What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2025-02-21 compared with 2024-02-22 · 93 added, 89 removed, 514 unchanged (26% of the section changed)

3 unchanged sentences

In that case, the trading price of our common stock could decline, and you might lose all or part of your investment.

In addition, the risks and

uncertainties discussed below are not the only ones we face.

In addition, the risks and uncertainties discussed below are not the only ones we face.

Our business, operating results, financial performance or prospects could also be harmed by risks and uncertainties not currently known to us or that we currently do not believe are material.

39 unchanged sentences

The IT, security and compliance market is characterized by rapid technological advances, customer price sensitivity, short product and service life cycles, intense competition, changes in customer requirements, frequent new product introductions and enhancements and evolving industry standards and regulatory mandates.

Any of these factors could create downward pressure on pricing and gross margins, and could adversely affect our renewal rates, as well as our ability to attract new customers.

Any of these factors could create downward pressure on

pricing and gross margins, and could adversely affect our renewal rates, as well as our ability to attract new customers.

Our future success will depend on our ability to enhance existing solutions, introduce new solutions on a timely and cost-effective basis, meet changing customer needs, extend our core technology into new applications, and anticipate and respond to emerging standards and business models.

14 unchanged sentences

Furthermore, diversifying our solutions and expanding into new IT, security and compliance markets will require significant investment and planning, require that our research and development and sales and marketing organizations develop expertise in these new markets, bring us more directly into competition with IT, security compliance providers that may be better established or have greater resources than we do, require additional investment of time and resources in the development and training of our channel partners and entail significant risk of failure.

present and future solutions and cause us to lose existing customers or fail to gain new customers, which would significantly harm our business, financial condition and results of operations.

If we fail to anticipate market requirements or fail to develop and introduce solution enhancements or new solutions to satisfy those requirements in a timely manner, such failure could substantially decrease or delay market acceptance and sales of our present and future solutions and cause us to lose existing customers or fail to gain new customers, which would significantly harm our business, financial condition and results of operations.

If we fail to continue to effectively scale and adapt our platform to meet the performance and other requirements of our customers, our operating results and our business would be harmed.

7 unchanged sentences

We offer our cloud platform and integrated suite of solutions pursuant to a software-as-a-service model, and our customers purchase subscriptions from us that are generally one year in length.

Our customers have no obligation to renew their subscriptions after their subscription period expires, and they may not renew their subscriptions at the same or higher levels or at all.

Our customers have no obligation to renew their subscriptions

after their subscription period expires, and they may not renew their subscriptions at the same or higher levels or at all.

As a result, our ability to grow depends in part on customers renewing their existing subscriptions and purchasing additional subscriptions and solutions.

8 unchanged sentences

If we spend significant resources on research and development and are unable to generate an adequate return on our investment, our business and results of operations may be materially and adversely affected.

Our platform, website and internal systems may be subject to intentional disruption or other security incidents that could result in liability and adversely impact our reputation and future sales.

We and our service providers face threats from a variety of sources, including attacks on our networks and systems from numerous sources, including traditional “hackers,” sophisticated nation-state and nation-state supported actors, other sources of malicious code (such as viruses and worms), ransomware, social engineering, denial of service attacks, and phishing attempts.

We and our service providers could be a target of cyber-attacks or other malfeasance designed to impede the performance of our solutions, penetrate our network security or the security of our cloud platform or our internal systems, misappropriate proprietary information and/or cause interruptions to our services.

Our platform, products, website and internal systems may be subject to intentional disruption or other security incidents that could result in liability and adversely impact our reputation and future sales.

We and our service providers face threats from a variety of sources, including attacks on our networks and systems from numerous sources, including but not limited to traditional “hackers,” sophisticated nation-state and nation-state supported actors, other sources of malicious code (such as viruses and worms), ransomware, social engineering, denial of service attacks, and phishing attempts.

We and our service providers could be a target of cyber-attacks or other malfeasance designed to impede the performance of our solutions, penetrate our network security or the security of our cloud platform, products, or our internal systems, misappropriate proprietary information, gain access to our customers' systems and data, and/or cause interruptions to our services.

We and our service providers have experienced and may continue to experience security incidents and attacks of varying degrees from time to time.

We have incurred costs to respond to such incidents and may continue to incur costs to support our efforts to enhance our security measures.

Additionally, due to political uncertainty and military actions in parts of Eastern Europe and the Middle East, we and our service providers are vulnerable to heightened

risks of cybersecurity incidents and security and privacy breaches from or affiliated with nation-state actors, including attacks that could materially disrupt our systems, operations and services.

Our solutions, platforms, and system, and those of our service providers, may also suffer security incidents as a result of non-technical issues, including intentional or inadvertent acts or omissions by our employees or service providers.

With the increase in personnel working remotely, we and our service providers are at increased risk for security breaches and incidents.

Additionally, due to political uncertainty and military actions in parts of Eastern Europe and the Middle East, we and our service providers are vulnerable to heightened risks of cybersecurity incidents and security and privacy breaches and incidents caused or initiated by nation-state or affiliated actors, including attacks that could materially disrupt our systems, operations and services, or impact our customers systems, operations, and services.

Our solutions, platforms, and system, and those of our service providers, may be, and have in the past been, subject to security incidents as a result of technical and non-technical issues, including as a result of intentional or inadvertent acts or omissions by our employees or service providers.

With the increase in personnel working remotely, at least part-time in our case, we and our service providers are at increased risk for security breaches and incidents.

We have taken and intend to continue to take steps to monitor and enhance the security of our solutions, cloud platform, and other relevant systems, IT infrastructure, networks, and data;

however, the unprecedented scale of remote work may require additional personnel and resources, which nevertheless cannot be guaranteed to fully safeguard our solutions, our cloud platform, or any systems, IT infrastructure networks, or data upon which we rely.

Further, because our operations involve providing IT security solutions to our customers, we may be targeted for cyber-attacks and other security incidents.

A breach in or incident impacting our data security, an attack against our service availability, or any breach, incident, or attack impacting our third-party service providers, could impact our networks or networks secured by our solutions, creating system disruptions or slowdowns and exploiting security vulnerabilities of our solutions, and the information stored on our networks or those of our third-party service providers could be accessed, used, publicly disclosed, altered, lost, or stolen, which could subject us to liability and cause us financial harm.

Further, because our operations involve providing IT security solutions to our customers, we may be, and have in the past been, targeted for cyber-attacks and other security incidents.

We also have incorporated AI/machine learning technologies into our technology, and may continue to incorporate additional AI/machine learning technologies in the future.

Our use of such technologies may create additional cybersecurity risks or increase cybersecurity risks, including risks of technical error, security breaches and incidents.

Further, AI/machine learning technologies may be used in connection with certain cybersecurity attacks, resulting in heightened risks of security breaches and incidents.

A breach in or incident impacting our data security, an attack against our service availability, or any breach, incident, or attack impacting our third-party service providers, or a technical error or outage, could impact our networks or networks secured by our solutions, creating system disruptions or slowdowns and exploiting security vulnerabilities of our solutions, and the information stored on our networks or those of our third-party service providers could be accessed, used, disclosed publicly or to

unauthorized persons, altered, lost, destroyed, or stolen, which could subject us to liability and cause us financial harm.

If an actual or perceived disruption in the availability of our solutions or the breach or other compromise of our security measures or those of our service providers occurs, it could adversely affect the market perception of our solutions, result in a loss of competitive advantage, have a negative impact on our reputation, or result in the loss of customers, channel partners and sales, and it may expose us to the loss, unavailability or alteration of information, claims, demands and litigation, regulatory investigations, actions and other proceedings and possible liability.

15 unchanged sentences

Our business depends to a significant extent on the overall demand for IT and on the economic health of our current and prospective customers.

Economic weakness, customer financial difficulties, supply chain constraints, change in interest rates, inflationary pressures and potential for a recession, and constrained spending on IT security, as well as longer sales cycles, which factors we have experienced in 2023, have resulted and may in the future result in decreased revenue and earnings.

Such factors have made and could in the future make it difficult to accurately forecast our sales and operating results and could negatively affect our ability to provide accurate forecasts to our contract manufacturers.

In addition, continued governmental budgetary challenges in the United States and Europe, inflationary pressures and potential for a recession, and geopolitical turmoil in many parts of the

world, including the ongoing military conflicts in parts of Eastern Europe and the Middle East, and other disruptions to global and regional economies and markets in many parts of the world, as well as uncertainties related to changes in public policies such as domestic and international regulations, taxes or international trade agreements, have and may continue to put pressure on global economic conditions and overall spending on IT security and may further increase inflation, both in the U.S.

Economic weakness, customer financial difficulties, change in interest rates, inflationary pressures and potential for a recession, and constrained spending on IT security, as well as longer sales cycles, which factors we have experienced in 2023 and 2024, have resulted and may in the future result in decreased revenue and earnings.

In addition, continued governmental budgetary challenges in the United States and Europe, inflationary pressures and potential for a recession, and geopolitical turmoil in many parts of the world, including the ongoing military conflicts in parts of Eastern Europe and the Middle East, and other disruptions to global and regional economies and markets in many parts of the world, as well as uncertainties related to changes in public policies such as domestic and international regulations, taxes or international trade agreements, have and may continue to put pressure on global economic conditions and overall spending on IT security and may further increase inflation, both in the U.S.

and globally, which could increase our operating costs in the future and reduce overall spending on IT security.

5 unchanged sentences

We currently host substantially all of our solutions from third-party shared cloud platforms located in the United States, Canada, Switzerland, the Netherlands, United Arab Emirates, Australia, United Kingdom, Italy, the Kingdom of Saudi Arabia and India.

These facilities are vulnerable to damage or interruption from earthquakes, hurricanes, floods, fires, cybersecurity attacks, terrorist attacks, employee negligence, power losses, telecommunications failures and similar events.

The facilities also could be subjec t to break-ins, sabotage, intentional acts of vandalism and other misconduct.

11 unchanged sentences

We face significant competition for each of our solutions from companies with broad product suites and greater name recognition and resources than we have, as well as from small companies focused on specialized security solutions.

We compete with large and small public companies, such as Broadcom (Symantec Enterprise Security), CrowdStrike, Palo Alto Networks, Rapid7, Tenable Holdings, as well as privately held security providers including Axonius, Checkmarx, Flexera, Invicti, Ivanti, Tanium, HelpSystems (Tripwire), Trustwave Holdings, Veracode and Wiz.

We compete with large and small public companies, such as CrowdStrike, Palo Alto Networks, Rapid7, and Tenable Holdings, as well as privately held security providers including Invicti, Tanium, and Wiz.

We also seek to replace IT, security and compliance solutions that organizations have developed internally.

27 unchanged sentences

Additionally, although we price our products and subscriptions worldwide in U.S.

Dollars, Euro, British Pounds, Canadian Dollars, Japanese Yen and Indian Rupee, currency fluctuations in certain countries and regions may negatively impact actual prices that partners and customers are willing to pay in those countries and regions, or the effective prices we realize in our reporting currency.

Dollars, Euros, British Pounds, Canadian Dollars, Japanese Yen, Indian Rupees, Australian Dollars and Singapore Dollar, currency fluctuations in certain countries and regions may negatively impact actual prices that partners and customers are willing to pay in those countries and regions, or the effective prices we realize in our reporting currency.

We cannot assure you that we will be successful in developing and introducing new offerings with enhanced functionality on a timely basis, or that our new product and subscription offerings, if introduced, will enable us to maintain our prices and gross profits at levels that will allow us to maintain positive gross margins and profitability.

If our solutions fail to help our customers achieve and maintain compliance with regulations and industry standards, our revenues and operating results could be harmed.

We generate a portion of our revenues from solutions that help organizations achieve and maintain compliance with regulations and industry standards.

For example, many of our customers subscribe to our IT, security and compliance solutions to help them comply with the security standards developed and maintained by the Payment Card Industry Security Standards Council,

or the PCI Council, which apply to companies that store cardholder data.

Industry organizations like the PCI Council may significantly change their security standards with little or no notice, including changes that could make their standards more or less onerous for businesses.

Governments may also adopt new laws or regulations, or make changes to existing laws or regulations, which could impact the demand for or value of our solutions.

If we are unable to adapt our solutions to changing regulatory standards in a timely manner, or if our solutions fail to assist with or expedite our customers’ compliance initiatives, our customers may lose confidence in our solutions and could switch to products offered by our competitors.

In addition, if regulations and standards related to data security, vulnerability management and other IT, security and compliance requirements are relaxed or the penalties for non-compliance are changed in a manner that makes them less onerous, our customers may view government and industry regulatory compliance as less critical to their businesses, and our customers may be less willing to purchase our solutions.

In any of these cases, our revenues and operating results could be harmed.

If our solutions fail to detect vulnerabilities or incorrectly detect vulnerabilities, our brand and reputation could be harmed, which could have an adverse effect on our business and results of operations.

11 unchanged sentences

An actual or perceived security breach or incident or loss, theft, unavailability or other compromise of the sensitive data of one of our customers, regardless of whether the breach is attributable to the failure of our solutions, could adversely affect the market’s perception of our security solutions.

If we are unable to continue the expansion of our sales force, sales of our solutions and the growth of our business would be harmed.

We believe that our growth will depend, to a significant extent, on our success in recruiting and retaining a sufficient number of qualified sales personnel and their ability to obtain new customers, manage our existing customer base and expand the sales of our newer solutions.

We plan to continue to expand our sales force and invest in our sales and marketing activities.

If we are unable to recruit and retain qualified sales personnel, sales of our solutions and the growth of our business would be harmed.

We believe that our growth will depend, to a significant extent, on our success in recruiting and retaining a sufficient number of qualified sales personnel and their ability to, whether directly or indirectly in collaboration with channel partners, obtain new customers, manage our existing customer base and expand the sales of our newer solutions.

We plan to continue to recruit and retain a team of qualified sales personnel and invest in our sales and marketing activities.

Our recent hires and planned hires may not become as productive as quickly as we would like, and we may be unable to hire or retain sufficient numbers of qualified individuals in the future in the competitive markets where we do business.

2 unchanged sentences

Additionally, if our efforts do not result in increased revenues, our operating results could be negatively impacted due to the upfront operating expenses associated with expanding our sales force.

We rely on third-party channel partners to generate a substantial amount of our revenues, and if we fail to expand and manage our distribution channels, our revenues could decline and our growth prospects could suffer.

We rely on third-party channel partners to generate a substantial amount of our revenues, and if we fail to effectively manage our distribution channels, our revenues could decline and our growth prospects could suffer.

Our success significantly depends to a significant extent on establishing and maintaining relationships with a variety of channel partners and we anticipate that we will continue to depend on these partners in order to grow our business.

For the years ended December 31, 2023, 2022 and 2021 , we derived approximately 43%, 42% and 41% o f our revenues from sales of subscriptions for our solutions through channel partners, and the percentage of revenues derived from channel partners may increase in future periods.

For the years ended December 31, 2024, 2023 and 2022 , we derived approximately 46%, 43% and 42% of our revenues from sales of subscriptions for our solutions through channel partners, and the percentage of revenues derived from channel partners may increase in future periods.

Our agreements with our channel partners are generally non-exclusive and do not prohibit them from working with our competitors or offering competing solutions, and many of our channel partners have more established relationships with our competitors.

2 unchanged sentences

Moreover, our ability to expand our distribution channels depends in part on our ability to educate our channel partners about our solutions, which can be complex.

Our failure to recruit additional channel partners, or any reduction or delay in their sales of our solutions or conflicts between channel sales and our direct sales and marketing activities may harm our results of operations.

Our failure to effectively manage our relationship with channel partners, or any reduction or delay in their sales of our solutions or conflicts between channel sales and our direct sales and marketing activities may harm our results of operations.

Even if we are successful, these relationships may not result in greater customer usage of our solutions or increased revenues.

9 unchanged sentences

• trade and foreign exchange restrictions;

• economic or political instability in foreign markets, including as a result of increasing tensions between India and China;

• economic or political instability in foreign markets;

• greater difficulty in enforcing contracts, accounts receivable collection and longer collection periods;

20 unchanged sentences

If we are unable to successfully manage the challenges of international operations, our business and operating results could be adversely affected.

In addition, as of December 31, 2023, approximately 75% of our employees were located outside of the United States, with 66% of our employees located in Pune, India.

In addition, as of December 31, 2024, approximately 77% of our employees were located outside of the United States, with 68% of our employees located in India.

Accordingly, we are exposed to changes in laws governing our employee relationships in various U.S.

6 unchanged sentences

dollar and we generate a majority of our revenues in U.S.

However, for the year ended December 31, 2023, we incurred approximately 29% of our expenses in foreign currencies, primarily Euro, British Pounds, and Indian Rupee, principally with respect to salaries and related personnel expenses associated with our European and Indian operations.

However, for the year ended December 31, 2024, we incurred approximately 29% of our expenses in foreign currencies, primarily the Euro, British Pound, and Indian Rupee, principally with respect to salaries and related personnel expenses associated with our European and Indian operations.

Additionally, for the year ended December 31, 2024, approximately 25% of our revenue s were generated in foreign currencies.

1 unchanged sentence

The exchange rate between the U.S.

dollar and foreign currencies has fluctuated substantially in recent years and may continue to fluctuate substantially in the future.

dollar and foreign currencies has fluctuated substantially in recent

years and may continue to fluctuate substantially in the future.

We expect that a majority of our revenues will continue to be generated in U.S.

6 unchanged sentences

Additionally, our hedging activities may contribute to increased losses as a result of volatility in foreign currency markets.

If the market for cloud solutions for IT, security and compliance does not evolve as we anticipate, our revenues may not grow and our operating results would be harmed.

Our success depends to a significant extent on the willingness of organizations to increase their use of cloud solutions for their IT, security and compliance.

Some organizations may be reluctant to use cloud solutions because they have concerns regarding the risks associated with the reliability or security of the technology delivery model associated with these solutions.

If other cloud service providers experience security incidents, loss of customer data, disruptions in service delivery or other problems, the market for cloud solutions as a whole, including our solutions, may be negatively impacted.

Moreover, organizations that have invested substantial personnel and financial resources to integrate on-premise software into their businesses may be reluctant or unwilling to migrate to a cloud solution.

Organizations that use on-premise security products, such as network firewalls, security information and event management products or data loss prevention solutions, may also believe that these products sufficiently protect their IT infrastructure and deliver adequate security.

Therefore, they may continue spending their IT security budgets on these products and may not adopt our IT, security and compliance solutions in addition to or as a replacement for such products.

If customers do not recognize the benefits of our cloud solutions over traditional on-premise enterprise software products, and as a result we are unable to increase sales of subscriptions to our solutions, then our revenues may not grow or may decline, and our operating results would be harmed.

Our business and operations have continued to grow since inception, and if we do not appropriately manage any future growth, or are unable to improve our systems and processes, our operating results may be negatively affected.

31 unchanged sentences

In order to remain competitive, we have in the past and may in the future seek to acquire additional businesses, products, services or technologies.

For example, we acquired certain intellectual property of TotalCloud on August 19, 2021 and certain assets of Blue Hexagon on October 4, 2022.

For example, we acquired certain assets of Blue Hexagon on October 4, 2022.

The environment for acquisitions in our industry is very competitive and acquisition candidate purchase prices may exceed what we would prefer to pay.

5 unchanged sentences

If we are unable to effectively execute acquisitions, our business, financial condition and operating results could be adversely affected.

If our solutions fail to help our customers achieve and maintain compliance with regulations and industry standards, our revenues and operating results could be harmed.

We generate a portion of our revenues from solutions that help organizations achieve and maintain compliance with regulations and industry standards.

Industry organizations like the PCI Council may significantly change their security standards with little or no notice, including changes that could make their standards more or less

onerous for businesses.

Governments may also adopt new laws or regulations, or make changes to existing laws or regulations, which could impact the demand for or value of our solutions.

In any of these cases, our revenues and operating results could be harmed.

We rely on software-as-a-service vendors to operate certain functions of our business and any failure of such vendors to provide services to us could adversely impact our business and operations.

13 unchanged sentences

Our subscription model also makes it difficult for us to rapidly increase our revenues through additional bookings in any period, as revenues are recognized ratably over the subscription period.

If the market for cloud solutions for IT, security and compliance does not evolve as we anticipate, our revenues may not grow and our operating results would be harmed.

Our success depends to a significant extent on the willingness of organizations to increase their use of cloud solutions for their IT, security and compliance.

If other cloud service providers experience security incidents, loss, unavailability, or unauthorized processing of customer data, disruptions in service delivery or other problems, the market for cloud solutions as a whole, including our solutions, may be negatively impacted.

Therefore, they may continue spending their IT security budgets on these products and may not adopt our IT, security and compliance solutions in addition to or as a replacement for such products.

Our business is subject to the risks of earthquakes, fire, power outages, floods and other catastrophic events, and to interruption by man-made problems such as terrorism.

18 unchanged sentences

Our solutions could be used to collect and store personal information of our customers ’ employees or customers, and therefore privacy and other data handling concerns could result in additional cost and liability to us or inhibit sales of our solutions.

We collect the names and email addresses of our customers in connection with subscriptions to our solutions.

We collect certain personal and confidential information of our customers in connection with subscriptions to our solutions.

Additionally, the data that our solutions collect to help secure and protect the IT infrastructure of our customers may include additional personal or confidential information of our customers’ employees and their customers, and we may collect, store and otherwise process personal or confidential information more generally in connection with our business and operations.

Personal privacy has become a significant issue in the United States and in many other countries where we offer our solutions.

Privacy, data protection, and cybersecurity have become significant issues in the United States and in many other countries where we offer our solutions.

The regulatory framework for privacy issues worldwide is currently evolving and is likely to remain uncertain for the foreseeable future.

Many federal, state and foreign government bodies and agencies have adopted or are considering adopting laws and regulations regarding the collection, use, disclosure and retention of personal information.

In the United States, these include, for example, rules and regulations promulgated under the authority of the Federal Trade Commission, the Health Insurance Portability and Accountability Act of 1996, the Gramm-Leach-Bliley Act, and state breach notification laws.

Many federal, state and foreign government bodies and agencies have adopted or are considering adopting laws and regulations regarding the collection, use, disclosure, retention, transfer, and other processing of personal information.

Internationally, virtually every jurisdiction in which we operate has established its own data security and privacy legal framework with which we or our customers must comply.

1 unchanged sentence

Additionally, new laws and regulations relating to privacy and data protection continue to be proposed and enacted.

For example, the European Union has adopted the Global Data Protection Regulation (“GDPR”).

This regulation, which took effect in May of 2018, provides for substantial obligations relating to the handling, storage and other processing of data relating to individuals and administrative fines for violations, which can be up to four percent of the previous year’s annual revenue or €20 million, whichever is higher.

The GDPR may be subject to new or changing interpretations by courts, and our interpretation of the law and efforts to comply with the rules and regulations of the law may be ruled invalid.

Similarly, the California Consumer Privacy Act (“CCPA”) requires covered companies to, among other things, provide new disclosures to California consumers and affords such consumers new rights to opt-out of certain sales of personal information.

For example, the European Union's General Data Protection Regulation (“GDPR”), which took effect in May of 2018, provides for substantial obligations relating to the handling, storage and other processing of data relating to individuals and administrative fines for violations, which can be up to the greater of four percent of the previous year’s annual revenue or €20 million.

Similarly, the California Consumer Privacy Act (“CCPA”) requires covered companies to, among other things, provide certain disclosures to California consumers and affords such consumers rights to opt-out of certain sales of personal information.

The CCPA also creates a private right of action for statutory damages for certain breaches of information.

1 unchanged sentence

The CPRA modified the CCPA significantly, creating obligations relating to consumer data beginning on January 1, 2022, with enforcement authorized as of July 1, 2023.

In addition, other states have enacted or proposed legislation that regulates the collection, use, and sale of personal information, including, for example, Washington's My Health, My Data Act and legislation similar to the CCPA adopted in Virginia, Colorado, Utah, Connecticut, Iowa, Indiana, Montana, Tennessee, Oregon, Florida, Delaware, and Texas.

Aspects of the CCPA, CPRA, and these other new and evolving state laws, as well their interpretation and enforcement, remain uncertain.

We cannot predict the impact of the CCPA, CPRA, or other evolving privacy and data protection obligations on our business or operations, but they may require us to modify our data processing practices and policies and incur substantial costs and expenses in an effort to comply.

The privacy, data protection, and information security laws and regulations we must comply with also are subject to change.

For example, the United Kingdom has enacted a Data Protection Act, and has implemented legislation referred to as the “UK GDPR,” that substantially implement the GDPR in the United Kingdom following the United Kingdom’s exit from the European Union.

The GDPR, CCPA, and other laws and regulations relating to privacy, data protection, and cybersecurity may be subject to new or changing interpretations by courts, and our interpretation of the law and efforts to comply with the rules and regulations of the law may be ruled invalid.

We cannot predict the impact of the CCPA, CPRA, or other evolving privacy, data protection and cybersecurity obligations on our business or operations, but they may require us to modify our data processing practices and policies and incur substantial costs and expenses in an effort to comply.

The privacy, data protection, and cybersecurity laws and regulations we must comply with also are subject to change.

For example, the United Kingdom has enacted a Data Protection Act, and has implemented legislation referred to as the “UK GDPR,” which substantially implement the GDPR in the United Kingdom following the United Kingdom’s exit from the European Union.

This legislation provides for substantial penalties for noncompliance of up to the greater of £17.5 million or four percent of the previous year’s annual revenues.

2 unchanged sentences

Additionally, we have self-certified under the EU-U.S.

Data Privacy Framework and a related program, the Swiss-U.S.

Data Privacy Framework, the Swiss-U.S.

Data Privacy Framework, and the United Kingdom extension to the EU-U.S.

Data Privacy Framework, and have adopted certain standard contractual clauses approved by the European Commission (“SCCs”) as part of our data processing agreements with regard to certain transfers of personal data from the EEA to the U.S.

5 unchanged sentences

Data Privacy Framework, Swiss-U.S.

Framework, United Kingdom extension to the EU-U.S.

Data Privacy Framework, revised SCCs and UK SCCs, guidance and opinions of regulators, and other developments relating to cross-border data transfer may require us to implement additional contractual and technical safeguards for any personal data transferred out of Europe, which may increase compliance costs, lead to increased regulatory scrutiny or liability, and which may adversely impact our business, financial condition and operating results.

We may be unsuccessful in maintaining legitimate means for our transfer and receipt of personal data from the EEA or Switzerland.

We may experience reluctance or refusal by current or prospective European customers to use our products, and we and our customers may face a risk of enforcement actions by data protection authorities in the EEA relating to personal data transfers to us and by us from the EEA.

Any such enforcement actions could result in substantial costs and diversion of resources, distract management and technical personnel and negatively affect our business, operating results and financial condition.

We may be unsuccessful in maintaining legitimate means for our transfer and receipt of personal data from the EEA, United Kingdom, Switzerland, or other jurisdictions.

We may experience reluctance or refusal by current or prospective customers in these or other jurisdictions to use our products, and we and our customers may face a risk of regulatory enforcement actions or other proceedings relating to personal data transfers to us and by us from the EEA, United Kingdom, and Switzerland.

Any such proceedings could result in substantial costs and diversion of resources, distract management and technical personnel and negatively affect our business, operating results and financial condition.

Some countries also are considering or have passed legislation requiring local storage and processing of data, or similar requirements, which could increase the cost and complexity of delivering our services.

In addition to laws and regulations, privacy advocacy and industry groups or other private parties may propose new and different privacy standards that either legally or contractually apply to us.

Because the interpretation and application of privacy and data protection laws, regulations, standards and contractual obligations are uncertain, it is possible that they may be interpreted and applied in a manner that is, or perceived to be, inconsistent with our data management practices or the features of our solutions.

If so, in addition to the possibility of regulatory investigations and enforcement actions, fines, lawsuits and other claims, other forms of injunctive or operations-limiting relief, and damage to our reputations and loss of goodwill, we could be required to fundamentally change our business activities and practices or modify our solutions and may face limitations in our ability to develop new solutions and features, any of which could have an adverse effect on our business.

Any inability to adequately address privacy concerns, even if unfounded, or any actual or perceived inability to comply with applicable privacy or data protection laws, regulations and privacy standards, could result in cost and liability to us, damage our reputation, inhibit sales of subscriptions and harm our business.

In addition to laws and regulations, privacy advocacy and industry groups or other private parties may propose new and different standards relating to privacy, data protection, and cybersecurity that apply, or are alleged to apply, to us.

Because the interpretation and application of privacy and data protection laws, regulations, standards and contractual obligations relating to these matters are uncertain, it is possible that they may be interpreted and applied in a manner that is, or perceived to be, inconsistent with our data management practices or the features of our solutions.

If so, in addition to the possibility of regulatory investigations and enforcement actions or other proceedings, fines, lawsuits and other claims, other forms of injunctive or operations-limiting relief, and damage to our reputations and loss of goodwill, we could be required to fundamentally change our business activities and practices or modify our solutions and may face limitations in our ability to develop new solutions and features, any of which could have an adverse effect on our business.

Any inability to adequately address concerns relating to privacy, data protection, or cybersecurity, even if unfounded, or any actual or perceived inability to comply with applicable privacy or data protection laws, regulations and privacy standards relating to these matters, could result in cost and liability to us, damage our reputation, inhibit sales of subscriptions and harm our business.

Furthermore, the costs of compliance with, and other burdens imposed by, the laws, regulations, and privacy standards that are applicable to the businesses of our customers may limit the use and adoption of, and reduce the overall demand for, our solutions.

Privacy concerns, whether valid or not valid, may inhibit market adoption of our solutions particularly in certain industries and foreign countries.

Privacy and data protection concerns, whether valid or not valid, may inhibit market adoption of our solutions particularly in certain industries and foreign countries.

We use AI/machine learning technologies in our solutions that could result in harm to our business and operating results.

4 unchanged sentences

Additionally, our offerings based on AI/machine learning may expose us to additional claims, demands and proceedings by private parties and regulatory authorities and subject us to legal liability as well as brand and reputational harm.

The legal, regulatory, and policy environments around AI/machine learning are evolving rapidly, and we may become subject to new and evolving legal and other obligations.

The legal, regulatory, and policy environments around AI/machine learning are evolving rapidly, including the European Union's enactment of its Artificial Intelligence Act and legislative efforts in various other jurisdictions, and we may become subject to new and evolving legal and other obligations.

These and other developments may require us to make significant changes to our use of AI/machine learning, including by limiting or restricting our use of AI/machine learning, and which may require us to make significant changes to our policies and practices, which may necessitate expenditure of significant time, expense, and other resources, AI/machine learning also presents emerging ethical issues that could harm our reputation and business if our use of AI/machine learning becomes controversial.

3 unchanged sentences

We could be subject to suits by parties claiming that what we believe to be licensed open source software infringes their intellectual property rights.

Use and distribution of open source software may entail greater risks than use of third-party commercial software, as open source licensors generally do not provide warranties or other contractual protections regarding infringement claims or the quality of the code.

Use and distribution of open source software may entail greater risks than use of third-party commercial software, as open source licensors generally do not

provide warranties or other contractual protections regarding infringement claims or the quality of the code.

In addition, certain open source licenses require that source code for software programs that are subject to the license be made available to the public and that any modifications or derivative works to such open source software continue to be licensed under the same terms.

6 unchanged sentences

courts, and there is a risk that these licenses could be construed in a way that could impose unanticipated conditions or restrictions on our ability to commercialize our solutions.

In this event, we could be required to seek

licenses from third parties to continue offering our solutions, to make our proprietary code generally available in source code form, to re-engineer our solutions or to discontinue the sale of our solutions if re-engineering could not be accomplished on a timely basis, any of which could adversely affect our business, operating results and financial condition.

In this event, we could be required to seek licenses from third parties to continue offering our solutions, to make our proprietary code generally available in source code form, to re-engineer our solutions or to discontinue the sale of our solutions if re-engineering could not be accomplished on a timely basis, any of which could adversely affect our business, operating results and financial condition.

We use third-party software and data that may be difficult to replace or cause errors or failures of our solutions that could lead to lost customers or harm to our reputation and our operating results.

46 unchanged sentences

We incorporate encryption technology into certain of our solutions.

These encryption solutions and the underlying technology may be exported only with the required export authorizations, including by license, a license exception or other appropriate government authorizations.

These encryption solutions and the underlying technology may be exported only with the required export authorizations, including by

license, a license exception or other appropriate government authorizations.

export controls may require submission of an encryption registration, product classification and/or annual or semi-annual reports.

10 unchanged sentences

A successful assertion that we should be collecting additional sales or other taxes on our services in jurisdictions where we have not historically done so and do not accrue for sales taxes could result in substantial tax liabilities for past sales, discourage customers from purchasing our solutions or otherwise harm our business and operating results.

Changes in our income tax provision or adverse outcomes resulting from examination of our income tax returns could adversely affect our operating results.

We could be subject to additional taxes.

Changes in our income tax provision or adverse outcomes resulting from examination of our income tax returns could adversely affect our operating results, in which case we could be subject to additional taxes.

We are subject to income taxes in the United States and various foreign jurisdictions, and our domestic and international tax liabilities are subject to the allocation of expenses in differing jurisdictions.

4 unchanged sentences

In addition, our tax obligations and effective tax rates could be adversely affected by changes in the relevant tax, accounting and other laws, regulations, principles and interpretations, including those relating to income tax nexus, by recognizing tax losses or lower than anticipated earnings in jurisdictions where we have lower statutory rates and higher than anticipated earnings in jurisdictions where we have higher statutory rates, by changes in foreign currency exchange rates, or by changes in the valuation of our deferred tax assets and liabilities.

The Tax Cuts and Jobs Act of 2017 introduced a Base Erosion and Anti-Abuse Tax which imposes a minimum tax on adjusted income of corporations with average applicable gross receipt of at least $500 million for prior three tax years and that make certain payments to related foreign persons.

While these rules do not impact our results of operations in the current year, these could impact our financial results in future periods.

The Tax Cuts and Jobs Act of 2017 (or "TCJA") introduced a Base Erosion and Anti-Abuse Tax which imposes a minimum tax on adjusted income of corporations with average applicable gross receipt of at least $500 million for prior three tax years and that make certain payments to related foreign persons.

While these rules do not impact our results of operations in the current year, they could impact our financial results in future periods.

The TCJA introduced provisions to reduce the deduction rates for foreign income in the US beginning 2026 that may increase our effective income tax rate in the future.

The Organization for Economic Cooperation and Development has issued model rules in connection with the Base Erosion and Profit Shifting integrated framework that determine multi-jurisdictional taxing rights (Pillar One) and the minimum rate of tax applicable to certain types of income (Pillar Two).

Many countries have enacted legislation to apply the Pillar Two directive for tax years beginning in January 2024, which generally provides for a minimum effective tax rate of 15% on the income arising in each jurisdiction where the Company operates.

We do not anticipate these rules to have an impact on our current year’s financial results.

If applicable in the future, these could have an impact on our financial results, the extent of which is currently uncertain.

We may be audited in various jurisdictions, and such jurisdictions may assess additional taxes, sales taxes and value-added taxes against us.

These rules do not impact our current year’s financial results as the Company is below the revenue threshold.

If applicable in the future, these rules could have an impact on our financial results, the extent of which is currently uncertain.

We may be audited in various jurisdictions, and such jurisdictions may assess additional taxes, including sales taxes and value-added taxes against us.

Although we believe our tax estimates are reasonable, the final determination of any tax audits or litigation could be materially different from our historical tax provisions and accruals, which could have a material adverse effect on our operating results or cash flows in the period or periods for which a determination is made.

42 unchanged sentences

On February 12, 2018, we announced that our board of directors had authorized a $100.0 million repurchase program.

On each of October 30, 2018, October 30, 2019, May 7, 2020, February 10, 2021 and February 9, 2023, we announced that our board of directors had authorized an increase of $100.0 million, and on each of November 3, 2021 and May 4, 2022, we announced that our board of directors had authorized an increase of $200.0 million to the share repurchase program.

On each of October 30, 2018, October 30, 2019, May 7, 2020, February 10, 2021 and February 9, 2023, we announced that our board of directors had authorized an increase of $100.0 million, and on each of November 3, 2021, May 4, 2022 and February 7, 2024, we announced that our board of directors had authorized an increase of $200.0 million to the share repurchase program.

On February 6, 2025 we announced that our board of directors had authorized an increase of $200.0 million to the share repurchase program, resulting in an aggregate authorization of $1.4 billion to date ($1.2 billion as of December 31, 2024).

2 unchanged sentences

In addition, it may be suspended or terminated at any time, which may result in a decrease in the price of our common stock.

Finally, our share repurchases in 2023 were subject to a new 1% excise tax introduced in the Inflation Reduction Act.

Finally, our share repurchases in 2023 and 2024 were subject to the 1% excise tax introduced in the Inflation Reduction Act.

The amount of share repurchases subject to the excise tax are reduced by the fair market value of any shares issued during the taxable year.

This provision does not currently, nor do we expect it to in the future, have a material impact to our results of operations.

During the year ended December 31, 2023, w e repurchased 1.3 million shares of our common stock for approximatel y $170.8 million.

As of December 31, 2023 , approximately $83.7 million remained available for share repurchases pursuant to our share repurchase program.

This provision does not currently have a material impact to our results of operations.

During the year ended December 31, 2024, we repurchased 1.0 million shares of our common stock for approximately $140.3 million.

As of December 31, 2024, approximately $143.4 million remained available for share repurchases pursuant to our share repurchase program (excluding the $200.0 million increase to our share repurchase program announced on February 6, 2025).

We do not intend to pay dividends on our common stock and therefore any returns will be limited to the value of our stock.

51 unchanged sentences

Any failure to maintain effective internal control over financial reporting also could adversely affect the results of periodic management evaluations regarding the effectiveness of our internal control over financial reporting that we are required to include in our periodic reports we file with the SEC under Section 404 of the Sarbanes-Oxley Act.

While we were able to assert in our Annual Report on Form 10-K that our internal control over financial reporting was effective as of December 31, 2023 , we cannot predict the outcome of our testing in future periods.

While we are able to assert in our Annual Report on Form 10-K that our internal control over financial reporting was effective as of December 31, 2024 , we cannot predict the outcome of our testing in future periods.

If we are unable to assert in any future reporting period that our internal control over financial reporting is effective (or if our independent registered public accounting firm is unable to express an opinion on the effectiveness of our internal controls), investors may lose confidence in our operating results and our stock price could decline.

1 unchanged sentence

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors