What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2025-11-20 compared with 2025-05-21 · 111 added, 78 removed, 564 unchanged (25% of the section changed)

20 unchanged sentences

• We face intense competition in our market and we may lack sufficient financial or other resources to maintain or improve our competitive position.

• We may acquire other businesses, which could subject us to adverse claims or liabilities, require significant management attention, disrupt our business, adversely affect our operating results, may not result in the expected benefits of such acquisitions, and may dilute stockholder value.

• We have and may in the future acquire other businesses (including CyberArk), which could subject us to adverse claims or liabilities, require significant management attention, disrupt our business, adversely affect our operating results, may not result in the expected benefits of such acquisitions, and may dilute stockholder value.

• We may not complete the acquisition of CyberArk within the timeframe we anticipate or at all, which could negatively impact our future business and financial results.

• As a result of the CyberArk acquisition, we anticipate that the scope and size of our business will substantially change and result in certain incremental risks, including increased competition.

• If we do not accurately predict, prepare for, and respond promptly to rapidly evolving technological and market developments and successfully manage product and subscription introductions and transitions to meet changing end-customer needs in the enterprise security industry, our competitive position and prospects will be harmed.

23 unchanged sentences

• Failure to comply with governmental laws and regulations could harm our business.

• We may not have the ability to raise the funds necessary to settle conversions of our Notes, repurchase our Notes upon a fundamental change, or repay our Notes in cash at their maturity, and our future debt may contain limitations on our ability to pay cash upon conversion or repurchase of our Notes.

• We may still incur substantially more debt or take other actions that would diminish our ability to make payments on our Notes when due.

• The market price of our common stock historically has been volatile, and the value of an investment in our common stock could decline.

• The convertible note hedge and warrant transactions may affect the value of our common stock.

• The warrant transactions may affect the value of our common stock.

Risks Related to Global Economic and Geopolitical Conditions

2 unchanged sentences

The instability in the global credit markets, inflation, changes in public policies such as domestic and international legislation or regulations, changes in enforcement and administration policies, taxes, any increases in interest rates, fluctuations in foreign currency exchange rates, or international trade agreements, international trade disputes, trade regulations, tariffs and changes in tariffs, geopolitical turmoil, and other disruptions to global and regional economies and markets continue to add uncertainty to global economic conditions.

Military actions or armed conflict, including the hostilities in Israel and the surrounding region, Russia’s invasion of Ukraine and any related political or economic responses and counter-responses, and uncertainty about, or changes in, government and trade relationships, policies, and treaties could also lead to worsening economic and market conditions and geopolitical environment.

Military actions or armed conflict, including the hostilities in Israel and the surrounding region, the Russia-Ukraine war and any related political or economic responses and counter-responses, and uncertainty about, or changes in, government and trade relationships, policies, and treaties could also lead to worsening economic and market conditions and geopolitical environment.

In response to Russia’s invasion of Ukraine, the United States, along with the European Union (the “E.U.”), has imposed restrictive sanctions on Russia, Russian entities, and Russian citizens (“Sanctions on Russia”).

6 unchanged sentences

As a result, our employee headcount has increased, and we expect it to continue to grow over the next year.

For example, from the end of fiscal 2024 to the end of the third quarter of fiscal 2025, our headcount increased from 15,289 to 15,866 employees.

For example, from the end of fiscal 2025 to the end of the first quarter of fiscal 2026, our headcount increased from 16,068 to 16,413 employees.

In addition, as we have grown, the number of end-customers has also increased, and we have managed more complex deployments of our products and subscriptions with larger end-customers.

7 unchanged sentences

Our revenue growth rate in recent periods may not be indicative of our future performance, and we may not be able to maintain profitability, which could cause our business, financial condition, and operating results to suffer.

We have experienced revenue growth rates of 14.5% and 18.2% for the nine months ended April 30, 2025 and 2024, respectively.

We have experienced revenue growth rates of 16% and 14% for the three months ended October 31, 2025 and 2024, respectively.

Our revenue for any quarterly or annual period should not be relied upon as an indication of our future revenue or revenue growth for any future period.

27 unchanged sentences

Sales to large enterprise end-customers, which is part of our growth strategy, involve risks that may not be present, or that are present to a lesser extent, with sales to smaller entities, such as (a) longer sales cycles and the associated risk that substantial time and resources may be spent on a potential end-customer that elects not to purchase our products, subscriptions, and support, and (b) increased purchasing power and leverage held by large end-customers in negotiating contractual arrangements.

Deployments for large enterprise end-customers are also more complex, require greater product functionality, scalability, and a broader range of services, and are more time-consuming.

Deployments for large enterprise end-customers are also more complex, require greater product functionality, scalability, and a broader range of services, and are more time-consuming and resource-consuming.

All of these factors add further risk to business conducted with these end-customers.

3 unchanged sentences

To do so, we must successfully convince prospective customers of the value of adopting our solutions.

We are engaging in costly marketing and sales efforts to accelerate platformization and attract new customers, which may fail or may not be as successful as intended or at all.

We are engaging in costly marketing and sales efforts to accelerate our strategies, including platformization, and attract new customers, which may fail or may not be as successful as intended or at all.

Additionally, prospective customers’ decisions to purchase our solutions depend on a variety of factors, many of which are out of our control.

5 unchanged sentences

We rely on revenue from subscription and support offerings, and because we recognize revenue from subscription and support over the term of the relevant service period, downturns or upturns in sales or renewals of these subscription and support offerings are not immediately reflected in full in our operating results.

Subscription and support revenue accounts for a significant portion of our revenue, comprising 81.6% of total revenue in the nine months ended April 30, 2025 and 80.8% of total revenue in the nine months ended April 30, 2024.

Subscription and support revenue accounts for a significant portion of our revenue, comprising 82.5% of total revenue in the three months ended October 31, 2025 and 83.5% of total revenue in the three months ended October 31, 2024.

Sales and renewals of subscription and support contracts may decline and fluctuate as a result of a number of factors, including end-customers’ level of satisfaction with our products and subscriptions, the frequency and severity of subscription outages, our product uptime or latency, the prices of our products and subscriptions, and reductions in our end-customers’ spending levels.

9 unchanged sentences

Substantially all of our revenue is generated by sales through our channel partners, including distributors and resellers.

For the nine months ended April 30, 2025, three distributors individually represented 10% or more of our total revenue and in the aggregate represented 44.7% of our total revenue.

As of April 30, 2025, two distributors individually represented 10% or more of our gross accounts receivable and in the aggregate represented 33.5% of our gross accounts receivable.

For the three months ended October 31, 2025, three distributors individually represented 10% or more of our total revenue and in the aggregate represented 42% of our total revenue.

As of October 31, 2025, three distributors individually represented 10% or more of our gross accounts receivable and in the aggregate represented 45% of our gross accounts receivable.

We provide our channel partners with specific training and programs to assist them in selling our products, including subscriptions and support offerings, but there can be no assurance that these steps will be utilized or effective.

24 unchanged sentences

If our products and subscriptions are late in achieving or fail to achieve compliance with these certifications and standards or technical requirements, or our competitors achieve compliance with these certifications and standards or technical requirements, we may be disqualified from selling our products, subscriptions, and support offerings to such governmental entity, or be at a competitive disadvantage, which would harm our business, operating results, and financial condition.

Government demand and payment for our products, subscriptions, and support offerings may be impacted by government shutdowns, changes in governmental administrations, public sector budgetary cycles, fiscal policies, contracting policies or requirements, funding authorizations, and efforts by the federal government to evaluate and reduce overall government spending and analyze and enhance its operational efficiency, with funding reductions or delays adversely affecting public sector demand for our products, subscriptions, and support offerings.

Government entity demand and payment for our products, subscriptions, and support offerings may be impacted by government shutdowns, changes in governmental administrations, public sector budgetary cycles, fiscal policies, contracting policies or requirements, funding authorizations, and efforts by a government to evaluate and reduce overall government spending and analyze and enhance its operational efficiency, with funding reductions or delays adversely affecting public sector demand for our products, subscriptions, and support offerings.

Government entities may have statutory, contractual, or other legal rights to terminate contracts with our distributors and resellers for convenience or due to a default, and any such termination may adversely impact our future operating results.

1 unchanged sentence

Additionally, the U.S.

government may require certain of the products that it purchases to be manufactured in the United States and other relatively high-cost manufacturing locations, and we may not manufacture all products in locations that meet such requirements, affecting our ability to sell these products, subscriptions, and support offerings to the U.S.

government may require certain of the products that it purchases to be manufactured in the United States or other relatively high-cost manufacturing locations, and we may not manufacture all products in locations that meet such requirements, affecting our ability to sell these products, subscriptions, and support offerings to the U.S.

We face intense competition in our market and we may lack sufficient financial or other resources to maintain or improve our competitive position.

5 unchanged sentences

• public cloud vendors and startups that offer solutions for cloud security (private, public, and hybrid cloud).

Many of our competitors have greater financial, technical, marketing, sales, and other resources, greater name recognition, longer operating histories, and a larger base of customers than we do.

Some of our competitors have or may attain greater financial, technical, marketing, sales, and other resources, greater name recognition, longer operating histories, and a larger base of customers than we do.

They may be able to devote greater resources to the promotion and sale of products and services than we can, and they may offer lower pricing than we do.

Further, they may have greater resources for research and development of new technologies, the provision of customer support, and the pursuit of acquisitions.

Further, they may have greater resources for research and development of new technologies, the provision of customer support, and the pursuit of acquisitions or other strategic investments.

They may also have larger and more mature intellectual property portfolios, and broader and more diverse product and service offerings, which allow them to leverage their relationships based on other products or incorporate functionality into existing products to gain business in a manner that discourages users from purchasing our products and subscriptions, including incorporating cybersecurity features into their existing products or services and product bundling, selling at zero or negative margins, and offering concessions or a closed technology offering.

6 unchanged sentences

Due to budget constraints or economic downturns, organizations may add solutions to their existing network security infrastructure rather than replacing it with our products and subscriptions.

Conditions in our market could change rapidly and significantly as a result of technological advancements, partnering or acquisitions by our competitors, or continuing market consolidation.

Conditions in our market could change rapidly and significantly as a result of technological advancements, partnering, acquisitions or strategic investments by our competitors, or continuing market consolidation.

Our competitors and potential competitors may be able to develop new or disruptive technologies, products, or services, and leverage new business models that are equal or superior to ours, achieve greater market acceptance of their products and services, disrupt our markets, and increase sales by utilizing different distribution channels than we do.

2 unchanged sentences

Some of our competitors have made or could make acquisitions of businesses that may allow them to offer more directly competitive and comprehensive solutions than they had previously offered and adapt more quickly to new technologies and end-customer needs.

Our current and potential competitors may also establish cooperative relationships among themselves or with third parties that may further enhance their resources.

Our current and potential competitors may also establish cooperative relationships among themselves or with third parties that may further enhance their resources or product or service offerings.

These competitive pressures in our market or our failure to compete effectively may result in price reductions, fewer orders, reduced revenue and gross margins, and loss of market share.

If we are unable to compete successfully, or if competing successfully requires us to take aggressive pricing or other actions, our business, financial condition, and results of operations would be adversely affected.

We may acquire other businesses, which could subject us to adverse claims or liabilities, require significant management attention, disrupt our business, adversely affect our operating results, may not result in the expected benefits of such acquisitions, and may dilute stockholder value.

We have and may in the future acquire other businesses (including CyberArk), which could subject us to adverse claims or liabilities, require significant management attention, disrupt our business, adversely affect our operating results, may not result in the expected benefits of such acquisitions, and may dilute stockholder value.

As part of our business strategy, we acquire and make investments in complementary companies, products, or technologies.

We continue to evaluate such opportunities and expect to continue to make such acquisitions and investments in the future, such as our pending acquisition of CyberArk Software Ltd.

(“CyberArk”).

The identification of suitable acquisition candidates is difficult, and we may not be able to complete such acquisitions on favorable terms, if at all.

3 unchanged sentences

Additionally, we may be subject to litigation or other claims in connection with the acquired company, product, or technology, including claims from terminated employees, customers, former stockholders, or other third parties, which may differ from or be more significant than the risks our business faces.

If we are unsuccessful at integrating past or future acquisitions in a timely manner, or the technologies, products, or operations associated with such acquisitions, into our company, our revenue and operating results could be adversely affected.

If we are unsuccessful at integrating past or future acquisitions, including the pending acquisition of CyberArk, in a timely manner, or the technologies, products, or operations associated with such acquisitions, into our company, our revenue and operating results could be adversely affected.

Any integration process may require significant time and resources, which may disrupt our ongoing business and divert management’s attention, and we may not be able to manage the integration process successfully or in a timely manner.

We may have difficulty retaining key personnel or customers of the acquired business.

We may not successfully evaluate or utilize the acquired technology, products, or personnel, realize anticipated synergies from the acquisition, or accurately forecast the financial impact of an acquisition transaction and integration of such acquisition, including accounting charges and any potential impairment of goodwill and intangible assets recognized in connection with such acquisitions.

We may record liability for contingent consideration obligations from acquisitions that are to be settled in cash, the fair value of which is assessed on a quarterly basis.

We may not successfully evaluate or utilize any acquired technology, products, or personnel, realize anticipated synergies from an acquisition, or accurately forecast the financial impact of an acquisition transaction and integration of such acquisition, including accounting charges and any potential impairment of goodwill and intangible assets recognized in connection with such acquisitions.

In particular, we believe that there are significant benefits and synergies that may be realized from our proposed acquisition of CyberArk, including through leveraging our and CyberArk’s products, scale, and combined enterprise customer bases.

However, the efforts to realize the anticipated benefits and synergies will be a complex process and may disrupt both our and CyberArk’s existing operations if not implemented in a timely and efficient manner.

The full benefits of the proposed acquisition of CyberArk, including the anticipated sales or growth opportunities, may not be realized as expected or may not be achieved within the anticipated time frame, or at all.

We have recorded, and may in the future record, liability for contingent consideration obligations from acquisitions that are to be settled in cash, the fair value of which is assessed on a quarterly basis.

If changes are made in our assumptions used to determine the liability’s fair value or our assumptions are incorrect, adjustments could be made that may have a material impact, favorable or unfavorable, on our operating results.

We may also be required to make cash payments of contingent consideration in excess of its initial fair value, or in excess of our expectations for a particular period, which could adversely impact cash flows.

We may have to pay cash, incur debt, or issue equity or equity-linked securities to pay for any future acquisitions, each of which could adversely affect our financial condition or the market price of our common stock.

Furthermore, the sale of equity or issuance of equity-linked debt to finance any future acquisitions could result in dilution to our stockholders.

We may have to pay cash, incur debt, or issue equity or equity-linked securities to pay for any future acquisitions, including the pending acquisition of CyberArk, each of which could adversely affect our financial condition or the market price of our common stock, and result in dilution to our stockholders.

Furthermore, the sale or issuance of equity or equity-linked debt to finance any future acquisitions could result in dilution to our stockholders.

In addition, any acquisitions may be viewed negatively by our customers, financial markets, or investors and may not ultimately strengthen our competitive position or achieve our goals and business strategy.

The occurrence of any of these risks could harm our business, operating results, and financial condition.

We may not complete the acquisition of CyberArk within the timeframe we anticipate or at all, which could negatively impact our future business and financial results.

The completion of the acquisition of CyberArk is subject to a number of conditions, including, among others:

• the effectiveness of a registration statement on Form S-4 to be filed by us registering the shares of our common stock to be issued to CyberArk shareholders as consideration in the acquisition and the absence of any stop order or proceedings seeking a stop order;

• the approval for listing on Nasdaq of our shares of common stock to be issued in connection with the proposed acquisition;

• the making, approval, expiration, termination or receipt of, as applicable, all applicable filings, registrations, waiting periods (or extensions of waiting periods) and approvals under specified antitrust and foreign investment laws;

• the absence of governmental restraints or prohibitions preventing the consummation of the proposed acquisition.

No assurance can be given that the required governmental and regulatory consents and approvals will be obtained or that any of the required conditions to closing will be satisfied in a timely manner or at all.

As a result, although it is currently anticipated that we will complete the acquisition of CyberArk during the third quarter of our fiscal 2026, the possible timing and likelihood of completion are uncertain.

There can be no assurance that the acquisition of CyberArk will be completed in the anticipated timeframe or at all.

Any delay in completing the proposed acquisition could cause the combined company not to realize, or to be delayed in realizing, some or all of the benefits and synergies that we anticipate to achieve if the proposed acquisition were to be successfully completed within its expected time frame.

In addition, the relevant governmental authorities from which approvals under specified antitrust and foreign investment laws must be obtained may impose or seek to impose conditions on the completion of the acquisition or require changes to the terms of the proposed acquisition or agreements to be entered into in connection with the CyberArk acquisition.

Such conditions or changes and the process of obtaining these approvals, could have the effect of delaying or impeding completion of the CyberArk acquisition or imposing additional costs or limitations on us following the acquisition, which may have an adverse effect on our business, results of operations, and financial condition.

The failure or inability to satisfy all of the required conditions could delay the completion of the acquisition for a significant period of time or prevent it from occurring at all.

In addition, under limited circumstances, we or CyberArk may elect to terminate the definitive agreement or we and CyberArk may mutually decide to terminate the definitive agreement.

A termination of the definitive agreement could materially and adversely affect our business, results of operations and reputation.

If the acquisition of CyberArk is delayed or not completed, we could be subject to a number of risks that may adversely affect our business, operating results and financial condition, including, among other things:

• we may experience negative reactions from the financial markets, including negative impacts on the market price of our common stock;

• we could incur significant acquisition costs that we would be unable to recoup;

• under specified circumstances in connection with the termination of the definitive agreement, we would be required to pay CyberArk a termination fee of $1.0 billion;

• negative perception from industry contacts, business partners, and other third parties, which could impact our operations or our ability to compete for new business or obtain renewals in the marketplace more broadly;

• reputational harm, negative publicity, negative reactions from employees, and other negative impacts resulting from delay or failure to complete the acquisition of CyberArk.

As a result of the CyberArk acquisition, we anticipate that the scope and size of our business will substantially change and result in certain incremental risks, including increased competition.

We believe that the CyberArk acquisition will expand the scope and size of our business by adding substantial assets and operations to our existing business.

The anticipated future growth of our business may impose significant added responsibilities on our senior management, and our senior management’s attention may be diverted from the management of our business and its day-to-day operations to the completion and integration of the CyberArk acquisition.

The CyberArk acquisition could also create uncertainty for our and CyberArk’s employees, partners, and customers, particularly during the anticipated post-acquisition integration process, and result in disruption to existing business relationships and the development of new business relationships.

Following completion of the proposed acquisition of CyberArk, our success, including with respect to realizing the anticipated benefits and synergies from the proposed acquisition, will depend, in part, on our ability to manage our expansion, which poses numerous risks and uncertainties, including the need to integrate the operations and business of CyberArk into our existing business in a timely and efficient manner, to combine systems and management controls and to integrate relationships with industry contacts and business partners.

In addition, we will be required to devote significant attention and resources prior to closing to prepare for the post-closing integration and operation of the combined company, and we will be required post-closing to devote significant attention and resources to successfully align our and CyberArk’s business practices and operations.

This process may disrupt our business and, if ineffective, would limit the anticipated benefits and synergies of the acquisition.

In addition, we expect that the completion of the CyberArk acquisition will result in increased competition, including, as a result of our entry into a new product category.

CyberArk faces intense competition in the information security and identity security industry in which it operates, characterized by constant innovation, evolving customer requirements, and rapid adoption of different technologies and services.

These added competitive pressures could result in decreased sales, price reductions, increased operating costs, and lower revenues, margins and net income for the combined company.

These impacts could also result in a delay in realizing, or our failure to realize, expected synergies or cost savings from the CyberArk acquisition.

The occurrence of any of these risks could harm our business, operating results, and financial condition.

If we do not accurately predict, prepare for, and respond promptly to rapidly evolving technological and market developments and successfully manage product and subscription introductions and transitions to meet changing end-customer needs in the enterprise security industry, our competitive position and prospects will be harmed.

25 unchanged sentences

Such investments ultimately may not be commercially viable or may not result in an adequate return of capital and we may incur unanticipated liabilities.

These efforts could subject us to regulatory risk, legal liability, including under new proposed legislation regulating AI in jurisdictions such as the E.U.

and regulations being considered in other jurisdictions, or brand or reputational harm.

These efforts could subject us to regulatory risk, legal liability, including under legislation regulating AI in jurisdictions such as the E.U.

and laws and regulations being considered in other jurisdictions, or brand or reputational harm.

The rapid evolution of AI, including potential government regulation of AI, requires us to invest significant resources to develop, test, and maintain AI in our products and services in a manner that meets evolving requirements and expectations.

5 unchanged sentences

A network or data security incident may allow unauthorized access to our network or data, harm our reputation, create additional liability, and adversely impact our financial results.

Increasingly, companies are subject to a wide variety of attacks on their networks on an ongoing basis.

Increasingly, companies are subject to a wide variety of attacks on an ongoing basis.

In addition to traditional computer “hackers,” malicious code (such as viruses and worms), phishing attempts, employee theft or misuse, and denial of service attacks, sophisticated nation-state and nation-state supported actors engage in intrusions and attacks (including advanced persistent threat intrusions and supply chain attacks), and add to the risks to our internal networks, cloud-deployed enterprise and customer-facing environments and the information they store and process.

4 unchanged sentences

Furthermore, as a well-known provider of security solutions, we may be a more attractive target for such attacks.

The conflict in Ukraine and associated activities in Ukraine and Russia may increase the risk of cyberattacks on various types of infrastructure and operations, and the United States government has warned companies to be prepared for a significant increase in Russian cyberattacks in response to the Sanctions on Russia.

The Russia-Ukraine war and associated activities in Ukraine and Russia may increase the risk of cyberattacks on various types of infrastructure and operations, and the United States government has warned companies to be prepared for additional Russian cyberattacks in response to the Sanctions on Russia.

A security breach or incident, or an attack against our service availability suffered by us, or our third-party service providers, could impact our networks or networks secured by our products and subscriptions, creating system disruptions or slowdowns and exploiting security vulnerabilities of our products.

In addition, the information stored or otherwise processed on our networks, or those of our third-party service providers, could be accessed, publicly disclosed, altered, lost, stolen, rendered unavailable, or otherwise used or processed without authorization, which could subject us to liability and cause us financial harm.

In addition, the information stored or otherwise processed on our networks, or those of our third-party service providers, has previously been, and could in the future be, accessed, publicly disclosed, altered, lost, stolen, rendered unavailable, or otherwise used or processed without authorization, which could subject us to liability and cause us financial harm.

Any actual or perceived breach of security in our systems or networks, or any other actual or perceived data security incident we or our third-party service providers suffer, could result in significant damage to our reputation, negative publicity, loss of channel partners, end-customers, and sales, loss of competitive advantages over our competitors, increased costs to remedy any problems and otherwise respond to any incident, regulatory investigations and enforcement actions, demands, costly litigation, and other liability.

5 unchanged sentences

Additionally, defects or vulnerabilities may cause our products or subscriptions to become partially or fully unavailable temporarily or permanently, to be vulnerable to security attacks, cause them to fail to help secure networks, or interrupt end-customers’ networking traffic, or the availability of other information technology infrastructure or systems.

For example, in April 2024, we became aware of a command injection vulnerability in the GlobalProtect feature of certain versions of our PAN-OS software.

For example, in November 2024, we became aware of an authentication bypass vulnerability through the management web interface of certain versions of our PAN-OS software.

To remediate the matter, we published a security advisory to advise customers, provided software updates for affected PAN-OS versions, and engaged in customer outreach, support and remediation efforts for potentially impacted customers.

Because the techniques used by computer hackers to access or sabotage networks change frequently and generally are not recognized until launched against a target, we may be unable to anticipate these techniques and provide a solution in time to protect our end-customers’ networks.

In addition, due to the Russian invasion of Ukraine, there could be a significant increase in Russian cyberattacks against our customers, resulting in an increased risk of a security breach of our end-customers’ systems.

In addition, due to the Russia-Ukraine war, there could be a significant increase in Russian cyberattacks against our customers, resulting in an increased risk of a security breach of our end-customers’ systems.

Furthermore, defects or errors in products or software, or migrations or updates to those products or software, could result in a failure to effectively update end-customers’ hardware and cloud-based products or otherwise cause problems in our customers’ hardware, networks or information technology infrastructure or systems.

34 unchanged sentences

For example, on January 31, 2024, in the Centripetal Networks, Inc.

lawsuit against us, a jury returned a verdict of non-willful infringement, and, after post-trial motions, a judgment was issued in the lawsuit on October 3, 2024 assessing a lump sum damages amount of $113.6 million, which is currently on appeal.

Additional examples of patent infringement cases have been disclosed in Note 10.

73 unchanged sentences

Our manufacturing partners procure components and build our hardware products based on our forecasts, and we generally do not hold inventory for a prolonged period of time.

These forecasts are based on estimates of future demand for our products, which are in turn based on historical trends and analyses from our sales and product management organizations, adjusted for overall market conditions.

These forecasts are based on historical trends and analysis, adjusted for overall market conditions.

In order to reduce manufacturing lead times and plan for adequate component supply, from time to time we may issue forecasts for components and products that are non-cancelable and non-returnable.

21 unchanged sentences

For example, we are substantially dependent on the continued service of our engineering personnel because of the complexity of our offerings.

Competition for highly skilled personnel, particularly in engineering, including in the areas of AI and machine learning, is often intense, especially in the San Francisco Bay Area, where we have a substantial presence and need for such personnel.

Competition for highly skilled personnel, particularly in engineering, including in the areas of AI and machine learning, is intense, especially in the San Francisco Bay Area, where we have a substantial presence and need for such personnel.

In addition, the industry in which we operate generally experiences high employee attrition.

12 unchanged sentences

Additionally, our international sales and operations are subject to a number of risks, including the following:

• political, economic, and social uncertainty around the world, health risks such as epidemics and pandemics like COVID-19, macroeconomic challenges, terrorist activities, Russia’s invasion of Ukraine, tensions between China and Taiwan, the hostilities in Israel and the surrounding region, and continued hostilities in the Middle East;

• political, economic, and social uncertainty around the world, health risks such as epidemics and pandemics, macroeconomic challenges, terrorist activities, the Russia-Ukraine war, tensions between China and Taiwan, the hostilities in Israel and the surrounding region, and continued hostilities in the Middle East;

• unexpected changes in, or the application of, foreign and domestic laws and regulations (including intellectual property rights protections), regulatory practices or enforcement policies, trade restrictions, international trade agreements, and foreign legal requirements, including those applicable to the importation, certification, and localization of our products, tariffs, and tax laws and treaties, including regulatory and trade policy changes adopted by the current administration, such as the Sanctions on Russia, or foreign countries in response to regulatory changes adopted by the current administration;

15 unchanged sentences

We have entered into forward contracts in an effort to reduce our foreign currency exchange exposure related to our foreign currency denominated revenue and operating expenditures.

As of April 30, 2025, the total notional amount of our outstanding foreign currency forward contracts was $1.7 billion.

As of October 31, 2025, the total notional amount of our outstanding foreign currency forward contracts was $1.3 billion.

For more information on our hedging transactions, refer to Note 6.

2 unchanged sentences

We face risks associated with having operations and employees located in Israel.

We have business operations in Israel and intend to continue growing our presence in Israel.

We have business operations in Israel and intend to continue growing our presence in Israel, including in connection with our proposed acquisition of CyberArk.

Our operations in Israel could be disrupted by political instability, civil unrest, terrorist attacks, acts of violence, acts of war, or other military actions, including the hostilities in Israel and the surrounding region.

3 unchanged sentences

In addition, many of our employees in Israel are obligated to perform annual reserve duty in the Israeli military and are subject to being called for active duty under emergency circumstances, which has occurred as a result of hostilities in Israel and the surrounding region.

We cannot predict the full impact of these conditions on us in the future, particularly if emergency circumstances or an escalation in the political situation occurs.

We cannot predict the full impact of these conditions on us in the future, particularly if emergency circumstances or an escalation in the political situation or hostilities occurs.

If many of our employees in Israel are called for active duty for a significant period of time, our operations and our business could be disrupted and may not be able to function at full capacity.

30 unchanged sentences

General Data Protection Regulation (“U.K.

GDPR,” and collectively the “GDPR”), each of which impose stringent data protection requirements, provide for costly penalties for noncompliance (up to the greater of (a) €20 million under the E.U.

GDPR,” and collectively the “GDPR”), each of which imposes stringent data protection requirements, provides for costly penalties for noncompliance (up to the greater of (a) €20 million under the E.U.

GDPR or £17.5 million under the U.K.

GDPR,” and (b) 4% of annual worldwide turnover), and confer the right upon data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies, and obtain compensation for damages resulting from violations.

GDPR, and (b) 4% of annual worldwide turnover), and confers the right upon data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies, and obtain compensation for damages resulting from violations.

The GDPR imposes restrictions, among other things, on the transfer of personal data outside of the European Economic Area (“EEA”) (or, in the case of the U.K.

10 unchanged sentences

However, the DPF may be subject to legal challenges, which could invalidate its use, disrupt our ability to rely on such data transfer mechanisms, and otherwise cause the legal requirements for such data transfers to be uncertain.

Among other effects, we may experience additional costs associated with increased compliance burdens, reduced demand for our offerings from current or prospective customers in the EEA, Switzerland, and the U.K.

(collectively, “Europe”) to use our products, on account of the risks identified in the Schrems II decision, and we may find it necessary or desirable to make further changes to our processing of personal data of European residents.

The regulatory environment applicable to the handling of European residents’ personal data, and our actions taken in response, may cause us to assume additional liabilities or incur additional costs.

In addition, the U.K.

government enacted the U.K.

Data (Use and Access) Act 2025 on June 19, 2025, which includes changes to the U.K.’s data protection regime that cause it to deviate from the GDPR.

This creates new compliance challenges and uncertainty, including with respect to the European Commission’s adequacy determination for the U.K.’s data protection regime.

Among other effects of these developments, we may experience additional costs associated with increased compliance burdens, reduced demand for our offerings from current or prospective customers in the EEA, Switzerland, and the U.K.

(collectively, “Europe”) to use our products, on account of the risks identified in the Schrems II decision or other developments relating to cross-border data transfers, and we may find it necessary or desirable to make further changes to our processing of personal data of European residents.

The regulatory environment applicable to the handling of European residents’ personal data and cross-border data transfers, and our actions taken in response, may cause us to assume additional liabilities or incur additional costs.

Moreover, much like with Schrems II, we anticipate future legal challenges to the approved data transfer mechanisms between Europe and the United States, including a challenge to the E.U.-U.S.

4 unchanged sentences

Moreover, other U.S.

states have enacted privacy laws that are potentially relevant to us.

states have enacted laws relating to privacy and security that are potentially relevant to us.

These include laws enacted in at least 20 U.S.

states, with additional state legislatures expected to consider comprehensive privacy legislation in the coming months and throughout calendar year 2025.

Increasingly stringent federal or state privacy legislation may require us to modify our data practices and policies, incur substantial compliance costs and expenses, and add further complexity to our compliance efforts that could adversely affect our business or increase our potential liability if we fail to comply.

states, a portion of which are expected to come into effect over the course of our fiscal 2026.

Department of Justice also has issued rules regarding access to, or transfer of, certain bulk sensitive personal data by countries of concern.

Increasingly complex federal or state laws and regulations relating to privacy and security, and interpretations and enforcement of existing laws and regulations relating to these matters, may require us to modify our data practices and policies, incur substantial compliance costs and expenses, and add further complexity to our compliance efforts that could adversely affect our business or increase our potential liability if we fail to comply or are alleged to have done so.

We may also from time to time be subject to obligations relating to personal data by contract, or face assertions that we are subject to self-regulatory obligations or industry standards.

15 unchanged sentences

It is possible that domestic or international tax authorities may subject us to tax examinations, or audits, and such tax authorities may disagree with certain positions we have taken, and any adverse outcome of such an examination, review or audit could result in additional tax liabilities and penalties and otherwise have a negative effect on our financial position, operating results, and cash flow.

Further, the determination of our worldwide provision for or benefit from income taxes and other tax liabilities requires significant judgment by management, and there are transactions where the ultimate tax determination is uncertain.

Further, the determination of our worldwide provision for income taxes and other tax liabilities requires significant judgment by management, and there are transactions where the ultimate tax determination is uncertain.

Although we believe that our estimates are reasonable, the ultimate tax outcome may differ from the amounts recorded on our consolidated financial statements and may materially affect our financial results in the period or periods for which such determination is made.

In addition, our future income tax obligations could be adversely affected by changes in, or interpretations of, tax laws, regulations, policies, or decisions in the United States or in the other jurisdictions in which we operate.

In addition, our future income tax obligations and effective tax rates could be adversely affected by changes in, or interpretations of, tax laws, regulations, policies, or decisions in the United States or in the other jurisdictions in which we operate including as a result of the U.S.

federal tax legislation commonly referred to as the One Big Beautiful Bill Act, which was signed into law on July 4, 2025.

If our estimates or judgments, including those relating to our critical accounting policies, are based on assumptions that change or prove to be incorrect, our operating results differ from our publicly announced guidance or the expectations of securities analysts and investors, resulting in a decline in the market price of our common stock.

3 unchanged sentences

For more information relating to critical accounting policies, refer to the section entitled “Critical Accounting Estimates” in “Management’s Discussion and Analysis of Financial Condition and Results of Operations” in Part I, Item 2 of this Quarterly Report on Form 10-Q.

In general, if our estimates, judgments or assumptions relating to our accounting policies change or if actual circumstances differ from our estimates, judgments or assumptions, our operating results may be adversely affected and could fall below our publicly announced guidance or the expectations of securities analysts and investors, resulting in a decline in the market price of our common stock.

In general, if our estimates, judgments or assumptions relating to our critical accounting policies change or if actual circumstances differ from our estimates, judgments or assumptions, our operating results may be adversely affected and could fall below our publicly announced guidance or the expectations of securities analysts and investors, resulting in a decline in the market price of our common stock.

We are obligated to maintain proper and effective internal control over financial reporting.

23 unchanged sentences

Enforcement actions, litigation, and sanctions could harm our business, operating results, and financial condition.

Risks Related to Our Notes and Common Stock

We may not have the ability to raise the funds necessary to settle conversions of our Notes, repurchase our Notes upon a fundamental change, or repay our Notes in cash at their maturity, and our future debt may contain limitations on our ability to pay cash upon conversion or repurchase of our Notes.

In June 2020, we issued our 0.375% Convertible Senior Notes due 2025 (the “2025 Notes”).

We will need to make cash payments (a) if holders of our 2025 Notes require us to repurchase all, or a portion of, their 2025 Notes upon the occurrence of a fundamental change (e.g., a change of control of Palo Alto Networks, Inc.) before the maturity date, (b) upon conversion of our 2025 Notes, or (c) to repay our 2025 Notes in cash at their maturity unless earlier converted or repurchased.

All of the outstanding 2025 Notes will mature on June 1, 2025 and, at that time, we will become obligated to pay the remaining principal amount of the 2025 Notes of $383.3 million in cash, and deliver shares of our common stock for the amount of our conversion obligation in excess of the aggregate principal amount of the 2025 Notes being converted.

If our cash provided by operating activities, together with our existing cash, cash equivalents, and investments, and existing sources of financing, are inadequate to satisfy these obligations, we will need to obtain third-party financing, which may not be available to us on commercially reasonable terms or at all, to meet these payment obligations.

In addition, our ability to repurchase or to pay cash upon conversion of our 2025 Notes may be limited by law, regulatory authority, or agreements governing our future indebtedness.

Our failure to repurchase our 2025 Notes at a time when the repurchase is required by the applicable indenture governing such 2025 Notes or to pay cash upon conversion of such 2025 Notes as required by the applicable indenture would constitute a default under the indenture.

A default under the applicable indenture or the fundamental change itself could also lead to a default under agreements governing our future indebtedness.

If the payment of the related indebtedness were to be accelerated after any applicable notice or grace periods, we may not have sufficient funds to repay the indebtedness and repurchase our 2025 Notes or to pay cash upon conversion of our 2025 Notes.

We may still incur substantially more debt or take other actions that would diminish our ability to make payments on our Notes when due.

We and our subsidiaries may incur substantial additional debt in the future, subject to the restrictions contained in our debt instruments, that could have the effect of diminishing our ability to make payments on our 2025 Notes when due.

Risks Related to Our Common Stock

The market price of our common stock historically has been volatile, and the value of an investment in our common stock could decline.

16 unchanged sentences

• sales or repurchases of large blocks of our common stock or substantial future sales by our directors, executive officers, employees, and significant stockholders;

• issuances or sales of shares of our common stock, including as part of a capital-raising transaction or as consideration in or in connection with acquisitions;

• issuances or sales of debt or securities convertible into or exchangeable for shares of our common stock, including in connection with acquisitions;

• departures of key personnel;

2 unchanged sentences

Securities litigation could result in substantial costs, divert our management’s attention and resources from our business, and have a material adverse effect on our business, operating results, and financial condition.

The convertible note hedge and warrant transactions may affect the value of our common stock.

The warrant transactions may affect the value of our common stock.

In June 2020, we issued our 0.375% Convertible Senior Notes due 2025 (the “2025 Notes”), which matured on June 1, 2025.

In connection with the sale of our 2025 Notes, we entered into convertible note hedge transactions (the “2025 Note Hedges”) with certain counterparties.

In connection with each such sale of the 2025 Notes, we also entered into warrant transactions with the counterparties pursuant to which we sold warrants (the “2025 Warrants”) for the purchase of our common stock.

The 2025 Note Hedges for our 2025 Notes are generally expected to reduce the potential dilution to our common stock upon any conversion of our 2025 Notes.

The 2025 Warrants could separately have a dilutive effect to the extent that the market price per share of our common stock exceeds the applicable strike price of the 2025 Warrants unless, subject to certain conditions, we elect to cash settle such 2025 Warrants.

The applicable counterparties or their respective affiliates may modify their hedge positions by entering into or unwinding various derivatives with respect to our common stock and/or purchasing or selling our common stock or other securities of ours in secondary market transactions prior to the maturity of the outstanding 2025 Notes (and are likely to do so during any applicable observation period related to a conversion of our 2025 Notes).

This activity could also cause or prevent an increase or a decrease in the market price of our common stock or our 2025 Notes, which could affect a note holder’s ability to convert its 2025 Notes and, to the extent the activity occurs during any observation period related to a conversion of our 2025 Notes, it could affect the amount and value of the consideration that the note holder will receive upon conversion of our 2025 Notes.

We do not make any representation or prediction as to the direction or magnitude of any potential effect that the transactions described above may have on the price of our 2025 Notes or our common stock.

In connection with the sale of the 2025 Notes and purchase of the 2025 Note Hedges, we also entered into warrant transactions with the counterparties pursuant to which we sold warrants (the “2025 Warrants”) for the purchase of our common stock.

The 2025 Warrants could have a dilutive effect to the extent that the market price per share of our common stock exceeds the applicable strike price of the 2025 Warrants unless, subject to certain conditions, we elect to cash settle such 2025 Warrants.

The applicable counterparties to the 2025 Warrants or their respective affiliates may modify their related hedge positions by entering into or unwinding various derivatives with respect to our common stock and/or purchasing or selling our common stock or other securities of ours in secondary market transactions prior to the expiration of the 2025 Warrants.

This activity could cause or prevent an increase or a decrease in the market price of our common stock.

We do not make any representation or prediction as to the direction or magnitude of any potential effect that the transactions described above may have on the price of our common stock.

In addition, we do not make any representation that the counterparties or their respective affiliates will engage in these transactions or that these transactions, once commenced, will not be discontinued without notice.

The issuance of additional stock in connection with financings, acquisitions, investments, our stock incentive plans, the conversion of our Notes or exercise of the related Warrants, or otherwise will dilute stock held by all other stockholders.

The issuance of additional stock in connection with financings, acquisitions, investments, our stock incentive plans, exercise of the 2025 Warrants, or otherwise will dilute stock held by all other stockholders.

Our restated certificate of incorporation authorizes us to issue up to 2.0 billion shares of common stock and up to 100 million shares of preferred stock with such rights and preferences as may be determined by our board of directors.

Subject to compliance with applicable rules and regulations, we may issue shares of common stock or securities convertible into shares of our common stock from time to time in connection with a financing, acquisition, investment, our stock incentive plans, the conversion of our 2025 Notes, the settlement of our 2025 Warrants, or otherwise.

Any such issuance could result in substantial dilution to our existing stockholders and cause the market price of our common stock to decline.

Subject to compliance with applicable rules and regulations, we may issue shares of common stock or securities convertible into or exchangeable for shares of our common stock from time to time in connection with a financing or other capital raising, acquisition, investment, our stock incentive plans, the settlement of our 2025 Warrants, or otherwise.

Any such issuance, including in connection with the proposed CyberArk acquisition, could result in substantial dilution to our existing stockholders and cause the market price of our common stock to decline.

We cannot guarantee that our share repurchase program will be fully consummated or that it will enhance shareholder value, and share repurchases could affect the price of our common stock.

As of April 30, 2025, we had $1.0 billion available under our share repurchase program which will expire on December 31, 2025 and may be suspended or discontinued at any time without prior notice.

As of October 31, 2025, we had $1.0 billion available under our share repurchase program which will expire on December 31, 2026 and may be suspended or discontinued at any time without prior notice.

Although our board of directors has authorized a share repurchase program, we are not obligated to repurchase any specific dollar amount or to acquire any specific number of shares under the program.

5 unchanged sentences

As a result, stockholders may only receive a return on their investments in our common stock if the market price of our common stock increases.

Our charter documents and Delaware law, as well as certain provisions contained in the indentures governing our Notes, could discourage takeover attempts and lead to management entrenchment, which could also reduce the market price of our common stock.

Our charter documents and Delaware law could discourage takeover attempts and lead to management entrenchment, which could also reduce the market price of our common stock.

Provisions in our restated certificate of incorporation and amended and restated bylaws may have the effect of delaying or preventing a change in control of our company or changes in our management.

Our restated certificate of incorporation and amended and restated bylaws include provisions that:

Our amended and restated certificate of incorporation and amended and restated bylaws include provisions that, among other things:

• establish that our board of directors is divided into three classes, Class I, Class II, and Class III, with three-year staggered terms;

9 unchanged sentences

These provisions may prohibit large stockholders, in particular those owning 15% or more of our outstanding voting stock, from merging or combining with us for a certain period of time.

Additionally, certain provisions contained in the indenture governing our 2025 Notes could make it more difficult or more expensive for a third party to acquire us.

The application of Section 203 or certain provisions contained in the indenture governing our 2025 Notes also could have the effect of delaying or preventing a change in control of us.

Any of these provisions could, under certain circumstances, depress the market price of our common stock.

1 unchanged sentence

Our business is subject to the risks of earthquakes, fire, power outages, floods, health risks, and other catastrophic events, and to interruption by man-made problems, such as terrorism.

Both our corporate headquarters and the location where our products are manufactured are located in the San Francisco Bay Area, a region known for seismic activity.

In addition, other natural disasters, such as fire or floods, a significant power outage, telecommunications failure, terrorism, an armed conflict, cyberattacks, epidemics and pandemics such as COVID-19, or other geopolitical unrest could affect our supply chain, manufacturers, logistics providers, channel partners, end-customers, or the economy as a whole, and such disruption could impact our shipments and sales.

Our corporate headquarters are located in the San Francisco Bay Area, a region known for seismic activity.

In addition, other natural disasters, such as fire or floods, a significant power outage, telecommunications failure, terrorism, an armed conflict, cyberattacks, epidemics and pandemics, or other geopolitical unrest could affect our supply chain, manufacturers, logistics providers, channel partners, end-customers, or the economy as a whole, and such disruption could impact our shipments and sales.

These risks may be further increased if the disaster recovery plans for us and our suppliers prove to be inadequate.

8 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-Q

Item 1A. Risk Factors