastructure hosted in AWS or other cloud services by maintaining its configuration, architecture and interconnection specifications, as well as the information stored in these virtual data centers and which third-party internet service providers transmit.

Although we have disaster recovery plans that use multiple virtual data center locations, any incident affecting their infrastructure that may be caused by fire, flood, severe storm, earthquake, power loss, telecommunications failures, unauthorized intrusion or malicious action, computer viruses and disabling devices, natural disasters, war, criminal act, military actions, terrorist attacks and other similar events beyond our control could negatively affect our platform.

A prolonged third-party service disruption affecting our platform for any of the foregoing reasons could be detrimental to our business.

Service interruptions from such infrastructure providers have caused, and could in the future cause, outages on our platforms.

Our solutions use resources operated by us in these locations.

Although we have disaster recovery plans that use multiple virtual data center locations, any incident affecting their infrastructure, including events beyond our control, could negatively affect our platforms, harm our reputation, and expose us to liability.

We may also incur significant costs for using alternative equipment or taking other actions in preparation for, or in reaction to, events that damage the third-party services we use.

Our cloud infrastructure services enable us to order and reserve server capacity in varying amounts and sizes distributed across multiple regions.

These cloud infrastructure services provide us with computing and storage capacity pursuant to agreements which may be terminated under specified circumstances.

Our platform is accessed by a large number of customers, often at the same time.

As we continue to expand the number of our customers and products available to our customers, we may not be able to scale our technology to accommodate the increased capacity requirements, which may result in interruptions or delays in service.

In addition, the failure of third-party virtual data centers, third-party internet service providers, or other third-party service providers whose services are integrated with our platform, to meet our capacity requirements could result in interruptions or delays in access to our platform or impede our ability to scale our operations.

In the event that our third-party service agreements are terminated, or there is a lapse of service, interruption of internet service provider connectivity or damage to such facilities, we could experience interruptions in access to our platform as well as delays and additional expense in arranging new facilities and services.

Our success depends, in part, on the integrity and scalability of our systems and infrastructures.

System interruption and the lack of integration, redundancy and scalability in these systems and infrastructures may harm our business, results of operations and financial condition.

Our success depends, in part, on our ability to maintain the integrity of our systems and infrastructure, including websites, information and related systems.

We may experience occasional system interruptions that make some or all systems or data unavailable or prevent us from efficiently providing access to our platform.

We also rely on third-party information technology systems, broadband and other communications systems and service providers in connection with providing access to our platform generally.

Any interruptions, outages or delays in our systems and infrastructure, our business and/or third parties, or deterioration in the performance of these systems and infrastructure, could impair our ability to provide access to our platform.

Fire, flood, power loss, telecommunications failure, hurricanes, tornadoes, earthquakes, other natural disasters, acts of war or terrorism, unauthorized access or malicious acts, and similar events or disruptions may damage or interrupt computers, broadband or other communications systems and infrastructure at any time.

Any of these events could cause system interruption, delays and loss of critical data, and could prevent us from providing access to our platform.

While we have backup systems for certain aspects of these operations, disaster recovery planning by its nature cannot be sufficient for all eventualities.

In addition, we may not have adequate insurance coverage to compensate for losses from a major interruption.

If any of these events were to occur, it could harm our business, results of operations and financial condition.

We rely on software and services from other parties.

Defects in or the loss of access to software or services from third parties could increase our costs and adversely affect the quality of our products.

Defects in or the loss of access to software or services from third parties could increase our costs and adversely affect the quality of our solutions.

We rely on technologies from third parties to operate critical functions of our business, including cloud infrastructure services and customer relationship management services.

Our business would be disrupted if any of the third-party software or services we use, or functional equivalents, were unavailable due to extended outages or interruptions or because they are no longer available on commercially reasonable terms or prices.

In each case, we would be required to either seek licenses to software or services from other parties and redesign our products to function with such software or services or develop substitutes ourselves, which would result in increased costs and could result in delays in our product launches and the release of new product offerings until equivalent technology can be identified, licensed or developed, and integrated into our products.

Furthermore, we might be forced to limit the features available in our current or future products.

Our business would be disrupted if any of the third-party software or services we use, or functional equivalents, were unavailable due to defects in the software or services from those third parties, or because they are no longer available on commercially reasonable terms or prices.

In each case, we would be required to either seek licenses to software or services from other parties and redesign our solutions to function with such software or services or develop substitutes ourselves, which would result in increased costs and could result in delays in launches or releases of new solutions until equivalent technology can be identified, licensed or developed, and integrated into our solutions.

Furthermore, we might be forced to limit the features available in our current or future solutions.

These delays and feature limitations, if they occur, could harm our business, results of operations and financial condition.

Real or perceived errors, failures, vulnerabilities or bugs in our products, including deployment complexity, have, in the past and could, in the future, harm our business and results of operations.

Errors, failures, vulnerabilities or bugs have, in the past and may, in the future, occur in our products, especially when updates are deployed or new products are rolled out, maintenance patches are applied, or infrastructure, architectural or configuration changes are made.

Real or perceived errors, failures, vulnerabilities or bugs in our solutions, including deployment complexity, have, in the past and could, in the future, harm our business and results of operations.

Errors, failures, vulnerabilities or bugs have, in the past and may, in the future, occur in our solutions, especially when updates are deployed or new solutions are rolled out, maintenance patches are applied, or

infrastructure, architectural or configuration changes are made.

In the past, such issues have caused outages for our customers.

Our platform is often used in connection with large-scale computing environments with different operating systems, system management software, equipment and networking configurations, which may cause errors or failures of products, or other aspects of the computing environment into which our products are deployed.

In addition, deployment of our products into complicated, large-scale computing environments may expose errors, failures, vulnerabilities or bugs in our products.

Our platforms are often used in connection with large-scale computing environments with different operating systems, system management software, equipment and networking configurations, which may cause errors or failures of our solutions, or other aspects of the computing environment into which our solutions are deployed.

In addition, deployment of our solutions into complicated, large-scale computing environments may expose errors, failures, vulnerabilities or bugs in our solutions.

Any such errors, failures, vulnerabilities or bugs may not be found until after they are deployed to our customers.

Real or perceived errors, failures, vulnerabilities or bugs in our products, or delays in or difficulties implementing our product releases, could result in negative publicity, loss of customer data, loss of or delay in market acceptance of our products, a decrease in customer satisfaction or adoption rates, loss of competitive position, or claims by customers for losses sustained by them, all of which could harm our business, results of operations and financial condition.

Issues in the development and use of artificial intelligence, combined with an uncertain regulatory environment, may result in reputational harm, liability, or other adverse consequences to our business operations.

We use internally developed and third-party developed machine learning and artificial intelligence (“AI”) technologies in our offerings and business, and we are making investments in expanding our artificial intelligence capabilities in our products, services, and tools, including ongoing deployment and improvement of existing machine learning and AI technologies, as well as developing new product features using AI technologies, including, for example, generative AI.

We are committed to increasing our transparency with our customers and the public about our solutions and technology.

This transparency, which may be more than is expected of companies in our industry, could lead to us publicly disclosing information that we would not otherwise be legally required to disclose, such as errors, failures, vulnerabilities or bugs in our solutions and technology.

As a result, we could experience negative publicity that could harm our business.

Any real or perceived errors, failures, vulnerabilities or bugs in our solutions, or delays in or difficulties implementing our solutions, could also result in:

loss, compromise, corruption or other unavailability of customer data;

disruptions to our solutions or our customers’ products, systems, networks, and operations;

loss of business and new customers;

loss of or delay in market acceptance of our solutions;

a decrease in customer satisfaction or adoption rates;

loss of competitive position;

or claims by customers for losses sustained by them, all of which could harm our business, results of operations, and financial condition.

Issues in the development and use of artificial intelligence (“AI”), combined with an uncertain regulatory environment, may result in reputational harm, liability, or other adverse consequences to our business operations.

We use internally developed and third-party developed machine learning and AI technologies in our offerings and business, and we are making investments in expanding our AI capabilities in our portfolio, including ongoing deployment and improvement of existing machine learning and AI technologies, as well as developing new product features using AI technologies, including, for example, generative AI.

AI technologies are complex and rapidly evolving, and we face significant competition from other companies as well as an evolving regulatory landscape.

For example, in the European Union, the proposed Artificial Intelligence Act, if approved, would establish obligations for providers of AI based on the type of AI and its potential risks to society.

The introduction of AI technologies into new or existing products may result in new or enhanced governmental or regulatory scrutiny, litigation, confidentiality or security risks, ethical concerns, or other complications that could adversely affect our business, reputation, or financial results.

For example, in the European Union, the Artificial Intelligence Act establishes obligations on the use of AI based on the type of AI and its potential risks to society.

Additionally, in the United States, federal and state legislatures and agencies are introducing legal frameworks and rules governing AI.

The introduction of AI technologies into new or existing solutions may result in new or enhanced governmental or regulatory scrutiny, litigation, confidentiality or security risks, ethical concerns, or other complications that could adversely affect our business, reputation, or financial results.

For example, even if permitted by our privacy policy and contractual rights, our use of data in novel AI applications may, in time, expand beyond customer expectations.

The intellectual property ownership and license rights, including copyright, surrounding AI technologies has not been fully addressed by courts or national or local laws or regulations, and the use or adoption of third-party AI technologies into our products and services may result in exposure to claims of copyright infringement or other intellectual property misappropriation.

Uncertainty around new and emerging AI technologies, such as generative AI, may require additional investment in the development and maintenance of proprietary datasets and machine learning models, development of new approaches and processes to provide attribution or remuneration to creators of training data, and development of appropriate protections and safeguards for handling the use of customer data with AI technologies, which may be costly and could impact our expenses if we decide to expand generative AI into our product offerings.

The intellectual property ownership and license rights, including copyright, surrounding AI technologies has not been fully addressed by courts or national or local laws or regulations, and the use or adoption of third-party AI technologies into our solutions may result in exposure to claims of copyright infringement or other intellectual property misappropriation.

Uncertainty around new and emerging AI technologies, such as generative AI, may require additional investment in the development and maintenance of proprietary datasets and machine learning models, development of new approaches and processes to provide attribution or remuneration to creators of training data, and development of appropriate protections and safeguards for handling the use of customer data with AI technologies, which may be costly and could impact our expenses as we continue to expand generative AI into our product offerings.

AI technologies, including generative AI, may create content that appears correct but is factually inaccurate or flawed.

6 unchanged sentences

We will not be able to protect our intellectual property if we are unable to enforce our rights or if we do not detect unauthorized use of our intellectual property.

Despite our precautions, it may be possible for unauthorized third parties to copy our products and use information that we regard as proprietary to create products that compete with ours.

Some contract provisions protecting against unauthorized use, copying, transfer and disclosure of our products may be unenforceable under the laws of certain jurisdictions and foreign countries.

Further, the laws of some countries do not protect proprietary rights to the same extent as the laws of the United States, and mechanisms for enforcement of intellectual property rights in some foreign countries may be inadequate.

To the extent we expand our international activities, our exposure to unauthorized copying and use of our products and proprietary information may increase.

Despite our precautions, it may be possible for unauthorized third parties to copy our solutions and use information that we regard as proprietary to create solutions that compete with ours.

Some contract provisions protecting against unauthorized use, copying, transfer and disclosure of our solutions may be unenforceable under the laws of certain jurisdictions and foreign countries.

Further, the laws of

some countries do not protect proprietary rights to the same extent as the laws of the United States, and mechanisms for enforcement of intellectual property rights in some foreign countries may be inadequate.

To the extent we expand our international activities, our exposure to unauthorized copying and use of our solutions and proprietary information may increase.

Accordingly, despite our efforts, we may be unable to prevent third parties from infringing upon or misappropriating our technology and intellectual property.

We rely in part on trade secrets, proprietary know-how and other confidential information to maintain our competitive position.

Although we enter into confidentiality and invention assignment agreements with our employees and consultants and enter into confidentiality agreements with the parties with whom we have strategic relationships and business alliances, no assurance can be given that these agreements will be effective in controlling access to and distribution of our products and proprietary information.

Further, these agreements do not prevent our competitors from independently developing technologies that are substantially equivalent or superior to our products.

Further, these agreements do not prevent our competitors from independently developing technologies that are substantially equivalent or superior to our solutions.

To protect our intellectual property rights, we may be required to spend significant resources to monitor and protect these rights.

2 unchanged sentences

Furthermore, our efforts to enforce our intellectual property rights may be met with defenses, counterclaims and countersuits attacking the validity and enforceability of our intellectual property rights.

Our inability to protect our proprietary technology against unauthorized copying or use, as well as any costly litigation or diversion of our management’s attention and resources, could delay further sales or the implementation of our products, impair the functionality of our products, delay introductions of new products, result in our substituting inferior or more costly technologies into our products, or injure our reputation.

In addition, we may be required to license additional technology from third parties to develop and market new products, and we cannot ensure that we can license that technology on commercially reasonable terms or at all, and our inability to license this technology could harm our ability to compete.

Our results of operations may be harmed if we are subject to an infringement claim or a claim that results in a significant damage award.

There is considerable patent and other intellectual property development activity in our industry, and we expect that software companies will increasingly be subject to infringement claims as the number of products and competitors grows and the functionality of products in different industry segments overlaps.

Our inability to protect our proprietary technology against unauthorized copying or use, as well as any costly litigation or diversion of our management’s attention and resources, could delay further sales or the implementation of our solutions, impair the functionality of our solutions, delay introductions of new solutions, result in our substituting inferior or more costly technologies into our solutions, or injure our reputation.

In addition, we may be required to license additional technology from third parties to develop and market new solutions, and we cannot ensure that we can license that technology on commercially reasonable terms or at all, and our inability to license this technology could harm our ability to compete.

We have in the past, and may in the future be subject to infringement claims, which could result in significant damage awards that could harm our results of operations.

There is considerable patent and other intellectual property development activity in our industry, and we expect that software companies will increasingly be subject to infringement claims as the number of solutions and competitors grows, and the functionality of solutions in different industry segments overlaps.

In addition, the patent portfolios of many of our competitors are larger than ours, and this disparity may increase the risk that our competitors may sue us for patent infringement and may limit our ability to counterclaim for patent infringement or settle through patent cross-licenses.

2 unchanged sentences

Further, we may be unaware of the intellectual property rights of others that may cover some or all of our technology.

Any claim of infringement, regardless of its merit or our defenses, could:

• require costly litigation to resolve and/or the payment of substantial damages, ongoing royalty payments or other amounts to settle such disputes;

• require significant management time and attention;

• cause us to enter into unfavorable royalty or license agreements, if such arrangements are available at all;

• require us to discontinue the sale of some or all of our products, remove or reduce features or functionality of our products or comply with other unfavorable terms;

• require us to indemnify our customers or third-party service providers;

• require us to expend additional development resources to redesign our products.

Any one or more of the above could harm our business, results of operations and financial condition.

We use open source software in our products, which could negatively affect our ability to offer our products and subject us to litigation or other actions.

We use open source software in our products and expect to use more open source software in the future.

Any claim of infringement, regardless of its merit or our defenses, could subject us to a number of risks described elsewhere in these risk factors, including those discussed under the title, “ If we fail to adequately protect our proprietary rights, our competitive position could be impaired and we may lose valuable assets, generate less revenue and incur costly litigation to protect our rights .”

We use open source software in our platforms, which could negatively affect our ability to offer our solutions and subject us to litigation or other actions.

We use open source software in our solutions and expect to use more open source software in the future.

From time to time, there have been claims challenging the ownership of open source software against companies that incorporate open source software into their products.

However, the terms of many open source licenses have not been interpreted by U.S.

courts, and there is a risk that these licenses could be construed in a way that could impose unanticipated conditions or restrictions on our ability to commercialize our products.

courts, and there is a risk that these licenses could be construed in a way that could impose unanticipated conditions or restrictions on our ability to commercialize our solutions.

As a result, we could be subject to lawsuits by parties claiming ownership of what we believe to be open source software.

Litigation could be costly for us to defend, have a negative effect on our results of operations and financial condition or require us to devote additional research and development resources to change our products.

In addition, if we were to combine our proprietary software products with open source software in a certain manner, we could, under certain of the open source licenses, be required to release the source code of our proprietary software to the public.

This would allow our competitors to create similar products with less development effort and time.

If we inappropriately use open source software, or if the license terms for open source software that we use change, we may be required to re-engineer our products, incur additional costs, discontinue the sale of some or all of our products or take other remedial actions.

In addition, if we were to combine our proprietary software with open source software in a certain manner, we could, under certain of the open source licenses, be required to release the source code of our proprietary software to the public, which could open security risks as well as risks to exposing some of our trade secrets.

This would allow our competitors to create similar solutions with less development effort and time.

If we inappropriately use open source software, or if the license

terms for open source software that we use change, we may be required to re-engineer our solutions, incur additional costs, discontinue the sale of some or all of our solutions or take other remedial actions.

Some open source software may include generative AI software or other software that incorporates or relies on generative AI or other AI technologies.

2 unchanged sentences

In addition to risks related to license requirements, usage of open source software can lead to greater risks than use of third-party commercial software, as open source licensors generally do not provide warranties or assurance of title or controls on origin of the software.

In addition, many of the risks associated with usage of open source software, such as the lack of warranties or assurances of title, cannot be eliminated, and could, if not properly addressed, negatively affect our business.

In addition, many of the risks associated with usage of open source software, such as security issues, potential loss of trade secret protection, and the lack of warranties or assurances of title, cannot be eliminated, and could, if not properly addressed, negatively affect our business.

We have established processes to help alleviate these risks, including a review process for screening requests from our development organizations for the use of open source software, but we cannot be sure that all of our use of open source software is in a manner that is consistent with our current policies and procedures, or will not subject us to liability.

Indemnity provisions in various agreements potentially expose us to substantial liability for intellectual property infringement and other losses.

Our agreements with customers and other third parties may include indemnification or other provisions under which we agree to indemnify or otherwise be liable to them for losses suffered or incurred as a result of claims of intellectual property infringement, damages caused by us to property or persons, or other liabilities relating to or arising from the use of our platform or other acts or omissions.

Our agreements with customers and other third parties include provisions under which we agree to indemnify or otherwise be liable to them for losses suffered or incurred as a result of claims of intellectual property infringement, damages caused by us to property or persons, or other liabilities relating to or arising from the use of our platforms or other acts or omissions.

From time to time, customers also require us to indemnify or otherwise be liable to them for breach of confidentiality, violation of applicable law, or failure to implement adequate security measures with respect to their data stored, transmitted, or accessed using our platforms.

The term of these contractual provisions often survives termination or expiration of the applicable agreement.

As we continue to grow, the possibility of infringement claims and other intellectual property rights claims against us may increase.

For any intellectual property rights indemnification claim against us or our customers, we will incur significant legal expenses and may have to pay damages, settlement fees, license fees and/or stop using technology found to be in violation of the third party’s rights.

Large indemnity payments could harm our business, results of operations and financial condition.

We may also have to seek a license for the infringing or allegedly infringing technology.

Such license may not be available on reasonable terms, if at all, and may significantly increase our operating expenses or may require us to restrict our business activities and limit our ability to deliver certain products.

As a result, we may also be required to develop alternative non-infringing technology, which could require significant effort and expense and/or cause us to alter our platform, which could negatively affect our business.

From time to time, customers require us to indemnify or otherwise be liable to them for breach of confidentiality, violation of applicable law or failure to implement adequate security measures with respect to their data stored, transmitted, or accessed using our platform.

Although we normally contractually limit our liability with

respect to such obligations, the existence of such a dispute may have adverse effects on our customer relationship and reputation and we may still incur substantial liability related to them.

Any assertions by a third party, whether or not successful, with respect to such indemnification obligations could subject us to costly and time-consuming litigation, expensive remediation and licenses, divert management attention and financial resources, harm our relationship with that customer and other current and prospective customers, reduce demand for our platform, and harm our brand, business, results of operations and financial condition.

Although we normally contractually limit our liability with respect to such obligations, the existence of such a dispute may have adverse effects on our customer relationship and reputation and we may still incur substantial liability or large indemnity payments.

This could significantly increase our operating expenses, require us to restrict our business activities, and limit our ability to deliver certain solutions, all of which could require significant time, effort and expense, harm our reputation and customer relationships, and negatively affect our business.

Risks Related to Legal, Accounting and Tax Matters

3 unchanged sentences

As a result, most of the revenue we report in each period is derived from the recognition of deferred revenue relating to subscriptions and support services contracts entered into during previous periods.

Consequently, a decrease in new or renewed subscriptions in any single reporting period will have a limited impact on our revenue for that period.

Consequently, a decrease in new or renewed subscriptions in any single reporting period will have a limited impact on our revenue for that period, but will negatively affect our revenue in future periods.

In addition, our ability to adjust our cost structure in the event of a decrease in new or renewed subscriptions may be limited.

Further, a decline in new subscriptions or renewals in a given period may not be fully reflected in our revenue for that period, but will negatively affect our revenue in future periods.

Accordingly, the effect of significant downturns in sales and market acceptance of our services, and changes in our rate of renewals, may not be fully reflected in our results of operations until future periods.

Our subscription model also makes it difficult for us to rapidly increase our revenue through additional sales in any period, as revenue from new customers is generally recognized over the applicable service period.

Our subscription model also makes it difficult for us to rapidly increase our revenue through additional sales in any period, as revenue from customers is generally recognized over the applicable service period.

Additionally, due to the complexity of certain of our customer contracts, the actual revenue recognition treatment required under relevant accounting principles generally accepted in the United States (“GAAP”) will depend on contract-specific terms and may result in greater variability in revenue from period to period.

In addition, a decrease in new subscriptions or renewals in a reporting period may not have an immediate impact on billings for that period.

We may face exposure to foreign currency exchange rate fluctuations.

We face exposure to foreign currency exchange rate fluctuations.

Today, a vast majority of our customer contracts are denominated in U.S.

9 unchanged sentences

We are subject to anti-corruption and anti-bribery and similar laws, such as the U.S.

Foreign Corrupt Practices Act of 1977, as amended (“FCPA”), the U.S.

Foreign Corrupt Practices Act of 1977, as amended (the “FCPA”), the U.S.

domestic bribery statute contained in 18 U.S.C.

3 unchanged sentences

As we increase our international sales and business, our risks under these laws may increase.

In addition, we use channel partners to sell our products and conduct business on our behalf.

In addition, we use channel partners to sell our solutions and conduct business on our behalf.

We or such partners may have direct or indirect interactions with officials and employees of government agencies or state-owned or affiliated entities and under certain circumstances we could be held liable for the corrupt or other illegal activities of such partners, and our employees, representatives, contractors, partners, and agents, even if we do not explicitly authorize such activities.

We have implemented an anti-corruption compliance program but cannot ensure that all our employees and agents, as well as those companies to which we outsource certain of our business operations, will not take actions in violation of our policies and applicable law, for which we may be ultimately held responsible.

Noncompliance with the FCPA, other applicable anti-corruption laws, or anti-money laundering laws could subject us to investigations, whistleblower complaints, sanctions, settlements, prosecution, and other enforcement actions within the U.S.

and internationally.

Any violation of these laws could result in disgorgement of profits, significant fines, damages, other civil and criminal penalties or injunctions, adverse media coverage, loss of export privileges, severe criminal or civil sanctions, suspension or debarment from U.S.

government contracts and other consequences, any of which could have a material adverse effect on our reputation, business, results of operations, and financial condition.

and internationally, which could have a material adverse effect on our reputation, business, results of operations, and financial condition.

We are subject to governmental export controls and economic sanctions laws that could impair our ability to compete in international markets and subject us to liability if we are not in full compliance with applicable laws.

Our business activities are subject to various restrictions under U.S.

export controls and trade and economic sanctions laws, including the U.S.

Commerce Department’s Export Administration Regulations and economic and trade sanctions regulations maintained by the U.S.

Treasury Department’s Office of Foreign Assets Control.

export control laws and U.S.

economic sanctions laws include prohibitions on the sale or supply of certain products and services to U.S.

export controls and trade and economic sanctions laws, which include prohibitions on the sale or supply of certain products and services to U.S.

embargoed or sanctioned countries, governments, persons and entities and also require authorization for the export of encryption items.

In addition, various countries regulate the import of certain encryption technology, including through import and licensing requirements, and have enacted laws that could limit our ability to distribute our service or could limit our customers’ ability to implement our service in those countries.

These laws and regulations may change frequently in response to evolving international issues.

If we fail to comply with these laws and regulations, we and certain of our employees could be subject to civil or criminal penalties, including the possible loss of export privileges and monetary penalties.

Obtaining the necessary authorizations, including any required license, for a particular transaction may be time-consuming, is not guaranteed, and may result in the delay or loss of sales opportunities.

Although we take precautions to prevent our products from being provided in violation of such laws, our products may have been in the past, and could in the future be, provided inadvertently in violation of such laws, despite the precautions we take.

Although we take precautions to prevent our solutions from being provided in violation of such laws, our solutions may have been in the past, and could in the future be, provided inadvertently in violation of such laws, despite the precautions we take.

This could result in negative consequences to us, including government investigations, penalties and harm to our reputation.

2 unchanged sentences

Our corporate structure and associated transfer pricing policies anticipate future growth into certain international markets.

The amount of taxes we pay in different jurisdictions may depend on the application of the tax laws of the various jurisdictions, including the United States, to our international business activities, changes in tax rates, new or revised tax laws or interpretations of existing tax laws and policies and our ability to operate our business in a manner consistent with our corporate structure and intercompany arrangements.

business in a manner consistent with our corporate structure and intercompany arrangements.

The taxing authorities of the jurisdictions in which we operate may challenge our methodologies for pricing intercompany transactions, which are generally required to be computed on an arm’s-length basis pursuant to intercompany arrangements or disagree with our determinations as to the income and expenses attributable to specific jurisdictions.

If such a challenge or disagreement were to occur, and our position was not sustained, we could be required to pay additional taxes, interest and penalties, which could result in one-time tax charges, higher effective tax rates, reduced cash flows and lower overall profitability of our operations.

If such a challenge or disagreement were to occur, and our position was not sustained, we could be required to pay additional taxes, interest and penalties, which could result in one-time tax charges, higher effective tax rates, reduced net cash flows and lower overall profitability of our operations.

Our financial statements could fail to reflect adequate reserves to cover such a contingency.

Changes in tax laws or regulations in the various tax jurisdictions we are subject to that are applied adversely to us or our customers could increase the costs of our products and harm our business.

Changes in tax laws or regulations in the various tax jurisdictions we are subject to that are applied adversely to us or our customers could increase the costs of our solutions and harm our business.

New income, sales, use, value-added or other transaction level taxes, tax laws, statutes, rules, regulations or ordinances could be enacted at any time.

Those enactments could adversely impact our domestic and international business operations, and our business and financial performance.

Further, existing tax laws, statutes, rules,

regulations or ordinances could be interpreted, changed, modified or applied adversely to us.

Further, existing tax laws, statutes, rules, regulations or ordinances could be interpreted, changed, modified or applied adversely to us.

These events could require us or our customers to pay additional tax amounts on a prospective or retroactive basis, as well as require us or our customers to pay fines and/or penalties and interest for past amounts deemed to be due.

If we raise our prices to offset the costs of these additional taxes, existing and potential future customers may elect not to purchase our products in the future.

Additionally, new, changed, modified or newly interpreted or applied tax laws could increase our customers’ and our compliance, operating and other costs, as well as the costs of our products.

If we raise our prices to offset the costs of these additional taxes, existing and potential future customers may elect not to purchase our solutions in the future.

Additionally, new, changed, modified or newly interpreted or applied tax laws could increase our compliance, operating and other costs, as well as the costs of our solutions to our customers.

Further, these events could decrease the capital we have available to operate our business.

7 unchanged sentences

State, foreign and local taxing jurisdictions have differing rules and regulations governing sales, use and other indirect taxes (including digital services taxes), and these rules and regulations are subject to varying interpretations that may change over time.

In particular, the applicability of certain sales, value-added and digital services taxes to our platform in various jurisdictions is unclear.

In particular, the applicability of certain sales, value-added and digital services taxes to our platforms in various jurisdictions is unclear.

It is possible that we could face tax audits and that our liability for these taxes could exceed our estimates as tax authorities could still assert that we are obligated to collect additional amounts as taxes from our customers and remit those taxes to those authorities.

We could also be subject to audits in states and international jurisdictions for which we have not accrued tax liabilities.

A successful assertion that we should be collecting additional sales or other taxes on our service in jurisdictions where we have not historically done so and do not accrue for such taxes could result in substantial tax liabilities for past sales, discourage customers from purchasing our products or otherwise harm our business, results of operations and financial condition.

We file sales tax returns in certain states within the United States as required by law and certain customer contracts for a portion of the products that we provide.

We do not collect sales or other similar taxes in other states and many of such states do not apply sales or similar taxes to the vast majority of the products that we provide.

A successful assertion that we should be collecting additional sales or other taxes on our solutions and services in jurisdictions where we have not historically done so and do not accrue for such taxes could result in substantial tax liabilities for past sales, discourage customers from purchasing our solutions or otherwise harm our business, results of operations and financial condition.

We file sales tax returns in certain states within the United States as required by law and certain customer contracts for a portion of the solutions that we provide.

We do not collect sales or other similar taxes in other states and many of such states do not apply sales or similar taxes to the vast majority of the solutions that we provide.

However, one or more states or foreign authorities could seek to impose additional sales, use or other tax collection and record-keeping obligations on us or may determine that such taxes should have, but have not been, paid by us.

10 unchanged sentences

The Sarbanes-Oxley Act requires, among other things, that we maintain effective disclosure controls and procedures and internal control over financial reporting.

In order to maintain the effectiveness of our disclosure controls and procedures and internal control over financial reporting, we have expended, and anticipate that we will continue to expend, significant resources, including accounting-related costs and significant management oversight.

To satisfy this obligation, we expend significant resources, including accounting-related costs and significant management oversight.

If any of these new or improved controls and systems do not perform as expected, we may experience material weaknesses or significant deficiencies in our controls.

Our controls may become inadequate because of changes in conditions in our business.

Further, weaknesses in our disclosure controls and internal control over financial reporting may be discovered in the future.

Any failure to maintain effective controls could harm our results of operations or cause us to fail to meet our reporting obligations and may result in a restatement of our financial statements for prior periods.

Any failure to maintain effective internal control over financial reporting also could adversely affect the results of periodic management evaluations and annual independent registered public accounting firm attestation reports regarding the effectiveness of our internal control over financial reporting that we are required to include in our periodic reports that are filed with the SEC.

Ineffective disclosure controls and procedures and internal control over financial reporting could also cause investors to lose confidence in our reported financial and other information, which would likely have a negative effect on the trading price of our Class A common stock.

In addition, if we are unable to continue to meet these requirements, we may not be able to remain listed on the Nasdaq.

We are required to provide an annual management report on the effectiveness of our internal control over financial reporting.

Our independent registered public accounting firm is required to formally attest to the effectiveness of our internal control over financial reporting annually.

Our independent registered public accounting firm may issue a report that is adverse in the event it is not satisfied with the level at which our internal control over financial reporting is documented, designed, or operating.

Any failure to maintain effective disclosure controls and internal control over financial reporting could harm our business and results of operations and could cause a decline in the price of our Class A common stock.

Our controls may also become inadequate because of changes in conditions in our business.

We may discover any such weaknesses or deficiencies in the future and be required to restate our financial statements for prior periods.

Ineffective internal controls over financial reporting could adversely affect the results of periodic management evaluations and annual independent registered public accounting firm attestation reports regarding the effectiveness of our internal control over financial reporting that we are required to include in our periodic reports that are filed with the SEC.

For example, investors could lose confidence in our reported financial and other information;

we could fail to satisfy our SEC, Nasdaq other reporting obligations, or become subject to sanctions or investigations by regulators;

and our the price of our Class A common stock could decline.

Changes in existing financial accounting standards or practices, or taxation rules or practices, may harm our results of operations.

13 unchanged sentences

For example, from February 1, 2024 through January 31, 2025, the trading price of our Class A common stock has ranged from $70.56 per share to $114.50 per share.

The market price of our Class A common stock fluctuates significantly in response to numerous factors, many of which are beyond our control, including, but not limited to:

The market price of our Class A common stock fluctuates significantly in response to numerous factors, many of which are beyond our control, including, but not limited to, the factors described elsewhere in these risk factors, as well as:

• overall performance of the equity markets and/or publicly-listed technology companies;

6 unchanged sentences

• recruitment or departure of key personnel;

• the economy as a whole, the inflation and interest rate environment and market and industry conditions;

• rumors and market speculation involving us or other companies in our industry;

• announcements by us or our competitors of significant innovations, acquisitions, strategic partnerships, joint ventures, or capital commitments;

• new laws or regulations or new interpretations of existing laws or regulations applicable to our business;

• lawsuits threatened or filed against us;

• other events or factors, including those resulting from war, incidents of terrorism, or responses to these events;

• sales of additional shares of our Class A common stock by us, our directors, our officers or our stockholders.

7 unchanged sentences

As of January 31, 2025, our directors, executive officers and their affiliates held in the aggregate 35.3% of the voting power of our capital stock, taking into account shares of our common stock subject to options that are currently exercisable or exercisable within 60 days of January 31, 2025 and RSUs that are releasable within 60 days of January 31, 2025.

Because of the ten-to-one voting ratio between our Class B and Class A common stock, the holders of our Class B common stock collectively could continue to control nearly a majority of the combined voting power of our common stock and be able to effectively control all matters submitted to our stockholders for approval until April 12, 2027, the date that is the ten-year anniversary of the closing of our IPO.

Because of the ten-to-one voting ratio between our Class B and Class A common stock, the

holders of our Class B common stock collectively could continue to control nearly a majority of the combined voting power of our common stock and be able to effectively control all matters submitted to our stockholders for approval until April 12, 2027, the date that is the ten-year anniversary of the closing of our IPO.

This concentrated control may limit or preclude your ability to influence corporate matters for the foreseeable future, including the election of directors, amendments of our organizational documents, and any merger, consolidation, sale of all or substantially all of our assets, or other major corporate transaction requiring stockholder approval.

19 unchanged sentences

Any determination to pay dividends in the future will be at the discretion of our board of directors.

Accordingly, investors must rely on sales of their Class A common stock after price appreciation, which may never occur, as the only way to realize any future gains on their investments.

Accordingly, investors must rely on sales of their Class A common

stock after price appreciation, which may never occur, as the only way to realize any future gains on their investments.

Provisions in our charter documents and under Delaware law could make an acquisition of our company more difficult, limit attempts by our stockholders to replace or remove our current board of directors, and limit the market price of our Class A common stock.

1 unchanged sentence

Our amended and restated certificate of incorporation and amended and restated bylaws include provisions that:

• provide that our board of directors is classified into three classes of directors with staggered three-year terms;

• permit the board of directors to establish the number of directors and fill any vacancies and newly-created directorships;

• provide that our board is classified into three classes of directors with staggered three-year terms;

• permit our board to establish the number of directors and fill any vacancies and newly-created directorships;

• require super-majority voting to amend some provisions in our amended and restated certificate of incorporation and amended and restated bylaws;

• authorize the issuance of “blank check” preferred stock that our board of directors could use to implement a stockholder rights plan;

• provide that only the Chairperson of our board of directors, our Chief Executive Officer, or a majority of our board of directors are authorized to call a special meeting of stockholders;

• provide that only the Chairperson of our board, our Chief Executive Officer, or a majority of our board of directors are authorized to call a special meeting of stockholders;

• provide for a dual class common stock structure in which holders of our Class B common stock have the ability to effectively control the outcome of matters requiring stockholder approval, even if they own significantly less than a majority of the outstanding shares of our Class A and Class B common stock, including the election of directors and significant corporate transactions, such as a merger or other sale of our company or its assets;

• prohibit stockholder action by written consent, which requires all stockholder actions to be taken at a meeting of our stockholders;

• provide that the board of directors is expressly authorized to make, alter or repeal our bylaws;

• advance notice requirements for nominations for election to our board of directors or for proposing matters that can be acted upon by stockholders at annual stockholder meetings.

• provide that our board is expressly authorized to make, alter or repeal our bylaws;

• advance notice requirements for nominations for election to our board or for proposing matters that can be acted upon by stockholders at annual stockholder meetings.

Moreover, Section 203 of the Delaware General Corporation Law may discourage, delay, or prevent a change in control of our company.

7 unchanged sentences

This choice of forum provision may limit a stockholder’s ability to bring a claim in a judicial forum that it finds favorable for disputes with us or any of our directors, officers, or other employees, which may discourage lawsuits with respect to such claims.

Alternatively, if a court were to find the choice of forum provision contained in our amended and restated certificate of incorporation to be inapplicable or unenforceable in an action, we may incur additional costs associated with resolving such action in other jurisdictions, which could harm our business, results of operations and financial condition.

Alternatively, if a court were to find the choice of forum provision contained in our amended and restated certificate of incorporation to be inapplicable or unenforceable in an action, we may incur

additional costs associated with resolving such action in other jurisdictions, which could harm our business, results of operations and financial condition.

Risks Related to our Outstanding Convertible Notes

34 unchanged sentences

In addition, even if holders do not elect to convert their Notes, we could be required under applicable accounting rules to reclassify all or a portion of the outstanding principal of the Notes as a current rather than long-term liability, which would result in a material reduction of our net working capital and could limit our ability to raise future capital.

As of January 31, 2025, the 2025 Notes have been classified as a current liability on our balance sheet due to their upcoming maturity on September 1, 2025.

Transactions relating to our Notes may affect the value of our Class A common stock.

14 unchanged sentences

Our success depends largely upon the continued services of our executive officers and other key employees.

We rely on our leadership team in the areas of research and development, operations, security, marketing, sales, customer support, general and administrative functions, and on individual contributors in our research and development and operations functions.

From time to time, there may be changes in our executive management team resulting from the hiring or departure of executives.

For example, our former Chief Operating Officer did not return as an employee following his recent sabbatical, though he is continuing to serve as a director and as Vice Chairman of the Board of Directors.

Such changes in our executive management team may be disruptive to our business.

We do not have employment agreements with our executive officers or other key personnel that require them to continue to work for us for any specified period and they could terminate their employment with us at any time.

The loss of one or more of our executive officers or key employees, and any failure to have in place and execute an effective succession plan for key executives, could harm our business.

Changes in our executive management team may also cause disruptions in, and harm to, our business.

The loss of one or more of our executive officers or key employees, and any failure to have in place and

execute an effective succession plan for key executives, could harm our business.

In addition, to execute our growth plan, we must attract and retain highly qualified personnel.

2 unchanged sentences

Our efforts to attract new personnel may be compounded by intensified restriction on travel, changes to immigration policy or the availability of work visas.

Many of the companies with which we compete for experienced personnel have greater resources than we have.

If we hire employees from competitors or other companies, their former employers may attempt to assert that these employees or we have breached their legal obligations, resulting in a diversion of our time and resources.

In addition, job candidates and existing employees often consider the value of the equity awards they receive in connection with their employment.

If the perceived value of our equity awards declines, it may harm our ability to recruit and retain highly skilled employees.

If we fail to attract new personnel or fail to retain and motivate our current personnel, our business and future growth prospects could be harmed.

2 unchanged sentences

We have a large employee presence in San Francisco, California, and the west coast of the United States contains active earthquake and wildfire zones which have the potential to disrupt our business.

For example, in the fall of 2019 and 2020, PG&E shut off power to certain cities in the San Francisco Bay Area in order to reduce the risk of wildfires and this resulted in many of our employees being unable to work remotely.

In the event of a major earthquake, hurricane or catastrophic event such as fire, power loss, telecommunications failure, vandalism, cyber-attack, war, terrorist attack or health epidemic (including COVID-19), we may be unable to continue our operations and may endure system interruptions, reputational harm, delays in our application development, lengthy interruptions in our products, breaches of data security and loss of critical data, all of which could harm our business, results of operations and financial condition.

In addition, the insurance we maintain may be insufficient to cover our losses resulting from disasters, cyber-attacks or other business interruptions, and any incidents may result in loss of, or increased costs of, such insurance.

Communications systems and infrastructure could be damaged or interrupted at any time due to a major catastrophic event such as an earthquake, hurricane, fire or flood;

power loss or a telecommunications failure;

an unauthorized or malicious act such as a cyber-attack, war or terrorist attack;

a health epidemic, or similar events or disruptions.

Such events could result in reputational harm, delays in our application development, breaches of data security and loss of critical data.

While we have backup systems for certain aspects of our operations, disaster recovery planning by its nature cannot be sufficient for all eventualities.

In addition, the insurance we maintain may be insufficient to compensate for losses from a major interruption.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors