What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2025-08-29 compared with 2024-09-06 · 165 added, 129 removed, 518 unchanged (36% of the section changed)

20 unchanged sentences

• We face intense competition in our market and we may lack sufficient financial or other resources to maintain or improve our competitive position.

• We may acquire other businesses, which could subject us to adverse claims or liabilities, require significant management attention, disrupt our business, adversely affect our operating results, may not result in the expected benefits of such acquisitions, and may dilute stockholder value.

• We have and may in the future acquire other businesses (including CyberArk), which could subject us to adverse claims or liabilities, require significant management attention, disrupt our business, adversely affect our operating results, may not result in the expected benefits of such acquisitions, and may dilute stockholder value.

• We may not complete the acquisition of CyberArk within the timeframe we anticipate or at all, which could negatively impact our future business and financial results.

• As a result of the CyberArk acquisition, we anticipate that the scope and size of our business will substantially change and result in certain incremental risks, including increased competition.

• If we do not accurately predict, prepare for, and respond promptly to rapidly evolving technological and market developments and successfully manage product and subscription introductions and transitions to meet changing end-customer needs in the enterprise security industry, our competitive position and prospects will be harmed.

10 unchanged sentences

Insufficient supply and inventory would result in lost sales opportunities or delayed revenue, while excess inventory would harm our gross margins.

• Because some of the key components in our hardware products come from limited sources of supply, we are susceptible to supply shortages or supply changes, which, in certain cases, have disrupted or delayed our scheduled product deliveries to our end-customers, increased our costs and may result in the loss of sales and end-customers.

• Our hardware products contain key components from limited sources of supply, including outside the United States, and we are susceptible to supply shortages, supply changes, and international regulations, which, in certain cases, have disrupted or delayed our scheduled product deliveries to our end-customers, increased our costs and may result in the loss of sales and end-customers.

• If we are unable to attract, retain, and motivate our key technical, sales, and management personnel, our business could suffer.

2 unchanged sentences

• We face risks associated with having operations and employees located in Israel.

• We are subject to governmental export and import controls that could subject us to liability or impair our ability to compete in international markets.

• We are subject to international trade regulations and governmental export and import controls that could subject us to liability or impair our ability to compete in international markets.

• We may incur increased costs to comply with privacy and data protection laws and, if we fail to comply, we could be subject to government enforcement actions, private litigation and adverse publicity.

• We may have exposure to tax liabilities that are greater than anticipated.

• If our estimates or judgments relating to our critical accounting policies are based on assumptions that change or prove to be incorrect, our operating results could fall below our publicly announced guidance or the expectations of securities analysts and investors, resulting in a decline in the market price of our common stock.

• If our estimates or judgments, including those relating to our critical accounting policies, are based on assumptions that change or prove to be incorrect, our operating results differ from our publicly announced guidance or the expectations of securities analysts and investors, resulting in a decline in the market price of our common stock.

• We are obligated to maintain proper and effective internal control over financial reporting.

We may not complete our analysis of our internal control over financial reporting in a timely manner, or our internal control may not be determined to be effective, which may adversely affect investor confidence in our company and, as a result, the value of our common stock.

• Our reputation and/or business could be negatively impacted by ESG matters and/or our reporting of such matters.

• Our reputation and/or business could be negatively impacted by corporate responsibility matters and/or our reporting of such matters.

• Failure to comply with governmental laws and regulations could harm our business.

• We may not have the ability to raise the funds necessary to settle conversions of our Notes, repurchase our Notes upon a fundamental change, or repay our Notes in cash at their maturity, and our future debt may contain limitations on our ability to pay cash upon conversion or repurchase of our Notes.

• We may still incur substantially more debt or take other actions that would diminish our ability to make payments on our Notes when due.

• The market price of our common stock historically has been volatile, and the value of an investment in our common stock could decline.

• The convertible note hedge and warrant transactions may affect the value of our common stock.

• The issuance of additional stock in connection with financings, acquisitions, investments, our stock incentive plans, the conversion of our Notes or exercise of the related Warrants, or otherwise will dilute stock held by all other stockholders.

• The warrant transactions may affect the value of our common stock.

• The issuance of additional stock in connection with financings, acquisitions, investments, our stock incentive plans, exercise of the 2025 Warrants, or otherwise will dilute stock held by all other stockholders.

• We cannot guarantee that our share repurchase program will be fully consummated or that it will enhance shareholder value, and share repurchases could affect the price of our common stock.

• We do not intend to pay dividends for the foreseeable future.

• Our charter documents and Delaware law, as well as certain provisions contained in the indentures governing our Notes, could discourage takeover attempts and lead to management entrenchment, which could also reduce the market price of our common stock.

• Our charter documents and Delaware law could discourage takeover attempts and lead to management entrenchment, which could also reduce the market price of our common stock.

• Our business is subject to the risks of earthquakes, fire, power outages, floods, health risks, and other catastrophic events, and to interruption by man-made problems, such as terrorism.

• Our failure to raise additional capital or generate the significant capital necessary to expand our operations and invest in new products and subscriptions could reduce our ability to compete and could harm our business.

Risks Related to Global Economic and Geopolitical Conditions

1 unchanged sentence

We operate globally, and as a result, our business and revenues are impacted by global economic and geopolitical conditions.

The instability in the global credit markets, inflation, changes in public policies such as domestic and international regulations, taxes, any increases in interest rates, fluctuations in foreign currency exchange rates, or international trade agreements, international trade disputes, geopolitical turmoil, and other disruptions to global and regional economies and markets continue to add uncertainty to global economic conditions.

Military actions or armed conflict, including the hostilities in Israel and the surrounding region, Russia’s invasion of Ukraine and any related political or economic responses and counter-responses, and uncertainty about, or changes in, government and trade relationships, policies, and treaties could also lead to worsening economic and market conditions and geopolitical environment.

The instability in the global credit markets, inflation, changes in public policies such as domestic and international legislation or regulations, changes in enforcement and administration policies, taxes, any increases in interest rates, fluctuations in foreign currency exchange rates, or international trade agreements, international trade disputes, trade regulations, tariffs and changes in tariffs, geopolitical turmoil, and other disruptions to global and regional economies and markets continue to add uncertainty to global economic conditions.

Military actions or armed conflict, including the hostilities in Israel and the surrounding region, the Russia-Ukraine war and any related political or economic responses and counter-responses, and uncertainty about, or changes in, government and trade relationships, policies, and treaties could also lead to worsening economic and market conditions and geopolitical environment.

In response to Russia’s invasion of Ukraine, the United States, along with the European Union (the “E.U.”) has imposed restrictive sanctions on Russia, Russian entities, and Russian citizens (“Sanctions on Russia”).

42 unchanged sentences

If we are unable to sell new and additional product, subscription, and support offerings to our end-customers, especially to large enterprise customers, our future revenue and operating results will be harmed.

Our future success depends, in part, on our ability to expand the deployment of our portfolio with existing end-customers, especially large enterprise customers, including through our platformization strategy, and create demand for our new offerings, The rate at which our end-customers purchase additional products, subscriptions, and support depends on a number of factors, including the perceived need for additional security products, including subscription and support offerings, as well as general economic conditions.

The rate at which our end-customers purchase additional products, subscriptions, and support depends on a number of factors, including the perceived need for additional security products, including subscription and support offerings, as well as general economic conditions.

If our efforts to sell additional products and subscriptions to our end-customers are not successful, our revenues may grow more slowly than expected or decline.

Sales to large enterprise end-customers, which is part of our growth strategy, involve risks that may not be present, or that are present to a lesser extent, with sales to smaller entities, such as (a) longer sales cycles and the associated risk that substantial time and resources may be spent on a potential end-customer that elects not to purchase our products, subscriptions, and support, and (b) increased purchasing power and leverage held by large end-customers in negotiating contractual arrangements.

Deployments for large enterprise end-customers are also more complex, require greater product functionality, scalability, and a broader range of services, and are more time-consuming.

Deployments for large enterprise end-customers are also more complex, require greater product functionality, scalability, and a broader range of services, and are more time-consuming and resource-consuming.

All of these factors add further risk to business conducted with these end-customers.

3 unchanged sentences

To do so, we must successfully convince prospective customers of the value of adopting our solutions.

We are engaging in costly marketing and sales efforts to accelerate platformization and attract new customers, which may fail or may not be as successful as intended or at all.

We are engaging in costly marketing and sales efforts to accelerate our strategies, including platformization, and attract new customers, which may fail or may not be as successful as intended or at all.

Additionally, prospective customers’ decisions to purchase our solutions depend on a variety of factors, many of which are out of our control.

17 unchanged sentences

Substantially all of our revenue is generated by sales through our channel partners, including distributors and resellers.

For fiscal 2024, four distributors individually represented 10% or more of our total revenue and in the aggregate represented 59.0% of our total revenue.

As of July 31, 2024, two distributors individually represented 10% or more of our gross accounts receivable and in the aggregate represented 31.5% of our gross accounts receivable.

For fiscal 2025, three distributors individually represented 10% or more of our total revenue and in the aggregate represented 44.2% of our total revenue.

As of July 31, 2025, three distributors individually represented 10% or more of our gross accounts receivable and in the aggregate represented 44.8% of our gross accounts receivable.

We provide our channel partners with specific training and programs to assist them in selling our products, including subscriptions and support offerings, but there can be no assurance that these steps will be utilized or effective.

22 unchanged sentences

The substantial majority of our sales to date to government entities have been made indirectly through our channel partners.

Government certification requirements for products and subscriptions like ours may change, thereby restricting our ability to sell into the federal government sector until we have attained the revised certification.

If our products and subscriptions are late in achieving or fail to achieve compliance with these certifications and standards, or our competitors achieve compliance with these certifications and standards, we may be disqualified from selling our products, subscriptions, and support offerings to such governmental entity, or be at a competitive disadvantage, which would harm our business, operating results, and financial condition.

Government demand and payment for our products, subscriptions, and support offerings may be impacted by government shutdowns, public sector budgetary cycles, contracting requirements, and funding authorizations, with funding reductions or delays adversely affecting public sector demand for our products, subscriptions, and support offerings.

Government certification or technical requirements for products and subscriptions like ours may change, thereby restricting our ability to sell into the federal government sector until we have attained the revised certification or technical requirements.

If our products and subscriptions are late in achieving or fail to achieve compliance with these certifications and standards or technical requirements, or our competitors achieve compliance with these certifications and standards or technical requirements, we may be disqualified from selling our products, subscriptions, and support offerings to such governmental entity, or be at a competitive disadvantage, which would harm our business, operating results, and financial condition.

Government entity demand and payment for our products, subscriptions, and support offerings may be impacted by government shutdowns, changes in governmental administrations, public sector budgetary cycles, fiscal policies, contracting policies or requirements, funding authorizations, and efforts by a government to evaluate and reduce overall government spending and analyze and enhance its operational efficiency, with funding reductions or delays adversely affecting public sector demand for our products, subscriptions, and support offerings.

Government entities may have statutory, contractual, or other legal rights to terminate contracts with our distributors and resellers for convenience or due to a default, and any such termination may adversely impact our future operating results.

1 unchanged sentence

Additionally, the U.S.

government may require certain of the products that it purchases to be manufactured in the United States and other relatively high-cost manufacturing locations, and we may not manufacture all products in locations that meet such requirements, affecting our ability to sell these products, subscriptions, and support offerings to the U.S.

government may require certain of the products that it purchases to be manufactured in the United States or other relatively high-cost manufacturing locations, and we may not manufacture all products in locations that meet such requirements, affecting our ability to sell these products, subscriptions, and support offerings to the U.S.

We face intense competition in our market and we may lack sufficient financial or other resources to maintain or improve our competitive position.

5 unchanged sentences

• public cloud vendors and startups that offer solutions for cloud security (private, public, and hybrid cloud).

Many of our competitors have greater financial, technical, marketing, sales, and other resources, greater name recognition, longer operating histories, and a larger base of customers than we do.

Some of our competitors have or may attain greater financial, technical, marketing, sales, and other resources, greater name recognition, longer operating histories, and a larger base of customers than we do.

They may be able to devote greater resources to the promotion and sale of products and services than we can, and they may offer lower pricing than we do.

Further, they may have greater resources for research and development of new technologies, the provision of customer support, and the pursuit of acquisitions.

Further, they may have greater resources for research and development of new technologies, the provision of customer support, and the pursuit of acquisitions or other strategic investments.

They may also have larger and more mature intellectual property portfolios, and broader and more diverse product and service offerings, which allow them to leverage their relationships based on other products or incorporate functionality into existing products to gain business in a manner that discourages users from purchasing our products and subscriptions, including incorporating cybersecurity features into their existing products or services and product bundling, selling at zero or negative margins, and offering concessions or a closed technology offering.

6 unchanged sentences

Due to budget constraints or economic downturns, organizations may add solutions to their existing network security infrastructure rather than replacing it with our products and subscriptions.

Conditions in our market could change rapidly and significantly as a result of technological advancements, partnering or acquisitions by our competitors, or continuing market consolidation.

Conditions in our market could change rapidly and significantly as a result of technological advancements, partnering, acquisitions or strategic investments by our competitors, or continuing market consolidation.

Our competitors and potential competitors may be able to develop new or disruptive technologies, products, or services, and leverage new business models that are equal or superior to ours, achieve greater market acceptance of their products and services, disrupt our markets, and increase sales by utilizing different distribution channels than we do.

2 unchanged sentences

Some of our competitors have made or could make acquisitions of businesses that may allow them to offer more directly competitive and comprehensive solutions than they had previously offered and adapt more quickly to new technologies and end-customer needs.

Our current and potential competitors may also establish cooperative relationships among themselves or with third parties that may further enhance their resources.

Our current and potential competitors may also establish cooperative relationships among themselves or with third parties that may further enhance their resources or product or service offerings.

These competitive pressures in our market or our failure to compete effectively may result in price reductions, fewer orders, reduced revenue and gross margins, and loss of market share.

If we are unable to compete successfully, or if competing successfully requires us to take aggressive pricing or other actions, our business, financial condition, and results of operations would be adversely affected.

We may acquire other businesses, which could subject us to adverse claims or liabilities, require significant management attention, disrupt our business, adversely affect our operating results, may not result in the expected benefits of such acquisitions, and may dilute stockholder value.

We have and may in the future acquire other businesses (including CyberArk), which could subject us to adverse claims or liabilities, require significant management attention, disrupt our business, adversely affect our operating results, may not result in the expected benefits of such acquisitions, and may dilute stockholder value.

As part of our business strategy, we acquire and make investments in complementary companies, products, or technologies.

We continue to evaluate such opportunities and expect to continue to make such acquisitions and investments in the future, such as our pending acquisition of CyberArk Software Ltd.

(“CyberArk”).

The identification of suitable acquisition candidates is difficult, and we may not be able to complete such acquisitions on favorable terms, if at all.

2 unchanged sentences

and we may incur costs and expenses necessary to address an acquired company’s failure to comply with laws and governmental rules and regulations.

Additionally, we may be subject to litigation or other claims in connection with the acquired company, including claims from terminated employees, customers, former stockholders, or other third parties, which may differ from or be more significant than the risks our business faces.

If we are unsuccessful at integrating past or future acquisitions in a timely manner, or the technologies, products, or operations associated with such acquisitions, into our company, our revenue and operating results could be adversely affected.

Additionally, we may be subject to litigation or other claims in connection with the acquired company, product, or technology, including claims from terminated employees, customers, former stockholders, or other third parties, which may differ from or be more significant than the risks our business faces.

If we are unsuccessful at integrating past or future acquisitions, including the pending acquisition of CyberArk, in a timely manner, or the technologies, products, or operations associated with such acquisitions, into our company, our revenue and operating results could be adversely affected.

Any integration process may require significant time and resources, which may disrupt our ongoing business and divert management’s attention, and we may not be able to manage the integration process successfully or in a timely manner.

We may have difficulty retaining key personnel of the acquired business.

We may not successfully evaluate or utilize the acquired technology, products, or personnel, realize anticipated synergies from the acquisition, or accurately forecast the financial impact of an acquisition transaction and integration of such acquisition, including accounting charges and any potential impairment of goodwill and intangible assets recognized in connection with such acquisitions.

We may have difficulty retaining key personnel or customers of the acquired business.

We may not successfully evaluate or utilize any acquired technology, products, or personnel, realize anticipated synergies from an acquisition, or accurately forecast the financial impact of an acquisition transaction and integration of such acquisition, including accounting charges and any potential impairment of goodwill and intangible assets recognized in connection with such acquisitions.

In particular, we believe that there are significant benefits and synergies that may be realized from our proposed acquisition of CyberArk, including through leveraging our and CyberArk’s products, scale, and combined enterprise customer bases.

However, the efforts to realize the anticipated benefits and synergies will be a complex process and may disrupt both our and CyberArk’s existing operations if not implemented in a timely and efficient manner.

The full benefits of the proposed acquisition of CyberArk, including the anticipated sales or growth opportunities, may not be realized as expected or may not be achieved within the anticipated time frame, or at all.

We have recorded, and may in the future record, liability for contingent consideration obligations from acquisitions that are to be settled in cash, the fair value of which is assessed on a quarterly basis.

If changes are made in our assumptions used to determine the liability’s fair value or our assumptions are incorrect, adjustments could be made that may have a material impact, favorable or unfavorable, on our operating results.

We may also be required to make cash payments of contingent consideration in excess of its initial fair value, or in excess of our expectations for a particular period, which could adversely impact cash flows.

We may have to pay cash, incur debt, or issue equity or equity-linked securities to pay for any future acquisitions, including the pending acquisition of CyberArk, each of which could adversely affect our financial condition or the market price of our common stock, and result in dilution to our stockholders.

Furthermore, the sale or issuance of equity or equity-linked debt to finance any future acquisitions could result in dilution to our stockholders.

In addition, any acquisitions may be viewed negatively by our customers, financial markets, or investors and may not ultimately strengthen our competitive position or achieve our goals and business strategy.

We may have to pay cash, incur debt, or issue equity or equity-linked securities to pay for any future acquisitions, each of which could adversely affect our financial condition or the market price of our common stock.

Furthermore, the sale of equity or issuance of equity-linked debt to finance any future acquisitions could result in dilution to our stockholders.

The occurrence of any of these risks could harm our business, operating results, and financial condition.

We may not complete the acquisition of CyberArk within the timeframe we anticipate or at all, which could negatively impact our future business and financial results .

The completion of the acquisition of CyberArk is subject to a number of conditions, including, among others:

• the effectiveness of a registration statement on Form S-4 to be filed by us registering the shares of our common stock to be issued to CyberArk shareholders as consideration in the acquisition and the absence of any stop order or proceedings seeking a stop order;

• the approval for listing on Nasdaq of our shares of common stock to be issued in connection with the proposed acquisition;

• obtaining the requisite CyberArk shareholder approval in connection with the proposed acquisition;

• the expiration or termination of any waiting period (or extensions thereof) applicable to the acquisition under the Hart-Scott-Rodino Antitrust Improvements Act of 1976, as amended (the “HSR Act”) and the making, approval, expiration, termination or receipt of, as applicable, all applicable filings, registrations, waiting periods (or extensions of waiting periods) and approvals under specified antitrust and foreign investment laws;

• the absence of governmental restraints or prohibitions preventing the consummation of the proposed acquisition.

No assurance can be given that the required CyberArk shareholder approval and governmental and regulatory consents and approvals will be obtained or that any of the required conditions to closing will be satisfied in a timely manner or at all.

As a result, although it is currently anticipated that we will complete the acquisition of CyberArk during the second half of our fiscal 2026, the possible timing and likelihood of completion are uncertain.

There can be no assurance that the acquisition of CyberArk will be completed in the anticipated timeframe or at all.

Any delay in completing the proposed acquisition could cause the combined company not to realize, or to be delayed in realizing, some or all of the benefits and synergies that we anticipate to achieve if the proposed acquisition were to be successfully completed within its expected time frame.

In addition, the relevant governmental authorities from which approvals under specified antitrust and foreign investment laws must be obtained may impose or seek to impose conditions on the completion of the acquisition or require changes to the terms of the proposed acquisition or agreements to be entered into in connection with the CyberArk acquisition.

Such conditions or changes and the process of obtaining these approvals, could have the effect of delaying or impeding completion of the CyberArk acquisition or imposing additional costs or limitations on us following the acquisition, which may have an adverse effect on our business, results of operations, and financial condition.

The failure or inability to satisfy all of the required conditions could delay the completion of the acquisition for a significant period of time or prevent it from occurring at all.

In addition, under limited circumstances, we or CyberArk may elect to terminate the definitive agreement or we and CyberArk may mutually decide to terminate the definitive agreement, before or after obtaining the requisite CyberArk shareholder approval.

A termination of the definitive agreement could materially and adversely affect our business, results of operations and reputation.

If the acquisition of CyberArk is delayed or not completed, we could be subject to a number of risks that may adversely affect our business, operating results and financial condition, including, among other things:

• we may experience negative reactions from the financial markets, including negative impacts on the market price of our common stock;

• we could incur significant acquisition costs that we would be unable to recoup;

• under specified circumstances in connection with the termination of the definitive agreement, we would be required to pay CyberArk a termination fee of $1.0 billion;

• negative perception from industry contacts, business partners, and other third parties, which could impact our operations or our ability to compete for new business or obtain renewals in the marketplace more broadly;

• reputational harm, negative publicity, negative reactions from employees, and other negative impacts resulting from delay or failure to complete the acquisition of CyberArk.

As a result of the CyberArk acquisition, we anticipate that the scope and size of our business will substantially change and result in certain incremental risks, including increased competition .

We believe that the CyberArk acquisition will expand the scope and size of our business by adding substantial assets and operations to our existing business.

The anticipated future growth of our business may impose significant added responsibilities on our senior management, and our senior management’s attention may be diverted from the management of our business and its day-to-day operations to the completion and integration of the CyberArk acquisition.

The CyberArk acquisition could also create uncertainty for our and CyberArk’s employees, partners, and customers, particularly during the anticipated post-acquisition integration process, and result in disruption to existing business relationships and the development of new business relationships.

Following completion of the proposed acquisition of CyberArk, our success, including with respect to realizing the anticipated benefits and synergies from the proposed acquisition, will depend, in part, on our ability to manage our expansion, which poses numerous risks and uncertainties, including the need to integrate the operations and business of CyberArk into our existing business in a timely and efficient manner, to combine systems and management controls and to integrate relationships with industry contacts and business partners.

In addition, we will be required to devote significant attention and resources prior to closing to prepare for the post-closing integration and operation of the combined company, and we will be required post-closing to devote significant attention and resources to successfully align our and CyberArk’s business practices and operations.

This process may disrupt our business and, if ineffective, would limit the anticipated benefits and synergies of the acquisition.

In addition, we expect that the completion of the CyberArk acquisition will result in increased competition, including, as a result of our entry into a new product category.

CyberArk faces intense competition in the information security and identity security industry in which it operates, characterized by constant innovation, evolving customer requirements, and rapid adoption of different technologies and services.

These added competitive pressures could result in decreased sales, price reductions, increased operating costs, and lower revenues, margins and net income for the combined company.

These impacts could also result in a delay in realizing, or our failure to realize, expected synergies or cost savings from the CyberArk acquisition.

The occurrence of any of these risks could harm our business, operating results, and financial condition.

If we do not accurately predict, prepare for, and respond promptly to rapidly evolving technological and market developments and successfully manage product and subscription introductions and transitions to meet changing end-customer needs in the enterprise security industry, our competitive position and prospects will be harmed.

25 unchanged sentences

Such investments ultimately may not be commercially viable or may not result in an adequate return of capital and we may incur unanticipated liabilities.

These efforts could subject us to regulatory risk, legal liability, including under new proposed legislation regulating AI in jurisdictions such as the E.U.

and regulations being considered in other jurisdictions, or brand or reputational harm.

These efforts could subject us to regulatory risk, legal liability, including under legislation regulating AI in jurisdictions such as the E.U.

and laws and regulations being considered in other jurisdictions, or brand or reputational harm.

The rapid evolution of AI, including potential government regulation of AI, requires us to invest significant resources to develop, test, and maintain AI in our products and services in a manner that meets evolving requirements and expectations.

5 unchanged sentences

A network or data security incident may allow unauthorized access to our network or data, harm our reputation, create additional liability, and adversely impact our financial results.

Increasingly, companies are subject to a wide variety of attacks on their networks on an ongoing basis.

Increasingly, companies are subject to a wide variety of attacks on an ongoing basis.

In addition to traditional computer “hackers,” malicious code (such as viruses and worms), phishing attempts, employee theft or misuse, and denial of service attacks, sophisticated nation-state and nation-state supported actors engage in intrusions and attacks (including advanced persistent threat intrusions and supply chain attacks), and add to the risks to our internal networks, cloud-deployed enterprise and customer-facing environments and the information they store and process.

4 unchanged sentences

Furthermore, as a well-known provider of security solutions, we may be a more attractive target for such attacks.

The conflict in Ukraine and associated activities in Ukraine and Russia may increase the risk of cyberattacks on various types of infrastructure and operations, and the United States government has warned companies to be prepared for a significant increase in Russian cyberattacks in response to the Sanctions on Russia.

The Russia-Ukraine war and associated activities in Ukraine and Russia may increase the risk of cyberattacks on various types of infrastructure and operations, and the United States government has warned companies to be prepared for additional Russian cyberattacks in response to the Sanctions on Russia.

A security breach or incident, or an attack against our service availability suffered by us, or our third-party service providers, could impact our networks or networks secured by our products and subscriptions, creating system disruptions or slowdowns and exploiting security vulnerabilities of our products.

6 unchanged sentences

For example, from time to time, certain of our end-customers have reported defects in our products related to performance, scalability, and compatibility.

Additionally, defects or vulnerabilities may cause our products or subscriptions to become temporarily unavailable, to be vulnerable to security attacks, cause them to fail to help secure networks, or temporarily interrupt end-customers’ networking traffic, or the availability of other information technology infrastructure or systems.

For example, in April 2024, we became aware of a command injection vulnerability in the GlobalProtect feature of certain versions of our PAN-OS software.

To remediate the matter, we published a security advisory to advise customers, provided software updates for affected PAN-OS versions, and are actively engaged in customer outreach, support and remediation efforts for potentially impacted customers.

Additionally, defects or vulnerabilities may cause our products or subscriptions to become partially or fully unavailable temporarily or permanently, to be vulnerable to security attacks, cause them to fail to help secure networks, or interrupt end-customers’ networking traffic, or the availability of other information technology infrastructure or systems.

For example, in November 2024, we became aware of an authentication bypass vulnerability through the management web interface of certain versions of our PAN-OS software.

To remediate the matter, we published a security advisory to advise customers, provided software updates for affected PAN-OS versions, and engaged in customer outreach, support and remediation efforts for potentially impacted customers.

Because the techniques used by computer hackers to access or sabotage networks change frequently and generally are not recognized until launched against a target, we may be unable to anticipate these techniques and provide a solution in time to protect our end-customers’ networks.

In addition, due to the Russian invasion of Ukraine, there could be a significant increase in Russian cyberattacks against our customers, resulting in an increased risk of a security breach of our end-customers’ systems.

Furthermore, defects or errors in products or software or updates to those products or software could result in a failure to effectively update end-customers’ hardware and cloud-based products or otherwise cause problems in our customers hardware, networks or information technology infrastructure or systems.

In addition, due to the Russia-Ukraine war, there could be a significant increase in Russian cyberattacks against our customers, resulting in an increased risk of a security breach of our end-customers’ systems.

Furthermore, defects or errors in products or software, or migrations or updates to those products or software, could result in a failure to effectively update end-customers’ hardware and cloud-based products or otherwise cause problems in our customers’ hardware, networks or information technology infrastructure or systems.

The data centers, networks, and cloud infrastructure that we use to deliver our products and services may experience technical failures and downtime or may fail to meet the increased requirements of a growing installed end-customer base, any of which could temporarily or permanently expose our end-customers’ networks, leaving their networks unprotected against the latest security threats.

2 unchanged sentences

Any such technical failure, downtime or failures in general may temporarily or permanently disable our end-customers’ networks, information technology infrastructure or other systems, or expose our end-customers’ networks to attacks from security threats.

The occurrence of any such problem in our products and subscriptions, whether real or perceived, could result in:

The occurrence of any such problem in our products and subscriptions, or migrations or updates to those products or software, whether real or perceived, could result in:

• expenditure of significant financial and product development resources in efforts to analyze, correct, eliminate, or work-around errors or defects or to address and eliminate vulnerabilities;

28 unchanged sentences

For example, on January 31, 2024, in the Centripetal Networks, Inc.

lawsuit against us, a jury returned a verdict of non-willful infringement with a lump sum amount of $151.5 million, plus statutory interest, for which we have accrued $184.4 million for the verdict amount and estimated interest as of July 31, 2024.

lawsuit against us, a jury returned a verdict of non-willful infringement, and, after post-trial motions, a judgment was issued in the lawsuit on October 3, 2024 assessing a lump sum damages amount of $113.6 million, plus statutory interest, which is currently on appeal.

Additional examples of patent infringement cases have been disclosed in Note 13.

34 unchanged sentences

Some open source licenses contain requirements that we make available applicable source code for modifications or derivative works we create based upon the type of open source software we use.

If we combine our proprietary software with open source software in a certain manner, we could, under certain open source licenses, be required to release the source code of our proprietary software to the public.

If we combine our proprietary software with, or otherwise distribute or use open source software in a certain manner, we could, under certain open source licenses, be required to release the source code of our proprietary software to the public.

This would allow our competitors to create similar products or subscriptions with lower development effort and time and ultimately could result in a loss of product sales for us.

22 unchanged sentences

Some of the components in our products are sourced either through Flex or directly by us from component suppliers outside the United States.

The portion of our hardware products that are sourced outside the United States may subject us to geopolitical risks, additional logistical risks or risks associated with complying with local rules and regulations in foreign countries.

Significant changes to existing international trade agreements could lead to sourcing or logistics disruption resulting from import delays or the imposition of increased tariffs on our sourcing partners.

The portion of our hardware products that are sourced outside the United States may subject us to geopolitical risks, additional logistical risks, risks associated with international trade agreements, international trade disputes, trade regulations, tariffs, or risks associated with complying with local rules and regulations in foreign countries.

Significant changes to existing international trade agreements, tariffs, or trade regulations could lead to sourcing or logistics disruption resulting from import delays or the imposition of increased tariffs on our sourcing partners.

For example, the United States and Chinese governments have each enacted, and discussed additional, import tariffs.

Some components that we import for final manufacturing in the United States have been impacted by these tariffs.

As a result, our costs have increased and we have raised, and may be required to further raise, prices on our hardware products.

As a result, our costs have increased and we have raised, and may be required to further raise, prices on our hardware products in response to these and potential new trade regulations.

Our manufacturing partners typically fulfill our supply requirements on the basis of individual purchase orders.

7 unchanged sentences

Our manufacturing partners procure components and build our hardware products based on our forecasts, and we generally do not hold inventory for a prolonged period of time.

These forecasts are based on estimates of future demand for our products, which are in turn based on historical trends and analyses from our sales and product management organizations, adjusted for overall market conditions.

These forecasts are based on historical trends and analysis, adjusted for overall market conditions.

In order to reduce manufacturing lead times and plan for adequate component supply, from time to time we may issue forecasts for components and products that are non-cancelable and non-returnable.

4 unchanged sentences

If we are unable to effectively manage our supply and inventory, our operating results could be adversely affected.

Because some of the key components in our hardware products come from limited sources of supply, we are susceptible to supply shortages or supply changes, which, in certain cases, have disrupted or delayed our scheduled product deliveries to our end-customers, increased our costs and may result in the loss of sales and end-customers.

Our hardware products contain key components from limited sources of supply, including outside the United States, and we are susceptible to supply shortages, supply changes, and international regulations, which, in certain cases, have disrupted or delayed our scheduled product deliveries to our end-customers, increased our costs and may result in the loss of sales and end-customers.

Our hardware products rely on key components, including integrated circuit components, which our manufacturing partners purchase on our behalf from a limited number of component suppliers, including sole source providers.

The manufacturing operations of some of our component suppliers are geographically concentrated in Asia and elsewhere, which makes our supply chain vulnerable to regional disruptions, such as natural disasters, fire, political instability, civil unrest, power outages, or health risks.

In the past, we experienced supply chain disruption and have incurred increased costs resulting from inflationary pressures.

In the past, we experienced supply chain disruption and have incurred increased costs resulting from inflationary pressures and changes in U.S.

trade policy.

We are also monitoring the tensions between China and Taiwan, and between the U.S.

10 unchanged sentences

For example, we are substantially dependent on the continued service of our engineering personnel because of the complexity of our offerings.

Competition for highly skilled personnel, particularly in engineering, including in the areas of AI and machine learning, is often intense, especially in the San Francisco Bay Area, where we have a substantial presence and need for such personnel.

Competition for highly skilled personnel, particularly in engineering, including in the areas of AI and machine learning, is intense, especially in the San Francisco Bay Area, where we have a substantial presence and need for such personnel.

In addition, the industry in which we operate generally experiences high employee attrition.

3 unchanged sentences

As we grow and change, we may find it difficult to maintain these important aspects of our corporate culture.

While we are taking steps to develop a more inclusive and diverse workforce, there is no guarantee that we will be able to do so.

While we are taking steps to develop a more inclusive workforce, there is no guarantee that we will be able to do so.

Any failure to preserve our culture as we grow could limit our ability to innovate and could negatively affect our ability to retain and recruit personnel, continue to perform at current levels or execute on our business strategy.

6 unchanged sentences

Additionally, our international sales and operations are subject to a number of risks, including the following:

• political, economic, and social uncertainty around the world, health risks such as epidemics and pandemics like COVID-19, macroeconomic challenges, terrorist activities, Russia’s invasion of Ukraine, tensions between China and Taiwan, the hostilities in Israel and the surrounding region, and continued hostilities in the Middle East;

• unexpected changes in, or the application of, foreign and domestic laws and regulations (including intellectual property rights protections), regulatory practices, trade restrictions, and foreign legal requirements, including those applicable to the importation, certification, and localization of our products, tariffs, and tax laws and treaties, including regulatory and trade policy changes adopted by the current administration, such as the Sanctions on Russia, or foreign countries in response to regulatory changes adopted by the current administration;

• political, economic, and social uncertainty around the world, health risks such as epidemics and pandemics like COVID-19, macroeconomic challenges, terrorist activities, the Russia-Ukraine war, tensions between China and Taiwan, the hostilities in Israel and the surrounding region, and continued hostilities in the Middle East;

• unexpected changes in, or the application of, foreign and domestic laws and regulations (including intellectual property rights protections), regulatory practices or enforcement policies, trade restrictions, international trade agreements, and foreign legal requirements, including those applicable to the importation, certification, and localization of our products, tariffs, and tax laws and treaties, including regulatory and trade policy changes adopted by the current administration, such as the Sanctions on Russia, or foreign countries in response to regulatory changes adopted by the current administration;

• non-compliance with U.S.

6 unchanged sentences

We are exposed to fluctuations in foreign currency exchange rates, which could negatively affect our financial condition and operating results.

Our sales contracts are denominated in U.S.

dollars, and therefore, our revenue is not subject to foreign currency risk;

Our sales contracts are primarily denominated in U.S.

dollars, and therefore, a predominant amount of our revenue is not subject to foreign currency risk.

However, in the event of a strengthening of the U.S.

dollar against foreign currencies in which we conduct business, the cost of our products to our end-customers outside of the United States would increase, which could adversely affect our financial condition and operating results.

In addition, increased international sales in the future, including through our channel partners and other partnerships or as a result of our acquisitions, may result in foreign currency denominated sales, increasing our foreign currency risk.

In addition, increased international sales in the future, including through our channel partners and other partnerships or as a result of our acquisitions, may result in increased foreign currency denominated sales, increasing our foreign currency risk.

Our operating expenses incurred outside the United States and denominated in foreign currencies are generally increasing and are subject to fluctuations due to changes in foreign currency exchange rates.

If we are not able to successfully hedge against the risks associated with foreign currency fluctuations, our financial condition and operating results could be adversely affected.

We have entered into forward contracts in an effort to reduce our foreign currency exchange exposure related to our foreign currency denominated expenditures.

We have entered into forward contracts in an effort to reduce our foreign currency exchange exposure related to our foreign currency denominated revenue and operating expenditures.

As of July 31, 2025, the total notional amount of our outstanding foreign currency forward contracts was $1.5 billion.

3 unchanged sentences

We face risks associated with having operations and employees located in Israel.

We have business operations in Israel and intend to continue growing our presence in Israel.

We have business operations in Israel and intend to continue growing our presence in Israel, including in connection with our proposed acquisition of CyberArk.

Our operations in Israel could be disrupted by political instability, civil unrest, terrorist attacks, acts of violence, acts of war, or other military actions, including the hostilities in Israel and the surrounding region.

3 unchanged sentences

In addition, many of our employees in Israel are obligated to perform annual reserve duty in the Israeli military and are subject to being called for active duty under emergency circumstances, which has occurred as a result of hostilities in Israel and the surrounding region.

We cannot predict the full impact of these conditions on us in the future, particularly if emergency circumstances or an escalation in the political situation occurs.

We cannot predict the full impact of these conditions on us in the future, particularly if emergency circumstances or an escalation in the political situation or hostilities occurs.

If many of our employees in Israel are called for active duty for a significant period of time, our operations and our business could be disrupted and may not be able to function at full capacity.

Any disruption in our operations in Israel could adversely affect our business.

We are subject to governmental export and import controls that could subject us to liability or impair our ability to compete in international markets.

We are subject to international trade regulations and governmental export and import controls that could subject us to liability or impair our ability to compete in international markets.

Because we incorporate encryption technology into our products, certain of our products are subject to U.S.

3 unchanged sentences

customs regulations, U.S.

economic sanctions, or other laws, we could be subject to substantial civil and criminal penalties, including fines, incarceration for responsible employees and managers, and the possible loss of export or import privileges.

economic sanctions, or other laws or regulations, we could be subject to substantial civil and criminal penalties, including fines, incarceration for responsible employees and managers, and the possible loss of export or import privileges.

Obtaining the necessary export license for a particular sale may be time-consuming and may result in the delay or loss of sales opportunities.

7 unchanged sentences

Any decreased use of our products or limitation on our ability to export to or sell our products in international markets would likely adversely affect our business, financial condition, and operating results.

International trade laws and regulations continuously evolve to address technological developments and changes in geopolitical conditions.

New regulations or other governmental restrictions that may result from these circumstances could inhibit our ability to transact with foreign suppliers, customers, or other business partners.

Monitoring and responding to these developments may require significant resources, and failure to comply with resulting regulations and restrictions may have an adverse impact on our business or results of operation.

RISKS RELATED TO PRIVACY AND DATA PROTECTION

9 unchanged sentences

General Data Protection Regulation (“U.K.

GDPR,” and collectively the “GDPR”), both of which impose stringent data protection requirements, provide for costly penalties for noncompliance (up to the greater of (a) €20 million under the “E.U.

GDPR,” and collectively the “GDPR”), each of which imposes stringent data protection requirements, provide for costly penalties for noncompliance (up to the greater of (a) €20 million under the E.U.

GDPR or £17.5 million under the U.K.

GDPR, and (b) 4% of annual worldwide turnover), and confer the right upon data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies, and obtain compensation for damages resulting from violations.

The GDPR requires, among other things, that personal data be transferred outside of the E.U.

(or, in the case of the U.K.

GDPR, the U.K.) to the United States and other jurisdictions only where adequate safeguards are implemented or a derogation applies.

The GDPR imposes restrictions, among other things, on the transfer of personal data outside of the European Economic Area (“EEA”) (or, in the case of the U.K.

GDPR, the U.K.) to non-EEA countries, such as the United States, unless adequate safeguards are implemented or a derogation applies.

In practice, we rely on standard contractual clauses approved under the GDPR to carry out such transfers and to receive personal data subject to the GDPR (directly or indirectly) in the United States.

1 unchanged sentence

Data Privacy Framework (“E.U.-U.S.

DPF”), which has been approved for transfers of personal data subject to the GDPR to the United States.

The E.U.-U.S.

DPF has been recognized as adequate under the E.U.

law to allow transfers of personal data from the E.U.

to companies in the U.S.

DPF”), the UK Extension to the E.U.-U.S.

DPF, and the Swiss-U.S.

Data Privacy Framework (collectively, the “DPF”), as set forth by the U.S.

Department of Commerce, regarding transfers of certain personal data from the E.U., the U.K., and Switzerland to the United States.

The DPF has been recognized as adequate under applicable law to allow transfers of personal data from the E.U., U.K., and Switzerland, as the case may be, to companies in the U.S.

that have self-certified to the framework.

However, the E.U.-U.S.

DPF may be subject to legal challenge, which could cause the legal requirements for data transfers from the E.U.

to be uncertain.

Among other effects, we may experience additional costs associated with increased compliance burdens, reduced demand for our offerings from current or prospective customers in the European Economic Area (“EEA”), Switzerland, and the U.K.

(collectively, “Europe”) to use our products, on account of the risks identified in the Schrems II decision, and we may find it necessary or desirable to make further changes to our processing of personal data of European residents.

The regulatory environment applicable to the handling of European residents’ personal data, and our actions taken in response, may cause us to assume additional liabilities or incur additional costs.

However, the DPF may be subject to legal challenges, which could invalidate its use, disrupt our ability to rely on such data transfer mechanisms, and otherwise cause the legal requirements for such data transfers to be uncertain.

In addition, the U.K.

government enacted the U.K.

Data (Use and Access) Act 2025 on June 19, 2025, which includes targeted amendments to the U.K.’s data protection regime that cause it to expressly deviate from the GDPR.

This development creates new compliance challenges and has created uncertainty with respect to the European Commission’s adequacy determination regarding the U.K.’s data protection regime, which has been extended until December 2025 and must be renewed to permit ongoing relatively unrestricted data flows from the EEA to the UK.

Among other effects of these developments, we may experience additional costs associated with increased compliance burdens, reduced demand for our offerings from current or prospective customers in the EEA, Switzerland, and the U.K.

(collectively, “Europe”) to use our products, on account of the risks identified in the Schrems II decision or other developments relating to cross-border data transfers, and we may find it necessary or desirable to make further changes to our processing of personal data of European residents.

The regulatory environment applicable to the handling of European residents’ personal data and cross-border data transfers, and our actions taken in response, may cause us to assume additional liabilities or incur additional costs.

Moreover, much like with Schrems II, we anticipate future legal challenges to the approved data transfer mechanisms between Europe and the United States, including a challenge to the E.U.-U.S.

1 unchanged sentence

We are also subject to the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the “CCPA”).

The CCPA requires, among other things, covered companies to provide enhanced disclosures to California consumers and to afford such consumers certain rights regarding their personal data, including the right to opt out of data sales for targeted advertising, and creates a private right of action to individuals affected by a data breach, if the breach was caused by a lack of reasonable security.

The CCPA requires, among other things, covered businesses to provide enhanced disclosures to California consumers and to afford such consumers certain rights regarding their personal data, including the right to opt out of data sales for targeted advertising, and creates a private right of action to individuals affected by a data breach, if the breach was caused by a lack of reasonable security.

The effects of the CCPA have been significant, requiring us to modify our data processing practices and policies and to incur substantial costs and expenses for compliance.

Moreover, additional state privacy laws have been passed and will require potentially substantial efforts to obtain compliance.

These include laws enacted in at least 19 states, and six other states have active privacy bills pending in state legislative processes.

Moreover, other U.S.

states have enacted laws relating to privacy and security that are potentially relevant to us.

These include laws enacted in at least 20 U.S.

states, a portion of which are expected to come into effect over the course of our fiscal 2026.

Department of Justice also has issued rules regarding access to, or transfer of, certain bulk sensitive personal data by countries of concern.

Increasingly complex federal or state laws and regulations relating to privacy and security, and interpretations and enforcement of existing laws and regulations relating to these matters, may require us to modify our data practices and policies, incur substantial compliance costs and expenses, and add further complexity to our compliance efforts that could adversely affect our business or increase our potential liability if we fail to comply or are alleged to have done so.

We may also from time to time be subject to obligations relating to personal data by contract, or face assertions that we are subject to self-regulatory obligations or industry standards.

13 unchanged sentences

The tax authorities of the jurisdictions in which we operate may challenge our methodologies for valuing developed or acquired technology or determining the proper charges for intercompany arrangements, which could increase our worldwide effective tax rate, harm our financial position and operating results, and have a negative effect on our cash flow.

For example, beginning in fiscal 2023, we were required to capitalize and amortize research and development expenses as required by the Tax Cuts and Jobs Act.

As a result of this change and our increased profitability, we have paid significantly more U.S.

cash taxes during fiscal 2024 and we expect our cash tax payments to increase in future periods.

Some tax authorities of jurisdictions other than the United States may seek to assert extraterritorial taxing rights on our transactions or operations.

It is possible that domestic or international tax authorities may subject us to tax examinations, or audits, and such tax authorities may disagree with certain positions we have taken, and any adverse outcome of such an examination, review or audit could result in additional tax liabilities and penalties and otherwise have a negative effect on our financial position, operating results, and cash flow.

Further, the determination of our worldwide provision for or benefit from income taxes and other tax liabilities requires significant judgment by management, and there are transactions where the ultimate tax determination is uncertain.

Further, the determination of our worldwide provision for income taxes and other tax liabilities requires significant judgment by management, and there are transactions where the ultimate tax determination is uncertain.

Although we believe that our estimates are reasonable, the ultimate tax outcome may differ from the amounts recorded on our consolidated financial statements and may materially affect our financial results in the period or periods for which such determination is made.

In addition, our future income tax obligations could be adversely affected by changes in, or interpretations of, tax laws, regulations, policies, or decisions in the United States or in the other jurisdictions in which we operate.

If our estimates or judgments relating to our critical accounting policies are based on assumptions that change or prove to be incorrect, our operating results could fall below our publicly announced guidance or the expectations of securities analysts and investors, resulting in a decline in the market price of our common stock.

In addition, our future income tax obligations and effective tax rates could be adversely affected by changes in, or interpretations of, tax laws, regulations, policies, or decisions in the United States or in the other jurisdictions in which we operate including as a result of the U.S.

federal tax legislation commonly referred to as the One Big Beautiful Bill Act, which was signed into law on July 4, 2025.

If our estimates or judgments, including those relating to our critical accounting policies, are based on assumptions that change or prove to be incorrect, our operating results differ from our publicly announced guidance or the expectations of securities analysts and investors, resulting in a decline in the market price of our common stock.

The preparation of consolidated financial statements in conformity with U.S.

2 unchanged sentences

We base our estimates on historical experience and on various other assumptions that we believe to be reasonable under the circumstances, the results of which form the basis for making judgments about the carrying amounts of assets, liabilities, equity, revenue, and expenses that are not readily apparent from other sources.

For more information, refer to the section entitled “Critical Accounting Estimates” in “Management’s Discussion and Analysis of Financial Condition and Results of Operations” in Part II, Item 7 of this Annual Report on Form 10-K.

For more information relating to critical accounting policies, refer to the section entitled “Critical Accounting Estimates” in “Management’s Discussion and Analysis of Financial Condition and Results of Operations” in Part II, Item 7 of this Annual Report on Form 10-K.

In general, if our estimates, judgments or assumptions relating to our critical accounting policies change or if actual circumstances differ from our estimates, judgments or assumptions, our operating results may be adversely affected and could fall below our publicly announced guidance or the expectations of securities analysts and investors, resulting in a decline in the market price of our common stock.

3 unchanged sentences

If, in the future, our chief executive officer, chief financial officer, or independent registered public accounting firm determines that our internal control over financial reporting is not effective as defined under Section 404, we could be subject to one or more investigations or enforcement actions by state or federal regulatory agencies, stockholder lawsuits, or other adverse actions requiring us to incur defense costs, pay fines, settlements, or judgments, causing investor perceptions to be adversely affected and potentially resulting in a decline in the market price of our stock.

Our reputation and/or business could be negatively impacted by ESG matters and/or our reporting of such matters.

There is an increasing focus from regulators, certain investors, and other stakeholders concerning ESG matters, both in the United States and internationally.

We communicate certain ESG-related initiatives, goals, and/or commitments regarding environmental matters, diversity, responsible sourcing and social investments, and other matters in our annual ESG Report, on our website, in our filings with the SEC, and elsewhere.

Our reputation and/or business could be negatively impacted by corporate responsibility matters and/or our reporting of such matters.

There is an increasing focus from regulators, certain investors, and other stakeholders concerning corporate responsibility matters, both in the United States and internationally.

We communicate certain corporate responsibility-related initiatives, goals, and/or commitments regarding sustainability matters, inclusion, responsible sourcing and social investments, and other matters in our annual Corporate Responsibility Report, on our website, in our filings with the SEC, and elsewhere.

These initiatives, goals, or commitments could be difficult to achieve and costly to implement.

We could fail to achieve, or be perceived to fail to achieve, our ESG-related initiatives, goals, or commitments.

We could fail to achieve, or be perceived to fail to achieve, our corporate responsibility-related initiatives, goals, or commitments.

In addition, we could be criticized for the timing, scope or nature of these initiatives, goals, or commitments, or for any revisions to them.

To the extent that our required and voluntary disclosures about ESG matters increase, we could be criticized for the accuracy, adequacy, or completeness of such disclosures.

Our actual or perceived failure to achieve our ESG-related initiatives, goals, or commitments could negatively impact our reputation, result in ESG-focused investors not purchasing and holding our stock, or otherwise materially harm our business.

In addition, we are or may become subject to various new and proposed climate-related and other sustainability-related laws and regulations, including, for example, the E.U.’s Corporate Sustainability Reporting Directive.

To the extent that our required and voluntary disclosures about corporate responsibility matters increase, we could be criticized for the accuracy, adequacy, or completeness of such disclosures.

Our actual or perceived failure to achieve our corporate responsibility-related initiatives, goals, or commitments could negatively impact our reputation, result in corporate responsibility-focused investors not purchasing and holding our stock, or otherwise materially harm our business.

In addition, we are or may become subject to various new and proposed sustainability-related laws and regulations, including, for example, the E.U.’s Corporate Sustainability Reporting Directive.

Additional regulation may require us to incur significant additional costs associated with increased compliance burdens, including the implementation of additional internal controls processes and procedures, and impose increased oversight obligations on our management and board of directors, as well as require us to retain third-party experts.

10 unchanged sentences

Enforcement actions, litigation, and sanctions could harm our business, operating results, and financial condition.

Risks Related to Our Notes and Common Stock

We may not have the ability to raise the funds necessary to settle conversions of our Notes, repurchase our Notes upon a fundamental change, or repay our Notes in cash at their maturity, and our future debt may contain limitations on our ability to pay cash upon conversion or repurchase of our Notes.

In June 2020, we issued our 0.375% Convertible Senior Notes due 2025 (the “2025 Notes”).

We will need to make cash payments (a) if holders of our 2025 Notes require us to repurchase all, or a portion of, their 2025 Notes upon the occurrence of a fundamental change (e.g., a change of control of Palo Alto Networks, Inc.) before the maturity date, (b) upon conversion of our 2025 Notes, or (c) to repay our 2025 Notes in cash at their maturity unless earlier converted or repurchased.

Effective August 1, 2024 through October 31, 2024, all of the 2025 Notes are convertible.

If all of the note holders decided to convert their 2025 Notes, we would be obligated to pay the $1.0 billion principal amount of the 2025 Notes in cash.

Under the terms of the 2025 Notes, we also have the option to settle the amount of our conversion obligation in excess of the aggregate principal amount of the 2025 Notes in cash or shares of our common stock.

If our cash provided by operating activities, together with our existing cash, cash equivalents, and investments, and existing sources of financing, are inadequate to satisfy these obligations, we will need to obtain third-party financing, which may not be available to us on commercially reasonable terms or at all, to meet these payment obligations.

In addition, our ability to repurchase or to pay cash upon conversion of our 2025 Notes may be limited by law, regulatory authority, or agreements governing our future indebtedness.

Our failure to repurchase our 2025 Notes at a time when the repurchase is required by the applicable indenture governing such 2025 Notes or to pay cash upon conversion of such 2025 Notes as required by the applicable indenture would constitute a default under the indenture.

A default under the applicable indenture or the fundamental change itself could also lead to a default under agreements governing our future indebtedness.

If the payment of the related indebtedness were to be accelerated after any applicable notice or grace periods, we may not have sufficient funds to repay the indebtedness and repurchase our 2025 Notes or to pay cash upon conversion of our 2025 Notes.

We may still incur substantially more debt or take other actions that would diminish our ability to make payments on our Notes when due.

We and our subsidiaries may incur substantial additional debt in the future, subject to the restrictions contained in our debt instruments, that could have the effect of diminishing our ability to make payments on our 2025 Notes when due.

Risks Related to Our Common Stock

The market price of our common stock historically has been volatile, and the value of an investment in our common stock could decline.

16 unchanged sentences

• sales or repurchases of large blocks of our common stock or substantial future sales by our directors, executive officers, employees, and significant stockholders;

• issuances or sales of shares of our common stock, including as part of a capital-raising transaction or as consideration in or in connection with acquisitions;

• issuances or sales of debt or securities convertible into or exchangeable for shares of our common stock, including in connection with acquisitions;

• departures of key personnel;

2 unchanged sentences

Securities litigation could result in substantial costs, divert our management’s attention and resources from our business, and have a material adverse effect on our business, operating results, and financial condition.

The convertible note hedge and warrant transactions may affect the value of our common stock.

The warrant transactions may affect the value of our common stock.

In June 2020, we issued our 0.375% Convertible Senior Notes due 2025 (the “2025 Notes”), which matured on June 1, 2025.

In connection with the sale of our 2025 Notes, we entered into convertible note hedge transactions (the “2025 Note Hedges”) with certain counterparties.

In connection with each such sale of the 2025 Notes, we also entered into warrant transactions with the counterparties pursuant to which we sold warrants (the “2025 Warrants”) for the purchase of our common stock.

The 2025 Note Hedges for our 2025 Notes are generally expected to reduce the potential dilution to our common stock upon any conversion of our 2025 Notes.

The 2025 Warrants could separately have a dilutive effect to the extent that the market price per share of our common stock exceeds the applicable strike price of the 2025 Warrants unless, subject to certain conditions, we elect to cash settle such 2025 Warrants.

The applicable counterparties or their respective affiliates may modify their hedge positions by entering into or unwinding various derivatives with respect to our common stock and/or purchasing or selling our common stock or other securities of ours in secondary market transactions prior to the maturity of the outstanding 2025 Notes (and are likely to do so during any applicable observation period related to a conversion of our 2025 Notes).

This activity could also cause or prevent an increase or a decrease in the market price of our common stock or our 2025 Notes, which could affect a note holder’s ability to convert its 2025 Notes and, to the extent the activity occurs during any observation period related to a conversion of our 2025 Notes, it could affect the amount and value of the consideration that the note holder will receive upon conversion of our 2025 Notes.

We do not make any representation or prediction as to the direction or magnitude of any potential effect that the transactions described above may have on the price of our 2025 Notes or our common stock.

In connection with the sale of the 2025 Notes and purchase of the 2025 Note Hedges, we also entered into warrant transactions with the counterparties pursuant to which we sold warrants (the “2025 Warrants”) for the purchase of our common stock.

The 2025 Warrants could have a dilutive effect to the extent that the market price per share of our common stock exceeds the applicable strike price of the 2025 Warrants unless, subject to certain conditions, we elect to cash settle such 2025 Warrants.

The applicable counterparties to the 2025 Warrants or their respective affiliates may modify their related hedge positions by entering into or unwinding various derivatives with respect to our common stock and/or purchasing or selling our common stock or other securities of ours in secondary market transactions prior to the expiration of the 2025 Warrants.

This activity could cause or prevent an increase or a decrease in the market price of our common stock.

We do not make any representation or prediction as to the direction or magnitude of any potential effect that the transactions described above may have on the price of our common stock.

In addition, we do not make any representation that the counterparties or their respective affiliates will engage in these transactions or that these transactions, once commenced, will not be discontinued without notice.

The issuance of additional stock in connection with financings, acquisitions, investments, our stock incentive plans, the conversion of our Notes or exercise of the related Warrants, or otherwise will dilute stock held by all other stockholders.

Our amended and restated certificate of incorporation authorizes us to issue up to 1.0 billion shares of common stock and up to 100.0 million shares of preferred stock with such rights and preferences as may be determined by our board of directors.

Subject to compliance with applicable rules and regulations, we may issue shares of common stock or securities convertible into shares of our common stock from time to time in connection with a financing, acquisition, investment, our stock incentive plans, the conversion of our 2025 Notes, the settlement of our 2025 Warrants, or otherwise.

Any such issuance could result in substantial dilution to our existing stockholders and cause the market price of our common stock to decline.

The issuance of additional stock in connection with financings, acquisitions, investments, our stock incentive plans, exercise of the 2025 Warrants, or otherwise will dilute stock held by all other stockholders.

Our restated certificate of incorporation authorizes us to issue up to 2.0 billion shares of common stock and up to 100.0 million shares of preferred stock with such rights and preferences as may be determined by our board of directors.

Subject to compliance with applicable rules and regulations, we may issue shares of common stock or securities convertible into or exchangeable for shares of our common stock from time to time in connection with a financing or other capital raising, acquisition, investment, our stock incentive plans, the settlement of our 2025 Warrants, or otherwise.

Any such issuance, including in connection with the proposed CyberArk acquisition, could result in substantial dilution to our existing stockholders and cause the market price of our common stock to decline.

We cannot guarantee that our share repurchase program will be fully consummated or that it will enhance shareholder value, and share repurchases could affect the price of our common stock.

As of July 31, 2024, we had $500.0 million available under our share repurchase program.

On August 15, 2024, our board of directors authorized a $500.0 million increase to our share repurchase program, bringing the total remaining authorization for future share repurchases to $1.0 billion.

The repurchase authorization will expire on December 31, 2025, and may be suspended or discontinued at any time without prior notice.

As of July 31, 2025, we had $1.0 billion available under our share repurchase program which will expire on December 31, 2025 and may be suspended or discontinued at any time without prior notice.

Although our board of directors has authorized a share repurchase program, we are not obligated to repurchase any specific dollar amount or to acquire any specific number of shares under the program.

5 unchanged sentences

As a result, stockholders may only receive a return on their investments in our common stock if the market price of our common stock increases.

Our charter documents and Delaware law, as well as certain provisions contained in the indentures governing our Notes, could discourage takeover attempts and lead to management entrenchment, which could also reduce the market price of our common stock.

Provisions in our amended and restated certificate of incorporation and amended and restated bylaws may have the effect of delaying or preventing a change in control of our company or changes in our management.

Our amended and restated certificate of incorporation and amended and restated bylaws include provisions that:

Our charter documents and Delaware law could discourage takeover attempts and lead to management entrenchment, which could also reduce the market price of our common stock.

Provisions in our restated certificate of incorporation and amended and restated bylaws may have the effect of delaying or preventing a change in control of our company or changes in our management.

Our amended and restated certificate of incorporation and amended and restated bylaws include provisions that, among other things:

• establish that our board of directors is divided into three classes, Class I, Class II, and Class III, with three-year staggered terms;

3 unchanged sentences

• specify that special meetings of our stockholders may be called only by the chairman of our board of directors, our president, our secretary, or a majority vote of our board of directors;

• require the affirmative vote of holders of at least 66 2/3% of the voting power of all of the then outstanding shares of the voting stock, voting together as a single class, to amend the provisions of our amended and restated certificate of incorporation relating to the issuance of preferred stock and management of our business or our amended and restated bylaws;

• require the affirmative vote of holders of at least 66 2/3% of the voting power of all of the then outstanding shares of the voting stock, voting together as a single class, to amend the provisions of our restated certificate of incorporation relating to the issuance of preferred stock and management of our business or our amended and restated bylaws;

• authorize our board of directors to amend our bylaws by majority vote;

3 unchanged sentences

These provisions may prohibit large stockholders, in particular those owning 15% or more of our outstanding voting stock, from merging or combining with us for a certain period of time.

Additionally, certain provisions contained in the indenture governing our 2025 Notes could make it more difficult or more expensive for a third party to acquire us.

The application of Section 203 or certain provisions contained in the indenture governing our 2025 Notes also could have the effect of delaying or preventing a change in control of us.

Any of these provisions could, under certain circumstances, depress the market price of our common stock.

13 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors