What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2024-02-22 compared with 2023-02-23 · 148 added, 141 removed, 455 unchanged (39% of the section changed)

An investment in our common stock involves a high degree of risk.

You should carefully consider the risks and uncertainties described below, and all other information contained in this Annual Report on Form 10-K, including our consolidated financial statements and the related notes, before making a decision to invest in our common stock.

You should carefully consider the risks and uncertainties described below, and all other information contained in this Annual Report on Form 10-K, including our consolidated financial statements and the related notes, before making a decision to invest in our common stock.

Our business, operating results, financial condition, or prospects could be materially and adversely affected by any of these risks and uncertainties.

In that case, the trading price of our common stock could decline, and you might lose all or part of your investment.

In addition, the risks and uncertainties discussed below are not the only ones we face.

In addition, the risks and

uncertainties discussed below are not the only ones we face.

Our business, operating results, financial performance or prospects could also be harmed by risks and uncertainties not currently known to us or that we currently do not believe are material.

Risks Related to Our Business and Industry

Our quarterly and annual operating results may vary from period to period, which could result in our failure to meet expectations with respect to operating results and cause the trading price of our stock to decline.

Our quarterly and annual operating results may vary from period to period, which could result in our failure to meet expectations with respect to operating results and cause the trading price of our stock to decline.

Our operating results have historically varied from period to period, and we expect that they will continue to do so as a result of a number of factors, many of which are outside of our control, including:

13 unchanged sentences

• changes in the growth rate of the IT, security and compliance market;

actual or perceived security breaches, technical difficulties or interruptions with our service;

• actual or perceived security breaches and incidents, technical difficulties or interruptions with our service;

• failure of our products and services to operate as designed;

publicity regarding security breaches generally and the level of perceived threats to IT security;

• publicity regarding security breaches and incidents generally and the level of perceived threats to IT security;

• the announcement or adoption of new regulations and policy mandates or changes to existing regulations and policy mandates;

11 unchanged sentences

Further, the interpretation and application of international laws and regulations in many cases is uncertain, and our legal and regulatory obligations in foreign jurisdictions are subject to frequent and unexpected changes, including the potential for various regulatory or other governmental bodies to enact new or additional laws or regulations or to issue rulings that invalidate prior laws or regulations.

Each factor above or discussed elsewhere in this Annual Report on Form 10-K or the cumulative effect of some of these factors may result in fluctuations in our operating results.

Each factor above or discussed elsewhere in this Annual Report on Form 10-K or the cumulative effect of some of these factors may result in fluctuations in our operating results.

This variability and unpredictability could result in our failure to meet expectations with respect to operating results, or those of securities analysts or investors, for a particular period.

21 unchanged sentences

Furthermore, diversifying our solutions and expanding into new IT, security and compliance markets will require significant investment and planning, require that our research and development and sales and marketing organizations develop expertise in these new markets, bring us more directly into competition with IT, security compliance providers that may be better established or have greater resources than we do, require additional investment of time and resources in the development and training of our channel partners and entail significant risk of failure.

If we fail to anticipate market requirements or fail to develop and introduce solution enhancements or new solutions to satisfy those requirements in a timely manner, such failure could substantially decrease or delay market acceptance and sales of our present and future solutions and cause us to lose existing customers or fail to gain new customers, which would significantly harm our business, financial condition and results of operations.

present and future solutions and cause us to lose existing customers or fail to gain new customers, which would significantly harm our business, financial condition and results of operations.

If we fail to continue to effectively scale and adapt our platform to meet the performance and other requirements of our customers, our operating results and our business would be harmed.

6 unchanged sentences

If we are unable to renew existing subscriptions for our IT, security and compliance solutions, sell additional subscriptions for our solutions and attract new customers, our operating results would be harmed.

We offer our Qualys Cloud Platform and integrated suite of solutions pursuant to a software-as-a-service model, and our customers purchase subscriptions from us that are generally one year in length.

We offer our cloud platform and integrated suite of solutions pursuant to a software-as-a-service model, and our customers purchase subscriptions from us that are generally one year in length.

Our customers have no obligation to renew their subscriptions after their subscription period expires, and they may not renew their subscriptions at the same or higher levels or at all.

As a result, our ability to grow depends in part on customers renewing their existing subscriptions and purchasing additional subscriptions and solutions.

Our customers may choose not to renew their subscriptions to our solutions or purchase additional solutions due to a number of factors, including their satisfaction or dissatisfaction with our solutions, the prices of our solutions, the prices of products or services offered by our competitors, reductions in our customers’

spending levels due to the macroeconomic environment or other factors.

If our customers do not renew their subscriptions to our solutions, renew on less favorable terms, or do not purchase additional solutions or subscriptions, our revenues may grow more slowly than expected or decline and our operating results would be harmed.

7 unchanged sentences

Our platform, website and internal systems may be subject to intentional disruption or other security incidents that could result in liability and adversely impact our reputation and future sales.

We and our service providers face threats from a variety of sources, including attacks on our networks and systems from numerous sources, including traditional “hackers,”

sophisticated nation-state and nation-state supported actors, other sources of malicious code (such as viruses and worms), ransomware, social engineering, denial of service attacks, and phishing attempts.

We and our service providers could be a target of cyber-attacks or other malfeasance designed to impede the performance of our solutions, penetrate our network security or the security of our cloud platform or our internal systems, misappropriate proprietary information and/or cause interruptions to our services. We and our service providers have experienced and may continue to experience security incidents and attacks of varying degrees from time to time.

For example, in December 2020, we were notified by a service provider, Accellion, of a zero-day vulnerability affecting an Accellion FTA server that we deployed to transfer information as part of our customer support system.

In response to this incident, we engaged third-party forensic experts to investigate and determined that attackers illegally obtained certain information from the Accellion FTA server.

We notified affected customers, as we deemed was required or appropriate.

We have incurred costs to respond to this incident and may continue to incur costs to support our efforts to enhance our security measures. Additionally, due to political uncertainty and military actions associated with Russia’s invasion of Ukraine, we and our service providers are vulnerable to heightened risks of cybersecurity incidents and security and privacy breaches from or affiliated with nation-state actors, including attacks that could materially disrupt our systems, operations and services.

Our solutions, platforms, and system, and those of our service providers, may also suffer security incidents as a result of non-technical issues, including intentional or inadvertent acts or omissions by our employees or service providers. With the increase in personnel working remotely during the current COVID-19 pandemic, we and our service providers are at increased risk for security breaches.

We have taken and intend to continue to take steps to monitor and enhance the security of our solutions, cloud platform, and other relevant systems, IT infrastructure, networks, and data;

We and our service providers face threats from a variety of sources, including attacks on our networks and systems from numerous sources, including traditional “hackers,” sophisticated nation-state and nation-state supported actors, other sources of malicious code (such as viruses and worms), ransomware, social engineering, denial of service attacks, and phishing attempts.

We and our service providers have experienced and may continue to experience security incidents and attacks of varying degrees from time to time.

We have incurred costs to respond to such incidents and may continue to incur costs to support our efforts to enhance our security measures.

Additionally, due to political uncertainty and military actions in parts of Eastern Europe and the Middle East, we and our service providers are vulnerable to heightened

risks of cybersecurity incidents and security and privacy breaches from or affiliated with nation-state actors, including attacks that could materially disrupt our systems, operations and services.

With the increase in personnel working remotely, we and our service providers are at increased risk for security breaches and incidents.

We have taken and intend to continue to take steps to monitor and enhance the security of our solutions, cloud platform, and other relevant systems, IT infrastructure, networks, and data;

however, the unprecedented scale of remote work may require additional personnel and resources, which nevertheless cannot be guaranteed to fully safeguard our solutions, our cloud platform, or any systems, IT infrastructure networks, or data upon which we rely.

Further, because our operations involve providing IT security solutions to our customers, we may be targeted for cyber-attacks and other security incidents.

A breach in our data security or an attack against our service availability, or that of our third-party service providers, could impact our networks or networks secured by our solutions, creating system disruptions or slowdowns and exploiting security vulnerabilities of our solutions, and the information stored on our networks or those of our third-party service providers could be accessed, used, publicly disclosed, altered, lost, or stolen, which could subject us to liability and cause us financial harm.

If an actual or perceived disruption in the availability of our solutions or the breach of our security measures or those of our service providers occurs, it could adversely affect the market perception of our solutions, result in a loss of competitive advantage, have a negative impact on our reputation, or result in the loss of customers, channel partners and sales, and it may expose us to the loss or alteration of information, litigation, regulatory actions and investigations and possible liability.

Any such actual or perceived security breach or disruption could also divert the efforts of our technical and management personnel.

We also may incur significant costs and operational consequences of investigating, remediating, eliminating and putting in place additional tools and devices designed to prevent actual or perceived security incidents, as well as the costs to comply with any notification obligations resulting from any security incidents.

In addition, any such actual or perceived security breach could impair our ability to operate our business and provide solutions to our customers.

A breach in or incident impacting our data security, an attack against our service availability, or any breach, incident, or attack impacting our third-party service providers, could impact our networks or networks secured by our solutions, creating system disruptions or slowdowns and exploiting security vulnerabilities of our solutions, and the information stored on our networks or those of our third-party service providers could be accessed, used, publicly disclosed, altered, lost, or stolen, which could subject us to liability and cause us financial harm.

If an actual or perceived disruption in the availability of our solutions or the breach or other compromise of our security measures or those of our service providers occurs, it could adversely affect the market perception of our solutions, result in a loss of competitive advantage, have a negative impact on our reputation, or result in the loss of customers, channel partners and sales, and it may expose us to the loss, unavailability or alteration of information, claims, demands and litigation, regulatory investigations, actions and other proceedings and possible liability.

Any such actual or perceived security breach or incident or disruption could also divert the efforts of our technical and management personnel.

We and our service providers may face difficulties or delays in identifying and responding to any security breach or incident.

We also may incur significant costs and operational consequences of investigating, remediating, eliminating and putting in place additional tools and devices designed to prevent actual or perceived security incidents, as well as costs to respond to and otherwise address any breach or incident, including any to comply with any notification obligations resulting from any security incidents.

In addition, any such actual or perceived security breach or incident could impair our ability to operate our business and provide solutions to our customers.

If this happens, our reputation could be harmed, our revenues could decline and our business could suffer.

3 unchanged sentences

As a result, revenues may vary from period to period, which may cause our operating results to fluctuate and could harm our business.

The timing of sales of subscriptions for our solutions can be difficult to forecast because of the length and unpredictability of our sales cycle, particularly with large transactions.

The timing of sales of subscriptions for our solutions can be difficult to forecast because of the length and unpredictability of our sales cycle, particularly with large transactions and in the current macroeconomic environment.

We sell subscriptions to our IT, security and compliance solutions primarily to IT departments that are managing a growing set of user and compliance demands, which has increased the complexity of customer requirements to be met and confirmed during the sales cycle and prolonged our sales cycle.

Further, the length of time that potential customers devote to their testing and evaluation, contract negotiation and budgeting processes varies significantly, which has also made our sales cycle long and unpredictable.

The length of the sales cycle for our solutions typically ranges from six to twelve months but can be more than eighteen months.

The length of the sales cycle for our solutions typically ranges from six to twelve months but can be more than eighteen months.

In addition, we might devote substantial time and effort to a particular unsuccessful sales effort, and as a result we could lose other sales opportunities or incur expenses that are not offset by an increase in revenues, which could harm our business.

1 unchanged sentence

Our business depends to a significant extent on the overall demand for IT and on the economic health of our current and prospective customers.

Economic weakness, customer financial difficulties, supply chain constraints, change in interest rates, inflationary pressures and potential for a recession, and constrained spending on IT security, which factors we have experienced in 2022, have resulted and may in the future result in decreased revenue and earnings.

Such factors have made and could in the future make it difficult to accurately forecast our sales and operating results and could negatively affect our ability to provide accurate forecasts to our contract manufacturers.

In addition, continued governmental budgetary challenges in the United States and Europe, inflationary pressures and potential for a recession, and geopolitical turmoil in many parts of the world, including the ongoing military conflict between Russia and Ukraine, and other disruptions to global and regional economies and markets in many parts of the world, as well as uncertainties related to changes in public policies such as domestic and international regulations, taxes or international trade agreements, have and may continue to put pressure on global economic conditions and overall spending on IT security and may further increase inflation, both in the U.S.

Economic weakness, customer financial difficulties, supply chain constraints, change in interest rates, inflationary pressures and potential for a recession, and constrained spending on IT security, as well as longer sales cycles, which factors we have experienced in 2023, have resulted and may in the future result in decreased revenue and earnings.

Such factors have made and could in the future make it difficult to accurately forecast our sales and operating results and could negatively affect our ability to provide accurate forecasts to our contract manufacturers.

In addition, continued governmental budgetary challenges in the United States and Europe, inflationary pressures and potential for a recession, and geopolitical turmoil in many parts of the

world, including the ongoing military conflicts in parts of Eastern Europe and the Middle East, and other disruptions to global and regional economies and markets in many parts of the world, as well as uncertainties related to changes in public policies such as domestic and international regulations, taxes or international trade agreements, have and may continue to put pressure on global economic conditions and overall spending on IT security and may further increase inflation, both in the U.S.

and globally, which could increase our operating costs in the future and reduce overall spending on IT security.

3 unchanged sentences

Future or continued economic weakness for us or our customers, failure of our customers and markets to recover from such weakness, customer financial difficulties, and reductions in spending on IT security could have a material adverse effect on demand for our platform and consequently on our business, financial condition and results of operations.

Our IT, security and compliance solutions are delivered from 11 shared cloud platforms , and any disruption of service at these facilities would interrupt or delay our ability to deliver our solutions to our customers which could reduce our revenues and harm our operating results.

We currently host substantially all of our solutions from third-party shared cloud platforms located in the United States, Canada, Switzerland, the Netherlands, United Arab Emirates, Australia, United Kingdom and India.

Our IT, security and compliance solutions are delivered from 14 shared cloud platforms , and any disruption of service at these facilities would interrupt or delay our ability to deliver our solutions to our customers which could reduce our revenues and harm our operating results.

We currently host substantially all of our solutions from third-party shared cloud platforms located in the United States, Canada, Switzerland, the Netherlands, United Arab Emirates, Australia, United Kingdom, Italy, the Kingdom of Saudi Arabia and India.

These facilities are vulnerable to damage or interruption from earthquakes, hurricanes, floods, fires, cybersecurity attacks, terrorist attacks, employee negligence, power losses, telecommunications failures and similar events.

1 unchanged sentence

The occurrence of a natural disaster, an act of terrorism or misconduct, a decision to close the facilities without adequate notice or other unanticipated problems could result in interruptions in our services.

Some of our shared cloud platforms are not currently redundant and we may not be able to rapidly move our customers from one shared cloud platform to another, which may increase delays in the restoration of our service for our customers if an adverse event occurs.

We have added shared cloud platforms to provide additional capacity and to enable disaster recovery.

Some of our shared cloud platforms are not currently redundant and we may not be able to rapidly move our customers from one shared cloud platform to another, which may increase delays in the restoration of our service for our customers if an adverse event occurs.

We have added shared cloud platforms to provide additional capacity and to enable disaster recovery.

We continue to build out these facilities;

however, these additional facilities may not be operational in the anticipated time-frame and we may incur unplanned expenses.

Additionally, our existing shared cloud platform providers have no obligations to renew their agreements with us on commercially reasonable terms, or at all.

If we are unable to renew our agreements with the facilities providers on commercially reasonable terms or if in the future we add additional shared cloud platform providers, we may experience costs or downtime in connection with the loss of an existing facility or the transfer to, or addition of, new facilities.

Any disruptions or other performance problems with our solutions could harm our reputation and business and may damage our customers’

Additionally, our existing shared cloud platform providers have no obligations to renew their agreements with us on commercially reasonable terms, or at all.

If we are unable to renew our agreements with the facilities providers on commercially reasonable terms or if in the future we add additional shared cloud platform providers, we may experience costs or downtime in connection with the loss of an existing facility or the transfer to, or addition of, new facilities.

Any disruptions or other performance problems with our solutions could harm our reputation and business and may damage our customers’ businesses.

Interruptions in our service delivery might reduce our revenues, cause us to issue credits to customers, subject us to potential liability and cause customers to terminate their subscriptions or not renew their subscriptions.

2 unchanged sentences

We face significant competition for each of our solutions from companies with broad product suites and greater name recognition and resources than we have, as well as from small companies focused on specialized security solutions.

We compete with large and small public companies, such as Broadcom (Symantec Enterprise Security), CrowdStrike, Palo Alto Networks, Rapid7, Tenable Holdings, as well as privately held security providers including Axonius, Checkmarx, Flexera, Invicti, Ivanti, Tanium, HelpSystems (Tripwire), Trustwave Holdings and Veracode.

We compete with large and small public companies, such as Broadcom (Symantec Enterprise Security), CrowdStrike, Palo Alto Networks, Rapid7, Tenable Holdings, as well as privately held security providers including Axonius, Checkmarx, Flexera, Invicti, Ivanti, Tanium, HelpSystems (Tripwire), Trustwave Holdings, Veracode and Wiz.

We also seek to replace IT, security and compliance solutions that organizations have developed internally.

As we continue to extend our cloud platform’s functionality by further developing IT, security and compliance solutions, such as web application scanning and firewalls, we expect to face additional competition in these new markets.

As we continue to extend our cloud platform’s functionality by further developing IT, security and compliance solutions, such as Cybersecurity Asset Management and Patch Management, we expect to face additional competition in these new markets.

Our competitors may also attempt to further expand their presence in the IT, security and compliance market and compete more directly against one or more of our solutions.

We believe that the principal competitive factors affecting our markets include product functionality, breadth of offerings, flexibility of delivery models, ease of deployment and use, total cost of ownership, scalability and performance, customer support and extensibility of platform.

Many of our existing and potential competitors have competitive advantages, including:

13 unchanged sentences

These competitors may also offer their products at a lower price as part of this larger sale, which could increase pricing pressure on our solutions and cause the average sales price for our solutions to decline.

These larger competitors are also often in a better position to withstand any significant reduction in capital spending and will therefore not be as susceptible to economic downturns.

These larger competitors are also often in a better position to withstand any significant reduction in capital spending and will therefore not be as susceptible to economic downturns.

Furthermore, our current and potential competitors may establish cooperative relationships among themselves or with third parties that may further enhance their resources and product and services offerings in the markets we address.

7 unchanged sentences

Additionally, although we price our products and subscriptions worldwide in U.S.

Dollars, Euros, British Pounds, Canadian Dollars, Japanese Yen and Indian Rupee, currency fluctuations in certain countries and regions may negatively impact actual prices that partners and customers are willing to pay in those countries and regions, or the effective prices we realize in our reporting currency.

Dollars, Euro, British Pounds, Canadian Dollars, Japanese Yen and Indian Rupee, currency fluctuations in certain countries and regions may negatively impact actual prices that partners and customers are willing to pay in those countries and regions, or the effective prices we realize in our reporting currency.

We cannot assure you that we will be successful in developing and introducing new offerings with enhanced functionality on a timely basis, or that our new product and subscription offerings, if introduced, will enable us to maintain our prices and gross profits at levels that will allow us to maintain positive gross margins and profitability.

1 unchanged sentence

We generate a portion of our revenues from solutions that help organizations achieve and maintain compliance with regulations and industry standards.

For example, many of our customers subscribe to our IT, security and compliance solutions to help them comply with the security standards developed and maintained by the Payment Card Industry Security Standards Council, or the PCI Council, which apply to companies that store cardholder data.

or the PCI Council, which apply to companies that store cardholder data.

Industry organizations like the PCI Council may significantly change their security standards with little or no notice, including changes that could make their standards more or less onerous for businesses.

Governments may also adopt new laws or regulations, or make changes to existing laws or regulations, that could impact the demand for or value of our solutions.

If we are unable to adapt our solutions to changing regulatory standards in a timely manner, or if our solutions fail to assist with or expedite our customers’

compliance initiatives, our customers may lose confidence in our solutions and could switch to products offered by our competitors.

Governments may also adopt new laws or regulations, or make changes to existing laws or regulations, which could impact the demand for or value of our solutions.

If we are unable to adapt our solutions to changing regulatory standards in a timely manner, or if our solutions fail to assist with or expedite our customers’ compliance initiatives, our customers may lose confidence in our solutions and could switch to products offered by our competitors.

In addition, if regulations and standards related to data security, vulnerability management and other IT, security and compliance requirements are relaxed or the penalties for non-compliance are changed in a manner that makes them less onerous, our customers may view government and industry regulatory compliance as less critical to their businesses, and our customers may be less willing to purchase our solutions.

1 unchanged sentence

If our solutions fail to detect vulnerabilities or incorrectly detect vulnerabilities, our brand and reputation could be harmed, which could have an adverse effect on our business and results of operations.

If our solutions fail to detect vulnerabilities in our customers’

IT infrastructures, or if our solutions fail to identify and respond to new and increasingly complex methods of attacks, our business and reputation may suffer.

If our solutions fail to detect vulnerabilities in our customers’ IT infrastructures, or if our solutions fail to identify and respond to new and increasingly complex methods of attacks, our business and reputation may suffer.

There is no guarantee that our solutions will detect all vulnerabilities.

7 unchanged sentences

In addition, our solutions do not currently extend to cover all mobile and personal devices that employees may bring into an organization.

As such, our solutions would not identify or address vulnerabilities in all mobile and personal devices, and our customers’

IT infrastructures may be compromised by attacks that infiltrate their networks through such devices.

An actual or perceived security breach or theft of the sensitive data of one of our customers, regardless of whether the breach is attributable to the failure of our solutions, could adversely affect the market’s perception of our security solutions.

As such, our solutions would not identify or address vulnerabilities in all mobile and personal devices, and our customers’ IT infrastructures may be compromised by attacks that infiltrate their networks through such devices.

An actual or perceived security breach or incident or loss, theft, unavailability or other compromise of the sensitive data of one of our customers, regardless of whether the breach is attributable to the failure of our solutions, could adversely affect the market’s perception of our security solutions.

If we are unable to continue the expansion of our sales force, sales of our solutions and the growth of our business would be harmed.

We believe that our growth will depend, to a significant extent, on our success in recruiting and retaining a sufficient number of qualified sales personnel and their ability to obtain new customers, manage our existing customer base and expand the sales of our newer solutions.

We plan to continue to expand our sales force and make a significant investment in our sales and marketing activities.

We plan to continue to expand our sales force and invest in our sales and marketing activities.

Our recent hires and planned hires may not become as productive as quickly as we would like, and we may be unable to hire or retain sufficient numbers of qualified individuals in the future in the competitive markets where we do business.

4 unchanged sentences

Our success significantly depends to a significant extent on establishing and maintaining relationships with a variety of channel partners and we anticipate that we will continue to depend on these partners in order to grow our business.

For th e years ended December 31, 2022, 2021 and 2020,  we derived approximately 42%, 41% 

and 42%, respectively, 

o f our revenues from sales of subscriptions for our solutions through channel partners, and the percentage of revenues derived from channel partners may increase in future periods.

For the years ended December 31, 2023, 2022 and 2021 , we derived approximately 43%, 42% and 41% o f our revenues from sales of subscriptions for our solutions through channel partners, and the percentage of revenues derived from channel partners may increase in future periods.

Our agreements with our channel partners are generally non-exclusive and do not prohibit them from working with our competitors or offering competing solutions, and many of our channel partners have more established relationships with our competitors.

5 unchanged sentences

In addition, the financial health of our channel partners and our continuing relationships with them are important to our success.

Some of these channel partners may be unable to withstand adverse changes in economic conditions, which could result in insolvency and/or the inability of such distributors to obtain credit to finance purchases of our products and services.

In addition, weakness in the end-user market could negatively affect the cash flows of our channel partners who could, in turn, delay paying their obligations to us, which would increase our credit risk exposure.

29 unchanged sentences

If we are unable to successfully manage the challenges of international operations, our business and operating results could be adversely affected.

In addition, as of December 31, 2022, approximately 75% of our employees were located outside of the United States, with 66% of our employees located in Pune, India.

In addition, as of December 31, 2023, approximately 75% of our employees were located outside of the United States, with 66% of our employees located in Pune, India.

Accordingly, we are exposed to changes in laws governing our employee relationships in various U.S.

and foreign jurisdictions, including laws and regulations regarding wage and hour requirements, fair labor standards, employee data privacy, unemployment tax rates, workers’

compensation rates, citizenship requirements and payroll and other taxes which may have a direct impact on our operating costs.

and foreign jurisdictions, including laws and regulations regarding wage and hour requirements, fair labor standards, employee data privacy, unemployment tax rates, workers’ compensation rates, citizenship requirements and payroll and other taxes which may have a direct impact on our operating costs.

We may continue to expand our international operations and international sales and marketing activities.

4 unchanged sentences

dollar and we generate a majority of our revenues in U.S.

However, for the year ended December 31, 2022,  we incurred approximately 29% of our expenses in foreign currencies, primarily Euros, British Pounds, and Indian Rupee, principally with respect to salaries and related personnel expenses associated with our European and Indian operations.

Additionally, for the year ended December 31, 2022,  approximately 24% of our revenue s were generated in foreign currencies.

However, for the year ended December 31, 2023, we incurred approximately 29% of our expenses in foreign currencies, primarily Euro, British Pounds, and Indian Rupee, principally with respect to salaries and related personnel expenses associated with our European and Indian operations.

Additionally, for the year ended December 31, 2023, approximately 23% of our revenue s were generated in foreign currencies.

Accordingly, changes in exchange rates may have a material adverse effect on our business, operating results and financial condition.

6 unchanged sentences

We use foreign currency forward contracts to mitigate the impact of foreign currency fluctuations of certain non-U.S.

dollar denominated net asset positions, to date primarily cash, accounts receivable and operating lease liabilities (non-designated), as well as to manage foreign currency fluctuation risk related to forecasted transactions (designated).

dollar denominated net asset positions, to date primarily cash, accounts receivable and operating lease liabilities (non-designated), as well as to manage foreign currency fluctuation risk related to forecasted transactions (designated).

However, we may not be able to purchase derivative instruments that are adequate to insulate ourselves from foreign currency exchange risks.

2 unchanged sentences

Our success depends to a significant extent on the willingness of organizations to increase their use of cloud solutions for their IT, security and compliance.

Some organizations may be reluctant to use cloud solutions because they have concerns regarding the risks associated with the reliability or security of the technology delivery model associated with these solutions.

Some organizations may be reluctant to use cloud solutions because they have concerns regarding the risks associated with the reliability or security of the technology delivery model associated with these solutions.

If other cloud service providers experience security incidents, loss of customer data, disruptions in service delivery or other problems, the market for cloud solutions as a whole, including our solutions, may be negatively impacted.

Moreover, organizations that have invested substantial personnel and financial resources to integrate on-premise software into their businesses may be reluctant or unwilling to migrate to a cloud solution.

Moreover, organizations that have invested substantial personnel and financial resources to integrate on-premise software into their businesses may be reluctant or unwilling to migrate to a cloud solution.

Organizations that use on-premise security products, such as network firewalls, security information and event management products or data loss prevention solutions, may also believe that these products sufficiently protect their IT infrastructure and deliver adequate security.

2 unchanged sentences

Our business and operations have continued to grow since inception, and if we do not appropriately manage any future growth, or are unable to improve our systems and processes, our operating results may be negatively affected.

We have continued to grow over the last several years, with revenues increasing from $363.0 million in 2020 to $489.7 million in 2022, and headcount increasing from 1,498 employees at the beginning of 2020 to 2,143 employees as of December 31, 2022. We rely on information technology systems to help manage critical functions such as order processing, revenue recognition and financial forecasts.

We have continued to grow over the last several years, with revenues increasing from $411.2 million in 2021 to $554.5 million in 2023, and headcount increasing from 1,498 employees at the beginning of 2021 to 2,188 employees as of December 31, 2023.

We rely on information technology systems to help manage critical functions such as order processing, revenue recognition and financial forecasts.

To manage any future growth effectively we must continue to improve and expand our IT systems, financial infrastructure, and operating and administrative systems and controls, and continue to manage headcount, capital and processes in an efficient manner.

6 unchanged sentences

Our future performance depends to a significant extent on the continued services and continuing contributions of our senior management and other key employees, to execute on our business plan and to identify and pursue new opportunities and product innovations.

We do not maintain key-man insurance for any member of our senior management team.

Our senior management and key employees are generally employed on an at-will basis, which means that they could terminate their employment with us at any time. From time to time, there may be changes in our senior management team resulting from the termination or departure of executives.

For example, we recently announced that we and our Chief Revenue Officer mutually agreed to end his employment on March 31, 2023.

We do not maintain key-man insurance for any member of our senior management team.

Our senior management and key employees are generally employed on an at-will basis, which means that they could terminate their employment with us at any time.

From time to time, there may be changes in our senior management team resulting from the termination or departure of executives.

The loss of the services of our senior management or other key employees for any reason could significantly delay or prevent the achievement of our development and strategic objectives and harm our business, financial condition and results of operations.

3 unchanged sentences

Any of our employees may terminate their employment at any time.

Competition for highly skilled personnel is frequently intense, especially within our industry, and we may not be able to compete for such personnel.

Competition for highly skilled personnel is frequently intense, especially within our industry, and we may not be able to compete for such personnel.

We are required under accounting principles generally accepted in the United States (U.S.

7 unchanged sentences

Government entities may have contractual or other legal rights to terminate contracts with our channel partners for convenience or due to a default, and any such termination may adversely impact our future results of operations.

Governments routinely investigate and audit government contractors’

administrative processes, and any unfavorable audit could result in the government refusing to continue buying our solutions, a reduction of revenues or fines or civil or criminal liability if the audit uncovers improper or illegal activities.

Governments routinely investigate and audit government contractors’ administrative processes, and any unfavorable audit could result in the government refusing to continue buying our solutions, a reduction of revenues or fines or civil or criminal liability if the audit uncovers improper or illegal activities.

Any such penalties could adversely impact our results of operations in a material way.

1 unchanged sentence

In order to remain competitive, we have in the past and may in the future seek to acquire additional businesses, products, services or technologies.

For example, we acquired certain intellectual property of Spell Security on July 24, 2020, certain intellectual property of TotalCloud on August 19, 2021 and certain assets of Blue Hexagon on October 4, 2022. The environment for acquisitions in our industry is very competitive and acquisition candidate purchase prices may exceed what we would prefer to pay.

For example, we acquired certain intellectual property of TotalCloud on August 19, 2021 and certain assets of Blue Hexagon on October 4, 2022.

The environment for acquisitions in our industry is very competitive and acquisition candidate purchase prices may exceed what we would prefer to pay.

Moreover, achieving the anticipated benefits of past and future acquisitions will depend in part upon whether we can integrate acquired operations, products and technology in a timely and cost-effective manner, and even if we achieve benefits from acquisitions, such acquisitions may still be viewed negatively by customers, financial markets or investors.

The acquisition and integration process is complex, expensive and time-consuming, and may cause an interruption of, or loss of momentum in, product development and sales activities and operations of both companies, as well as divert the attention of management, and we may incur substantial cost and expense.

We may issue equity securities which could dilute current stockholders’

ownership, incur debt, assume contingent or other liabilities and expend cash in acquisitions, which could negatively impact our financial position, stockholder equity and stock price.

We may issue equity securities which could dilute current stockholders’ ownership, incur debt, assume contingent or other liabilities and expend cash in acquisitions, which could negatively impact our financial position, stockholder equity and stock price.

We may not find suitable acquisition candidates, and acquisitions we complete may be unsuccessful.

7 unchanged sentences

Our customers have in the past inadvertently misused our solutions, which triggered downtime in their internal infrastructure until the problem was resolved.

Additionally, any failure to implement and configure our solutions correctly may result in our solutions failing to detect vulnerabilities or compliance issues, or otherwise to perform effectively, and may result in disruptions to our customers’

IT environments and businesses.

Any misuse of our solutions, including any failure to implement and configure them appropriately, could result in disruption to our customers’

businesses, customer dissatisfaction, negative impacts on the perceived reliability or effectiveness of our solutions, and claims and litigation, and may result in negative press coverage, negative effects on our reputation and competitive position, a loss of sales, customers, and channel partners, and harm our financial results.

Any misuse of our solutions, including any failure to implement and configure them appropriately, could result in disruption to our customers’ businesses, customer dissatisfaction, negative impacts on the perceived reliability or effectiveness of our solutions, and claims and litigation, and may result in negative press coverage, negative effects on our reputation and competitive position, a loss of sales, customers, and channel partners, and harm our financial results.

We recognize revenues from subscriptions over the term of the relevant service period, and therefore any decreases or increases in bookings are not immediately reflected in our operating results.

8 unchanged sentences

Our corporate headquarters and a significant portion of our operations are located in the San Francisco Bay Area, a region known for seismic activity.

In addition, natural disasters could affect our business partners’

ability to perform services for us on a timely basis.

In addition, natural disasters could affect our business partners’ ability to perform services for us on a timely basis.

In the event we or our business partners are hindered by any of the events discussed above, our ability to provide our solutions to customers could be delayed, resulting in our missing financial targets, such as revenues and net income, for a particular quarter.

Further, if a natural disaster occurs in a region from which we derive a significant portion of our revenues, customers in that region may delay or forego subscriptions of our solutions, which may materially and adversely impact our results of operations for a particular period.

In addition, war, acts of terrorism, pandemics or other health emergencies, or responses to these events could cause disruptions in our business or the business of our business partners, customers or the economy as a whole.

In addition, war, acts of terrorism, pandemics or other health emergencies, or responses to these events could cause disruptions in our business or the business of our business partners, customers or the economy as a whole.

All of the aforementioned risks may be exacerbated if the disaster recovery plans for us and our suppliers prove to be inadequate.

10 unchanged sentences

The successful assertion of one or more large claims against us that exceed available insurance coverage or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, could have a material and adverse effect on our business, including our financial condition, operating results and reputation.

Our solutions could be used to collect and store personal information of our customers ’

employees or customers, and therefore privacy and other data handling concerns could result in additional cost and liability to us or inhibit sales of our solutions.

Our solutions could be used to collect and store personal information of our customers ’ employees or customers, and therefore privacy and other data handling concerns could result in additional cost and liability to us or inhibit sales of our solutions.

We collect the names and email addresses of our customers in connection with subscriptions to our solutions.

Additionally, the data that our solutions collect to help secure and protect the IT infrastructure of our customers may include additional personal or confidential information of our customers’

employees and their customers.

Additionally, the data that our solutions collect to help secure and protect the IT infrastructure of our customers may include additional personal or confidential information of our customers’ employees and their customers, and we may collect, store and otherwise process personal or confidential information more generally in connection with our business and operations.

Personal privacy has become a significant issue in the United States and in many other countries where we offer our solutions.

5 unchanged sentences

Additionally, new laws and regulations relating to privacy and data protection continue to be proposed and enacted.

For example, the European Union has adopted the Global Data Protection Regulation (“GDPR”).

This regulation, which took effect in May of 2018, provides for substantial obligations relating to the handling, storage and other processing of data relating to individuals and administrative fines for violations, which can be up to four percent of the previous year’s annual revenue or €20 million, whichever is higher.

For example, the European Union has adopted the Global Data Protection Regulation (“GDPR”).

The GDPR may be subject to new or changing interpretations by courts, and our interpretation of the law and efforts to comply with the rules and regulations of the law may be ruled invalid.

Similarly, the California Consumer Privacy Act (“CCPA”) requires covered companies to, among other things, provide new disclosures to California consumers and affords such consumers new rights to opt-out of certain sales of personal information.

The CCPA also creates a private right of action for statutory damages for certain breaches of information. Certain aspects of the CCPA and its interpretation remain uncertain and are likely to remain uncertain for an extended period. Additionally, a new privacy law, the California Privacy Rights Act (“CPRA”), was approved by voters in the November 3, 2020 election.

The CPRA modifies the CCPA significantly, creating obligations relating to consumer data beginning on January 1, 2022, and enforcement is expected to commence on July 1, 2023.

Passage of the CPRA has resulted in further uncertainty and may require us to incur additional costs and expenses in an effort to comply.

In addition, other states have enacted or proposed legislation that regulates the collection, use, and sale of personal information, and such regimes might not be compatible with the GDPR, the CCPA or the CPRA or may require us to undertake additional practices.

Accordingly, we cannot yet predict the impact of the CCPA, CRPA or other evolving privacy and data protection obligations on our business or operations, but it may require us to modify our data processing practices and policies and incur substantial costs and expenses in an effort to comply.

The CCPA also creates a private right of action for statutory damages for certain breaches of information.

Additionally, the California Privacy Rights Act (“CPRA”), was approved by voters in the November 3, 2020 election.

The CPRA modified the CCPA significantly, creating obligations relating to consumer data beginning on January 1, 2022, with enforcement authorized as of July 1, 2023.

In addition, other states have enacted or proposed legislation that regulates the collection, use, and sale of personal information, including, for example, Washington's My Health, My Data Act and legislation similar to the CCPA adopted in Virginia, Colorado, Utah, Connecticut, Iowa, Indiana, Montana, Tennessee, Oregon, Florida, Delaware, and Texas.

Aspects of the CCPA, CPRA, and these other new and evolving state laws, as well their interpretation and enforcement, remain uncertain.

We cannot predict the impact of the CCPA, CPRA, or other evolving privacy and data protection obligations on our business or operations, but they may require us to modify our data processing practices and policies and incur substantial costs and expenses in an effort to comply.

The privacy, data protection, and information security laws and regulations we must comply with also are subject to change.

For example, the United Kingdom enacted a Data Protection Act in May 2018 that substantially implements the GDPR, but the United Kingdom's exit from the European Union, commonly referred to as “Brexit,”

could lead to further legislative and regulatory changes.

For example, the United Kingdom has enacted a Data Protection Act, and has implemented legislation referred to as the “UK GDPR,” that substantially implement the GDPR in the United Kingdom following the United Kingdom’s exit from the European Union.

This legislation provides for substantial penalties for noncompliance of up to the greater of £17.5 million or four percent of the previous year’s annual revenues.

While the European Union has deemed the United Kingdom an “adequate country” to which personal data could be exported from the European Economic Area (“EEA”), this decision is required to be renewed after four years of being in effect and may be modified, revoked, or challenged in the interim, creating uncertainty regarding transfers of personal data to the United Kingdom from the EEA.

It remains unclear how United Kingdom data protection laws or regulations will develop in the medium to longer term and how data transfers to and from the United Kingdom will be regulated.

Additionally, we have joined the EU-U.S.

Privacy Shield Framework and a related program, the Swiss-U.S.

Privacy Shield Framework, and adopted certain standard contractual clauses approved by the European Commission (“SCCs”) as part of our data processing agreements with regard to certain transfers of personal data from the European Economic Area (“EEA”) to the U.S.

to ensure that we work with vendors that have adopted the same, where appropriate.

While both the EU-U.S.

Privacy Shield Framework and SCCs have been subject to legal challenge, we continue to analyze the July 2020 “Schrems II”

decision by the Court of Justice of the European Union (“CJEU”) and its impact on our data transfer mechanisms as well as subsequent guidance from data privacy regulators and new SCCs published by the European Commission in June 2021, and we may find it necessary or appropriate to take different or additional steps with respect to transfers of personal data, which may result in increased costs of compliance and limitations on our customers and us. We may be unsuccessful in maintaining legitimate means for our transfer and receipt of personal data from the EEA or Switzerland.

We may experience reluctance or refusal by current or prospective European customers to use our products, and we and our customers may face a risk of enforcement actions by data protection authorities in the EEA relating to personal data transfers to us and by us from the EEA.

Additionally, we have self-certified under the EU-U.S.

Data Privacy Framework and a related program, the Swiss-U.S.

Data Privacy Framework, and have adopted certain standard contractual clauses approved by the European Commission (“SCCs”) as part of our data processing agreements with regard to certain transfers of personal data from the EEA to the U.S.

Both the EU-U.S.

Data Privacy Framework and SCCs have, however, been subject to legal challenge.

In its July 16, 2020 opinion, the CJEU imposed additional obligations on companies when relying on SCCs to transfer personal data.

The European Commission has published revised SCCs addressing the CJEU concerns on June 4, 2021, that are required to be implemented.

The United Kingdom has adopted new standard contractual clauses (“UK SCCs”), that became effective as of March 21, 2022, and which also are required to be implemented.

Data Privacy Framework, Swiss-U.S.

Data Privacy Framework revised SCCs and UK SCCs, guidance and opinions of regulators, and other developments relating to cross-border data transfer may require us to implement additional contractual and technical safeguards for any personal data transferred out of Europe, which may increase compliance costs, lead to increased regulatory scrutiny or liability, and which may adversely impact our business, financial condition and operating results.

We may be unsuccessful in maintaining legitimate means for our transfer and receipt of personal data from the EEA or Switzerland.

We may experience reluctance or refusal by current or prospective European customers to use our products, and we and our customers may face a risk of enforcement actions by data protection authorities in the EEA relating to personal data transfers to us and by us from the EEA.

Any such enforcement actions could result in substantial costs and diversion of resources, distract management and technical personnel and negatively affect our business, operating results and financial condition.

6 unchanged sentences

Privacy concerns, whether valid or not valid, may inhibit market adoption of our solutions particularly in certain industries and foreign countries.

We use AI/machine learning technologies in our solutions that could result in harm to our business and operating results.

We have incorporated and may continue to incorporate additional AI/machine learning solutions and features into our solutions, and these solutions and features may become more important to our operations or to our future growth over time.

We expect to rely on AI/machine learning solutions and features to help drive future growth in our business, but there can be no assurance that we will realize the desired or anticipated benefits from AI/machine learning or at all.

We may also fail to properly implement or market our AI/machine learning solutions and features.

Our competitors or other third parties may incorporate AI/machine learning into their products, offerings, and solutions more quickly or more successfully than us, which could impair our ability to compete effectively and adversely affect our results of operations.

Additionally, our offerings based on AI/machine learning may expose us to additional claims, demands and proceedings by private parties and regulatory authorities and subject us to legal liability as well as brand and reputational harm.

The legal, regulatory, and policy environments around AI/machine learning are evolving rapidly, and we may become subject to new and evolving legal and other obligations.

These and other developments may require us to make significant changes to our use of AI/machine learning, including by limiting or restricting our use of AI/machine learning, and which may require us to make significant changes to our policies and practices, which may necessitate expenditure of significant time, expense, and other resources, AI/machine learning also presents emerging ethical issues that could harm our reputation and business if our use of AI/machine learning becomes controversial.

Our solutions contain third-party open source software components, and our failure to comply with the terms of the underlying open source software licenses could restrict our ability to sell our solutions.

Our solutions contain software licensed to us by third-parties under so-called “open source”

licenses, including the GNU General Public License, the GNU Lesser General Public License, the BSD License, the Apache License and others.

From time to time, there have been claims against companies that distribute or use open source software in their products and services, asserting that such open source software infringes the claimants’

intellectual property rights.

Our solutions contain software licensed to us by third-parties under so-called “open source” licenses, including the GNU General Public License, the GNU Lesser General Public License, the BSD License, the Apache License and others.

We could be subject to suits by parties claiming that what we believe to be licensed open source software infringes their intellectual property rights.

8 unchanged sentences

courts, and there is a risk that these licenses could be construed in a way that could impose unanticipated conditions or restrictions on our ability to commercialize our solutions.

In this event, we could be required to seek licenses from third parties to continue offering our solutions, to make our proprietary code generally available in source code form, to re-engineer our solutions or to discontinue the sale of our solutions if re-engineering could not be accomplished on a timely basis, any of which could adversely affect our business, operating results and financial condition.

In this event, we could be required to seek

licenses from third parties to continue offering our solutions, to make our proprietary code generally available in source code form, to re-engineer our solutions or to discontinue the sale of our solutions if re-engineering could not be accomplished on a timely basis, any of which could adversely affect our business, operating results and financial condition.

We use third-party software and data that may be difficult to replace or cause errors or failures of our solutions that could lead to lost customers or harm to our reputation and our operating results.

34 unchanged sentences

An adverse outcome of a dispute may require us to:

pay substantial damages, including treble damages, if we are found to have willfully infringed a third party’s patents or copyrights;

• pay substantial damages, including treble damages, if we are found to have willfully infringed a third party’s patents or copyrights;

• cease making, licensing or using solutions that are alleged to infringe or misappropriate the intellectual property of others;

13 unchanged sentences

Compliance with applicable regulatory requirements regarding the export of our solutions, including with respect to new releases of our solutions, may create delays in the introduction of our solutions in international markets, prevent our customers with international operations from deploying our solutions throughout their globally-distributed systems or, in some cases, prevent the export of our solutions to some countries altogether.

In addition, various countries regulate the import of our appliance-based solutions and have enacted laws that could limit our ability to distribute solutions or could limit our customers’

ability to implement our solutions in those countries.

In addition, various countries regulate the import of our appliance-based solutions and have enacted laws that could limit our ability to distribute solutions or could limit our customers’ ability to implement our solutions in those countries.

Any new export or import restrictions, new legislation or shifting approaches in the enforcement or scope of existing regulations, or in the countries, persons or technologies targeted by such regulations, could result in decreased use of our solutions by existing customers with international operations, declining adoption of our solutions by new customers with international operations and decreased revenues.

6 unchanged sentences

A successful assertion that we should be collecting additional sales or other taxes on our services in jurisdictions where we have not historically done so and do not accrue for sales taxes could result in substantial tax liabilities for past sales, discourage customers from purchasing our solutions or otherwise harm our business and operating results.

Changes in our income tax provision or adverse outcomes resulting from examination of our income tax returns could adversely affect our operating results.

Changes in our income tax provision or adverse outcomes resulting from examination of our income tax returns could adversely affect our operating results.

We could be subject to additional taxes.

We are subject to income taxes in the United States and various foreign jurisdictions, and our domestic and international tax liabilities are subject to the allocation of expenses in differing jurisdictions.

Our tax rate is affected by changes in the mix of earnings and losses in countries with differing statutory tax rates, certain non-deductible expenses and excess tax benefits arising from stock-based compensation, other tax benefits and credits, and the valuation of deferred tax assets and liabilities. Increases in our effective tax rate could harm our operating results.

Additionally, significant judgment is required in evaluating our tax positions and our worldwide tax provisions.

Our tax rate is affected by changes in the mix of earnings and losses in countries with differing statutory tax rates, certain non-deductible expenses, excess tax benefits arising from stock-based compensation, other tax benefits and credits, and the valuation of deferred tax assets and liabilities.

Increases in our effective tax rate could harm our operating results.

Additionally, significant judgment is required in evaluating our tax positions and our worldwide tax provisions.

During the ordinary course of business, there are many activities and transactions for which the ultimate tax determination is uncertain.

In addition, our tax obligations and effective tax rates could be adversely affected by changes in the relevant tax, accounting and other laws, regulations, principles and interpretations, including those relating to income tax nexus, by recognizing tax losses or lower than anticipated earnings in jurisdictions where we have lower statutory rates and higher than anticipated earnings in jurisdictions where we have higher statutory rates, by changes in foreign currency exchange rates, or by changes in the valuation of our deferred tax assets and liabilities.

The United States introduced a new 1% excise tax on share repurchases occurring on or after January 1, 2023 as part of the Inflation Reduction Act. The amount of share repurchases subject to the excise tax will be reduced by the fair market value of any shares issued during the taxable year. We do not expect this provision to have a material impact to our results of operations.

The Tax Cuts and Jobs Act of 2017 introduced a Base Erosion and Anti-Abuse Tax which imposes a minimum tax on adjusted income of corporations with average applicable gross receipt of at least $500 million for prior three tax years and that make certain payments to related foreign persons.

While these rules do not impact our results of operations in the current year, these could impact our financial results in future periods.

The Organization for Economic Cooperation and Development has issued model rules in connection with the Base Erosion and Profit Shifting integrated framework that determine multi-jurisdictional taxing rights (Pillar One) and the minimum rate of tax applicable to certain types of income (Pillar Two).

Many countries have enacted legislation to apply the Pillar Two directive for tax years beginning in January 2024, which generally provides for a minimum effective tax rate of 15% on the income arising in each jurisdiction where the Company operates.

We do not anticipate these rules to have an impact on our current year’s financial results.

If applicable in the future, these could have an impact on our financial results, the extent of which is currently uncertain.

We may be audited in various jurisdictions, and such jurisdictions may assess additional taxes, sales taxes and value-added taxes against us.

8 unchanged sentences

• variations in our operating results, or the operating results of our competitors;

changes in our financial guidance or securities analysts’ estimates of our financial performance;

• changes in our financial guidance or securities analysts’ estimates of our financial performance;

• changes in accounting principles;

8 unchanged sentences

We may become involved in this type of litigation in the future.

Any securities litigation claims brought against us could result in substantial expenses and the diversion of our management’s attention from our business.

Our actual operating results may differ significantly from our guidance.

11 unchanged sentences

In light of the foregoing, investors are urged not to rely upon our guidance in making an investment decision regarding our common stock.

Any failure to successfully implement our operating strategy or the occurrence of any of the events or circumstances set forth in this “Risk Factors”

section in this Annual Report on Form 10-K could result in our actual operating results being different from our guidance, and the differences may be adverse and material.

Any failure to successfully implement our operating strategy or the occurrence of any of the events or circumstances set forth in this “Risk Factors” section in this Annual Report on Form 10-K could result in our actual operating results being different from our guidance, and the differences may be adverse and material.

Future sales of shares by existing stockholders could cause our stock price to decline.

The market price of shares of our common stock could decline as a result of substantial sales of our common stock, particularly sales by our directors, executive officers, employees and significant stockholders, a large number of shares of our common stock becoming available for sale, or the perception in the market that holders of a large number of shares intend to sell their shares.

As of December 31, 2022,  we had approximately 37 .4  million shares of our common stock outstanding.

In addition, as of December 31, 2022, 

there were approximately 1.8 

million options and 1.1 million restricted stock units 

As of December 31, 2023, we had approximately 36.9 million shares of our common stock outstanding.

In addition, as of December 31, 2023, there were approximately 1.4 million options and 1.1 million restricted stock units outstanding.

If such options are exercised and restricted stock units are released, these additional shares will become available for sale.

As of December 31, 2022, 

we had an aggregate of 2.4 million shares of our common stock reserved for future issuance under our Restated 2012 Equity Incentive Plan and 0.6 million shares reserved for future purchase under our 2021 Employee Stock Purchase Plan, which can be freely sold in the public market upon issuance.

As of December 31, 2023 , we had an aggregate of 1.8 million shares of our common stock reserved for future issuance under our Restated 2012 Equity Incentive Plan and 0.5 million shares reserved for future purchase under our 2021 Employee Stock Purchase Plan, which can be freely sold in the public market upon issuance.

If a large number of these shares are sold in the public market, the sales could reduce the trading price of our common stock.

We cannot guarantee that our share repurchase program will be fully consummated or that it will enhance stockholder value, and any share repurchases we make could affect the price of our common stock.

On February 12, 2018, we announced that our board of directors had authorized a $100.0 million repurchase program.

On each of October 30, 2018, October 30, 2019, May 7, 2020, February 10, 2021 and February 9, 2023, we announced that our board of directors had authorized an increase of $100.0 million, and on each of November 3, 2021 and May 4, 2022, we announced that our board of directors had authorized an increase of $200.0 million to the share repurchase program, resulting in an aggregate authorization of $1.0 billion to date ($900.0 million as of December 31, 2022). Although our board of directors authorized the share repurchase program, we are not obligated to repurchase any specific dollar amount or to acquire any specific number of shares.

The share repurchase program could affect the price of our common stock, increase volatility and diminish our cash reserves.

We cannot guarantee that our share repurchase program will be fully consummated or that it will enhance stockholder value, and any share repurchases we make could affect the price of our common stock.

On February 12, 2018, we announced that our board of directors had authorized a $100.0 million repurchase program.

On February 7, 2024 we announced that our board of directors had authorized an increase of $200.0 million to the share repurchase program, resulting in an aggregate authorization of $1.2 billion to date ($1.0 billion as of December 31, 2023) .

Although our board of directors authorized the share repurchase program, we are not obligated to repurchase any specific dollar amount or to acquire any specific number of shares.

The share repurchase program could affect the price of our common stock, increase volatility and diminish our cash reserves.

In addition, it may be suspended or terminated at any time, which may result in a decrease in the price of our common stock.

Finally, our share repurchases in 2023 will be subject to a new 1% excise tax introduced in the Inflation Reduction Act.

The amount of share repurchases subject to the excise tax will be reduced by the fair market value of any shares issues during the taxable year.

We do not expect this provision to have a material impact to our results of operations.

During the year ended December 31 , 2022, w e repurchased  2.5 mil lion shares of our common stock for approximately $317.3 million.

As of December 31, 2022, approximately $154.5 million remained available for share repurchases pursuant to our share repurchase program.

Finally, our share repurchases in 2023 were subject to a new 1% excise tax introduced in the Inflation Reduction Act.

The amount of share repurchases subject to the excise tax are reduced by the fair market value of any shares issued during the taxable year.

This provision does not currently, nor do we expect it to in the future, have a material impact to our results of operations.

During the year ended December 31, 2023, w e repurchased 1.3 million shares of our common stock for approximatel y $170.8 million.

As of December 31, 2023 , approximately $83.7 million remained available for share repurchases pursuant to our share repurchase program.

We do not intend to pay dividends on our common stock and therefore any returns will be limited to the value of our stock.

5 unchanged sentences

These provisions include:

authorizing “blank check” preferred stock, which could be issued by our board of directors without stockholder approval and may contain voting, liquidation, dividend and other rights superior to our common stock, which would increase the number of outstanding shares and could thwart a takeover attempt;

• authorizing “blank check” preferred stock, which could be issued by our board of directors without stockholder approval and may contain voting, liquidation, dividend and other rights superior to our common stock, which would increase the number of outstanding shares and could thwart a takeover attempt;

• a classified board of directors whose members can only be dismissed for cause;

15 unchanged sentences

We plan to continue to invest in our infrastructure, new solutions, research and development and sales and marketing, and as a result, we cannot assure you that we will maintain profitability.

We may incur losses in the future for a number of reasons, including without limitation, the other risks and uncertainties described in this Annual Report on Form 10-K.

We may incur losses in the future for a number of reasons, including without limitation, the other risks and uncertainties described in this Annual Report on Form 10-K.

Additionally, we may encounter unforeseen operating expenses, difficulties, complications, delays and other unknown factors that may result in losses in future periods.

9 unchanged sentences

GAAP requires management to make estimates and assumptions that affect the amounts reported in the consolidated financial statements and accompanying notes.

the results of which form the basis for making judgments about the carrying values of assets, liabilities, equity, revenues and expenses that are not readily apparent from other sources.

We base our estimates on historical experience and on various other assumptions that we believe to be reasonable under the circumstances, as provided in the section titled “Part II, Item 7 - Management’s Discussion and Analysis of Financial Condition and Results of Operations,” the results of which form the basis for making judgments about the carrying values of assets, liabilities, equity, revenues and expenses that are not readily apparent from other sources.

Our operating results may be adversely affected if our assumptions change or if actual circumstances differ from those in our assumptions, which could cause our operating results to fall below the expectations of securities analysts and investors, resulting in a decline in our stock price.

Significant assumptions and estimates used in preparing our consolidated financial statements include those related to revenue recognition, accounting for income taxes and stock-based compensation.

Significant assumptions and estimates used in preparing our consolidated financial statements include those related to revenue recognition, accounting for income taxes and stock-based compensation.

Changes in financial accounting standards may cause adverse and unexpected revenue fluctuations and impact our reported results of operations.

We prepare our financial statements in accordance with U.S.

These principles are subject to interpretation by the SEC and various bodies formed to interpret and create appropriate accounting principles.

These principles are subject to interpretation by the SEC and various bodies formed to interpret and create appropriate accounting principles.

A change in these accounting standards or practices could harm our operating results and could have a significant effect on our reporting of transactions and reported results and may even retroactively affect previously reported transactions.

8 unchanged sentences

Any failure to maintain effective internal control over financial reporting also could adversely affect the results of periodic management evaluations regarding the effectiveness of our internal control over financial reporting that we are required to include in our periodic reports we file with the SEC under Section 404 of the Sarbanes-Oxley Act.

While we were able to assert in our Annual Report on Form 10-K that our internal control over financial reporting was effective as of December 31, 2022, we cannot predict the outcome of our testing in future periods.

While we were able to assert in our Annual Report on Form 10-K that our internal control over financial reporting was effective as of December 31, 2023 , we cannot predict the outcome of our testing in future periods.

If we are unable to assert in any future reporting period that our internal control over financial reporting is effective (or if our independent registered public accounting firm is unable to express an opinion on the effectiveness of our internal controls), investors may lose confidence in our operating results and our stock price could decline.

In addition, if we are unable to continue to meet these requirements, we may not be able to remain listed on the NASDAQ Stock Market.

Unresolved Staff Comments

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors