What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2026-02-20 compared with 2025-02-21 · 71 added, 58 removed, 549 unchanged (19% of the section changed)

20 unchanged sentences

• general economic conditions, both domestically and in the foreign markets in which we sell our solutions;

• the imposition of tariffs and other non-tariff trade barriers;

• changes in foreign currency exchange rates;

23 unchanged sentences

The IT, security and compliance market is characterized by rapid technological advances, customer price sensitivity, short product and service life cycles, intense competition, changes in customer requirements, frequent new product introductions and enhancements and evolving industry standards and regulatory mandates.

Any of these factors could create downward pressure on

pricing and gross margins, and could adversely affect our renewal rates, as well as our ability to attract new customers.

Any of these factors could create downward pressure on pricing and gross margins, and could adversely affect our renewal rates, as well as our ability to attract new customers.

Our future success will depend on our ability to enhance existing solutions, introduce new solutions on a timely and cost-effective basis, meet changing customer needs, extend our core technology into new applications, and anticipate and respond to emerging standards and business models.

24 unchanged sentences

We offer our cloud platform and integrated suite of solutions pursuant to a software-as-a-service model, and our customers purchase subscriptions from us that are generally one year in length.

Our customers have no obligation to renew their subscriptions

after their subscription period expires, and they may not renew their subscriptions at the same or higher levels or at all.

Our customers have no obligation to renew their subscriptions after their subscription period expires, and they may not renew their subscriptions at the same or higher levels or at all.

As a result, our ability to grow depends in part on customers renewing their existing subscriptions and purchasing additional subscriptions and solutions.

9 unchanged sentences

Our platform, products, website and internal systems may be subject to intentional disruption or other security incidents that could result in liability and adversely impact our reputation and future sales.

We and our service providers face threats from a variety of sources, including attacks on our networks and systems from numerous sources, including but not limited to traditional “hackers,” sophisticated nation-state and nation-state supported actors, other sources of malicious code (such as viruses and worms), ransomware, social engineering, denial of service attacks, and phishing attempts.

We and our service providers could be a target of cyber-attacks or other malfeasance designed to impede the performance of our solutions, penetrate our network security or the security of our cloud platform, products, or our internal systems, misappropriate proprietary information, gain access to our customers' systems and data, and/or cause interruptions to our services.

We and our service providers have experienced and may continue to experience security incidents and attacks of varying degrees from time to time.

We and our service providers and suppliers face threats from a variety of sources, including attacks on our networks and systems from numerous sources, including but not limited to traditional “hackers,” sophisticated nation-state and nation-state supported actors, other sources of malicious code (such as viruses and worms), ransomware, social engineering, denial of service attacks, and phishing attempts.

We and our service providers and suppliers could be a target of cyber-attacks or other malfeasance designed to impede the performance of our solutions, penetrate our network security or the security of our cloud platform, products, or our internal systems, misappropriate proprietary information, gain access to our customers' systems and data, and/or cause interruptions to our services.

We and our service providers and suppliers have experienced and may continue to experience security incidents and attacks of varying degrees from time to time.

We have incurred costs to respond to such incidents and may continue to incur costs to support our efforts to enhance our security measures.

Additionally, due to political uncertainty and military actions in parts of Eastern Europe and the Middle East, we and our service providers are vulnerable to heightened risks of cybersecurity incidents and security and privacy breaches and incidents caused or initiated by nation-state or affiliated actors, including attacks that could materially disrupt our systems, operations and services, or impact our customers systems, operations, and services.

Our solutions, platforms, and system, and those of our service providers, may be, and have in the past been, subject to security incidents as a result of technical and non-technical issues, including as a result of intentional or inadvertent acts or omissions by our employees or service providers.

With the increase in personnel working remotely, at least part-time in our case, we and our service providers are at increased risk for security breaches and incidents.

Additionally, due to political uncertainty and military actions in parts of Eastern Europe and the Middle East, we and our service providers and suppliers are vulnerable to heightened risks of cybersecurity incidents and security and privacy breaches and incidents caused or initiated by nation-state or affiliated actors, including attacks that could materially disrupt our systems, operations and services, or impact our customers systems, operations, and services.

Our solutions, platforms, and system, and those of our service providers and suppliers, may be, and have in the past been, subject to security incidents as a result of technical and non-technical issues, including as a result of intentional or inadvertent acts or omissions by our employees or service providers.

With the level of personnel working remotely, at least part-time in our case, we and our service providers and suppliers are at increased risk for security breaches and incidents.

We have taken and intend to continue to take steps to monitor and enhance the security of our solutions, cloud platform, and other relevant systems, IT infrastructure, networks, and data;

however, the unprecedented scale of remote work may require additional personnel and resources, which nevertheless cannot be guaranteed to fully safeguard our solutions, our cloud platform, or any systems, IT infrastructure networks, or data upon which we rely.

however, the scale of remote work may require additional personnel and resources, which nevertheless cannot be guaranteed to fully safeguard our solutions, our cloud platform, or any systems, IT infrastructure networks, or data upon which we rely.

Further, because our operations involve providing IT security solutions to our customers, we may be, and have in the past been, targeted for cyber-attacks and other security incidents.

We also have incorporated AI/machine learning technologies into our technology, and may continue to incorporate additional AI/machine learning technologies in the future.

Our use of such technologies may create additional cybersecurity risks or increase cybersecurity risks, including risks of technical error, security breaches and incidents.

Our use of such technologies may create additional cybersecurity risks or increase cybersecurity risks, including risks of technical error, security breaches and other incidents.

Further, AI/machine learning technologies may be used in connection with certain cybersecurity attacks, resulting in heightened risks of security breaches and incidents.

A breach in or incident impacting our data security, an attack against our service availability, or any breach, incident, or attack impacting our third-party service providers, or a technical error or outage, could impact our networks or networks secured by our solutions, creating system disruptions or slowdowns and exploiting security vulnerabilities of our solutions, and the information stored on our networks or those of our third-party service providers could be accessed, used, disclosed publicly or to

unauthorized persons, altered, lost, destroyed, or stolen, which could subject us to liability and cause us financial harm.

If an actual or perceived disruption in the availability of our solutions or the breach or other compromise of our security measures or those of our service providers occurs, it could adversely affect the market perception of our solutions, result in a loss of competitive advantage, have a negative impact on our reputation, or result in the loss of customers, channel partners and sales, and it may expose us to the loss, unavailability or alteration of information, claims, demands and litigation, regulatory investigations, actions and other proceedings and possible liability.

A breach in or incident impacting our data security, an attack against our service availability, or any breach, incident, or attack impacting our third-party service providers and suppliers, or a technical error or outage, could impact our networks or networks secured by our solutions, creating system disruptions or slowdowns and exploiting security vulnerabilities of our solutions, and the information stored on our networks or those of our third-party service providers could be accessed, used, disclosed publicly or to unauthorized persons, altered, lost, destroyed, or stolen, which could subject us to liability and cause us financial harm.

Any such actual or perceived security breach or incident or disruption could also divert the efforts of our technical and management personnel.

14 unchanged sentences

Our business depends to a significant extent on the overall demand for IT and on the economic health of our current and prospective customers.

Economic weakness, customer financial difficulties, change in interest rates, inflationary pressures and potential for a recession, and constrained spending on IT security, as well as longer sales cycles, which factors we have experienced in 2023 and 2024, have resulted and may in the future result in decreased revenue and earnings.

In addition, continued governmental budgetary challenges in the United States and Europe, inflationary pressures and potential for a recession, and geopolitical turmoil in many parts of the world, including the ongoing military conflicts in parts of Eastern Europe and the Middle East, and other disruptions to global and regional economies and markets in many parts of the world, as well as uncertainties related to changes in public policies such as domestic and international regulations, taxes or international trade agreements, have and may continue to put pressure on global economic conditions and overall spending on IT security and may further increase inflation, both in the U.S.

Economic weakness, customer financial difficulties, change in interest rates, inflationary pressures and potential for a recession, economic and regulatory uncertainty, and constrained spending on IT security, as well as longer sales cycles, which factors we have experienced since 2023, have resulted and may in the future result in decreased revenue and earnings.

In addition, continued governmental budgetary challenges in the United States and Europe, inflationary pressures and potential for a recession, and geopolitical turmoil in many parts of the world, including the ongoing military conflicts in parts of Eastern Europe and the Middle East, and other disruptions to global and regional economies and markets in many parts of the world, as well as uncertainties related to changes in public policies such as domestic and international regulations, taxes, tariffs and non-tariff trade barriers, or international trade agreements, have and may continue to put pressure on global economic conditions and overall spending on IT security and may further increase inflation, both in the U.S.

and globally, which could increase our operating costs in the future and reduce overall spending on IT security.

For example, uncertainty as to the impact of the imposition of tariffs on certain countries by the current U.S.

administration, as well as any potential retaliatory measures by impacted trade partners, could adversely impact trade relations, result in higher costs, and thereby decrease the purchasing power of our customers.

General economic weakness may also lead to longer collection cycles for payments due from our customers, an increase in customer bad debt, restructuring initiatives and associated expenses, and impairment of investments.

5 unchanged sentences

These facilities are vulnerable to damage or interruption from earthquakes, hurricanes, floods, fires, cybersecurity attacks, terrorist attacks, employee negligence, power losses, technical errors, telecommunications failures and similar events.

The facilities also could be subjec t to break-ins, sabotage, intentional acts of vandalism and other misconduct.

The occurrence of a natural disaster, an act of terrorism or misconduct, a decision to close the facilities without adequate notice or other unanticipated problems could result in interruptions in our services.

The facilities also could be subjec t to break-ins, sabotage, acts of war, intentional acts of vandalism and other misconduct.

The occurrence of a natural disaster, an act of war, an act of terrorism or misconduct, a decision to close the facilities without adequate notice or other unanticipated problems could result in interruptions in our services.

Some of our shared cloud platforms are not currently redundant and we may not be able to rapidly move our customers from one shared cloud platform to another, which may increase delays in the restoration of our service for our customers if an adverse event occurs.

9 unchanged sentences

We face significant competition for each of our solutions from companies with broad product suites and greater name recognition and resources than we have, as well as from small companies focused on specialized security solutions.

We compete with large and small public companies, such as CrowdStrike, Palo Alto Networks, Rapid7, and Tenable Holdings, as well as privately held security providers including Invicti, Tanium, and Wiz.

We also seek to replace IT, security and compliance solutions that organizations have developed internally.

As we continue to extend our cloud platform’s functionality by further developing IT, security and compliance solutions, such as Cybersecurity Asset Management and Patch Management, we expect to face additional competition in these new markets.

As we continue to extend our cloud platform’s functionality by further developing IT, security and compliance solutions, such as Cybersecurity Asset Management, Patch Management, and Enterprise TruRisk Management, we expect to face additional competition in these new markets.

Our competitors may also attempt to further expand their presence in the IT, security and compliance market and compete more directly against one or more of our solutions.

18 unchanged sentences

In addition, current or potential competitors may be acquired by third parties with greater available resources.

As a result of such relationships and acquisitions, our current or potential competitors might be able to adapt more quickly to new technologies and customer needs, devote greater resources to the promotion or sale of their products and services, initiate or withstand substantial price competition, take advantage of other opportunities more readily or develop and expand their product and service offerings more quickly than we do.

As a result of such relationships and acquisitions, our current or potential competitors might be able to adapt more quickly to new technologies and customer needs,

devote greater resources to the promotion or sale of their products and services, initiate or withstand substantial price competition, take advantage of other opportunities more readily or develop and expand their product and service offerings more quickly than we do.

For all of these reasons, we may not be able to compete successfully against our current or future competitors.

24 unchanged sentences

Competition for highly skilled personnel is frequently intense and we may not be able to compete for these employees.

If we are unable to recruit and retain a sufficient number of productive sales personnel, sales of our solutions and the growth of our business may be harmed.

If we are unable to recruit and retain a sufficient number of

productive sales personnel, sales of our solutions and the growth of our business may be harmed.

Additionally, if our efforts do not result in increased revenues, our operating results could be negatively impacted due to the upfront operating expenses associated with expanding our sales force.

We rely on third-party channel partners to generate a substantial amount of our revenues, and if we fail to effectively manage our distribution channels, our revenues could decline and our growth prospects could suffer.

Our success significantly depends to a significant extent on establishing and maintaining relationships with a variety of channel partners and we anticipate that we will continue to depend on these partners in order to grow our business.

Our success depends to a significant extent on establishing and maintaining relationships with a variety of channel partners and we anticipate that we will continue to depend on these partners in order to grow our business.

For the years ended December 31, 2025, 2024 and 2023 , we derived approximately 49%, 46% and 43% of our revenues from sales of subscriptions for our solutions through channel partners, and the percentage of revenues derived from channel partners may increase in future periods.

51 unchanged sentences

The exchange rate between the U.S.

dollar and foreign currencies has fluctuated substantially in recent

years and may continue to fluctuate substantially in the future.

dollar and foreign currencies has fluctuated substantially in recent years and may continue to fluctuate substantially in the future.

We expect that a majority of our revenues will continue to be generated in U.S.

32 unchanged sentences

Selling to government entities can be highly competitive, expensive and time-consuming, often requiring significant upfront time and expense without any assurance that we will win a sale.

Furthermore, government certification requirements applicable to our platform, including FedRAMP, may change and, in doing so, restrict our ability to sell into the governmental sector until we have attained the full or revised certification.

Governmental entities may also have statutory, contractual or other legal rights to terminate contracts with us or our partners for convenience or for other reasons.

We have invested in the creation of a cloud offering certified under the Federal Information Security Management Act for government usage but we cannot be sure that we will continue to sustain or renew this certification, that the government will continue to mandate such certification or that other government agencies or entities will use this cloud offering.

We have obtained authorization under FedRAMP, which facilitates our entry into the U.S.

federal government market.

Such certification is subject to rigorous compliance and if we lose our certification, it could inhibit or preclude our ability to contract with certain U.S.

federal government customers.

In addition, some customers may rely on our authorization under FedRAMP to help satisfy their own legal and regulatory compliance requirements and our failure to maintain FedRAMP authorization might result in a breach under public

sector contracts obtained on the basis of such authorization.

This could subject us to liability, result in reputational harm, and adversely impact our financial condition or operating results.

Government demand and payment for our solutions may be impacted by public sector budgetary cycles and funding authorizations, with funding reductions or delays adversely affecting public sector demand for our solutions.

4 unchanged sentences

In order to remain competitive, we have in the past and may in the future seek to acquire additional businesses, products, services or technologies.

For example, we acquired certain assets of Blue Hexagon on October 4, 2022.

The environment for acquisitions in our industry is very competitive and acquisition candidate purchase prices may exceed what we would prefer to pay.

8 unchanged sentences

For example, many of our customers subscribe to our IT, security and compliance solutions to help them comply with the security standards developed and maintained by the Payment Card Industry Security Standards Council, or the PCI Council, which apply to companies that store cardholder data.

Industry organizations like the PCI Council may significantly change their security standards with little or no notice, including changes that could make their standards more or less

onerous for businesses.

Industry organizations like the PCI Council may significantly change their security standards with little or no notice, including changes that could make their standards more or less onerous for businesses.

Governments may also adopt new laws or regulations, or make changes to existing laws or regulations, which could impact the demand for or value of our solutions.

32 unchanged sentences

In addition, war, acts of terrorism, pandemics or other health emergencies, or responses to these events could cause disruptions in our business or the business of our business partners, customers or the economy as a whole.

All of the aforementioned risks may be exacerbated if the disaster recovery plans for us and our suppliers prove to be inadequate.

To the extent that any of the above results in delays of customer subscriptions or commercialization of our solutions, our business, financial condition and results of operations could be adversely affected.

All of the aforementioned risks may be exacerbated if the disaster recovery plans for us and our service providers and suppliers prove to be inadequate.

To the extent that any of the above

results in delays of customer subscriptions or commercialization of our solutions, our business, financial condition and results of operations could be adversely affected.

Risks Related to Intellectual Property, Legal, Tax and Regulatory Matters

11 unchanged sentences

Additionally, the data that our solutions collect to help secure and protect the IT infrastructure of our customers may include additional personal or confidential information of our customers’ employees and their customers, and we may collect, store and otherwise process personal or confidential information more generally in connection with our business and operations.

Privacy, data protection, and cybersecurity have become significant issues in the United States and in many other countries where we offer our solutions.

The regulatory framework for privacy issues worldwide is currently evolving and is likely to remain uncertain for the foreseeable future.

Privacy, data protection, and cybersecurity have become significant issues and the subject of extensive regulation in the United States and in many other countries where we offer our solutions.

The regulatory frameworks for these matters worldwide are evolving and are likely to remain uncertain for the foreseeable future.

Many federal, state and foreign government bodies and agencies have adopted or are considering adopting laws and regulations regarding the collection, use, disclosure, retention, transfer, and other processing of personal information.

1 unchanged sentence

Internationally, virtually every jurisdiction in which we operate has established its own data security and privacy legal framework with which we or our customers must comply.

These privacy, data protection and information security laws and regulations may result in ever-increasing regulatory and public scrutiny and escalating levels of enforcement and sanctions.

These privacy, data protection, and cybersecurity laws and regulations may result in ever-increasing regulatory and public scrutiny and escalating levels of enforcement and sanctions.

Additionally, new laws and regulations relating to privacy and data protection continue to be proposed and enacted.

For example, the European Union's General Data Protection Regulation (“GDPR”), which took effect in May of 2018, provides for substantial obligations relating to the handling, storage, and other processing of data relating to individuals and administrative fines for violations, which can be up to the greater of four percent of the previous year’s annual revenue or €20 million.

Additionally, Europe’s Network and Information System Directive (“NIS2”) and its implementing laws regulate cybersecurity risk-management and incident response capabilities of entities operating in a number of sectors.

Non-compliance with NIS2 may lead to administrative fines of a maximum of €10 million or up to 2% of the total worldwide revenue of the preceding fiscal year.

Similarly, the California Consumer Privacy Act (“CCPA”) requires covered companies to, among other things, provide certain disclosures to California consumers and affords such consumers rights to opt-out of certain sales of personal information.

7 unchanged sentences

The privacy, data protection, and cybersecurity laws and regulations we must comply with also are subject to change.

For example, the United Kingdom has enacted a Data Protection Act, and has implemented legislation referred to as the “UK GDPR,” which substantially implement the GDPR in the United Kingdom following the United Kingdom’s exit from the European Union.

This legislation provides for substantial penalties for noncompliance of up to the greater of £17.5 million or four percent of the previous year’s annual revenues.

While the European Union has deemed the United Kingdom an “adequate country” to which personal data could be exported from the European Economic Area (“EEA”), this decision is required to be renewed after four years of being in effect and may be modified, revoked, or challenged in the interim, creating uncertainty regarding transfers of personal data to the United Kingdom from the EEA.

For example, the United Kingdom has enacted a Data Protection Act, and has implemented legislation referred to as the “UK GDPR,” which substantially implement the GDPR in the United Kingdom.

This legislation, which was modified in the Data (Use and Access) Bill, which received Royal Assent on June 19, 2025, provides for substantial penalties for noncompliance of up to the greater of £17.5 million or four percent of the previous year’s annual revenues.

While the European Union has deemed the United Kingdom an "adequate country" to which personal data could be exported from the European Economic Area (“EEA”), this decision is subject to renewal and may be modified, revoked, or challenged, creating uncertainty regarding transfers of personal data to the United Kingdom from the EEA.

It remains unclear how United Kingdom data protection laws or regulations will develop in the medium to longer term and how data transfers to and from the United Kingdom will be regulated.

9 unchanged sentences

Data Privacy Framework, Swiss-U.S.

Framework, United Kingdom extension to the EU-U.S.

Data Privacy Framework, United Kingdom extension to the EU-U.S.

Data Privacy Framework, revised SCCs and UK SCCs, guidance and opinions of regulators, and other developments relating to cross-border data transfer may require us to implement additional contractual and technical safeguards for any personal data transferred out of Europe, which may increase compliance costs, lead to increased regulatory scrutiny or liability, and which may adversely impact our business, financial condition and operating results.

3 unchanged sentences

Some countries also are considering or have passed legislation requiring local storage and processing of data, or similar requirements, which could increase the cost and complexity of delivering our services.

Further, the European Union’s Data Act (the “Data Act”) became applicable on September 12, 2025.

Compliance with the Data Act may require us to adjust contract terms with customers and develop technical measures for data portability.

These changes may impact the duration of customer relationships and result in additional compliance and operational costs, which may affect our business.

In addition to laws and regulations, privacy advocacy and industry groups or other private parties may propose new and different standards relating to privacy, data protection, and cybersecurity that apply, or are alleged to apply, to us.

Because the interpretation and application of privacy and data protection laws, regulations, standards and contractual obligations relating to these matters are uncertain, it is possible that they may be interpreted and applied in a manner that is, or perceived to be, inconsistent with our data management practices or the features of our solutions.

The interpretation and application of laws, regulations, standards and contractual obligations relating to these matters are uncertain, and it is possible that they may be interpreted and applied in a manner that is, or perceived to be, inconsistent with our data management practices or the features of our solutions.

If so, in addition to the possibility of regulatory investigations and enforcement actions or other proceedings, fines, lawsuits and other claims, other forms of injunctive or operations-limiting relief, and damage to our reputations and loss of goodwill, we could be required to fundamentally change our business activities and practices or modify our solutions and may face limitations in our ability to develop new solutions and features, any of which could have an adverse effect on our business.

Any inability to adequately address concerns relating to privacy, data protection, or cybersecurity, even if unfounded, or any actual or perceived inability to comply with applicable privacy or data protection laws, regulations and privacy standards relating to these matters, could result in cost and liability to us, damage our reputation, inhibit sales of subscriptions and harm our business.

Furthermore, the costs of compliance with, and other burdens imposed by, the laws, regulations, and privacy standards that are applicable to the businesses of our customers may limit the use and adoption of, and reduce the overall demand for, our solutions.

Any inability to adequately address concerns relating to privacy, data protection, or cybersecurity, even if unfounded, or any actual or perceived inability to comply with applicable laws, regulations, standards, or other obligations relating to these matters, could result in cost and liability to us, damage our reputation, inhibit sales of subscriptions and harm our business.

Furthermore, the costs of compliance with, and other burdens imposed by, the laws, regulations, and standards relating to privacy, data protection, or cybersecurity that are applicable to the businesses of our customers may limit the use and adoption of, and reduce the overall demand for, our solutions.

Privacy and data protection concerns, whether valid or not valid, may inhibit market adoption of our solutions particularly in certain industries and foreign countries.

11 unchanged sentences

We could be subject to suits by parties claiming that what we believe to be licensed open source software infringes their intellectual property rights.

Use and distribution of open source software may entail greater risks than use of third-party commercial software, as open source licensors generally do not

provide warranties or other contractual protections regarding infringement claims or the quality of the code.

Use and distribution of open source software may entail greater risks than use of third-party commercial software, as open source licensors generally do not provide warranties or other contractual protections regarding infringement claims or the quality of the code.

In addition, certain open source licenses require that source code for software programs that are subject to the license be made available to the public and that any modifications or derivative works to such open source software continue to be licensed under the same terms.

4 unchanged sentences

Any of these events could have a material adverse effect on our business, operating results and financial condition.

Although we monitor our use of open source software in an effort both to comply with the terms of the applicable open source licenses and to avoid subjecting our solutions to conditions we do not intend, the terms of many open source licenses have not been interpreted by U.S.

not been interpreted by U.S.

courts, and there is a risk that these licenses could be construed in a way that could impose unanticipated conditions or restrictions on our ability to commercialize our solutions.

48 unchanged sentences

We incorporate encryption technology into certain of our solutions.

These encryption solutions and the underlying technology may be exported only with the required export authorizations, including by

license, a license exception or other appropriate government authorizations.

These encryption solutions and the underlying technology may be exported only with the required export authorizations, including by license, a license exception or other appropriate government authorizations.

export controls may require submission of an encryption registration, product classification and/or annual or semi-annual reports.

8 unchanged sentences

It is possible that we could face sales tax audits and that our liability for these taxes could exceed our estimates as tax authorities could still assert that we are obligated to collect additional amounts as taxes from our customers and remit those taxes to those authorities.

Furthermore, certain jurisdictions, such as the U.K.

and France, have enacted a digital services tax, which is generally a tax on gross revenue generated from users or customers located in those jurisdictions, and other jurisdictions are considering enacting similar laws.

We could also be subject to audits with respect to state and international jurisdictions for which we may not have accrued tax liabilities.

7 unchanged sentences

In addition, our tax obligations and effective tax rates could be adversely affected by changes in the relevant tax, accounting and other laws, regulations, principles and interpretations, including those relating to income tax nexus, by recognizing tax losses or lower than anticipated earnings in jurisdictions where we have lower statutory rates and higher than anticipated earnings in jurisdictions where we have higher statutory rates, by changes in foreign currency exchange rates, or by changes in the valuation of our deferred tax assets and liabilities.

The Tax Cuts and Jobs Act of 2017 (or "TCJA") introduced a Base Erosion and Anti-Abuse Tax which imposes a minimum tax on adjusted income of corporations with average applicable gross receipt of at least $500 million for prior three tax years and that make certain payments to related foreign persons.

The Tax Cuts and Jobs Act of 2017 (“TCJA”) introduced a Base Erosion and Anti-Abuse Tax which imposes a minimum tax on adjusted income of corporations with average applicable gross receipt of at least $500 million for prior three tax years and that make certain payments to related foreign persons.

While these rules do not impact our results of operations in the current year, they could impact our financial results in future periods.

The TCJA introduced provisions to reduce the deduction rates for foreign income in the US beginning 2026 that may increase our effective income tax rate in the future.

The Organization for Economic Cooperation and Development has issued model rules in connection with the Base Erosion and Profit Shifting integrated framework that determine multi-jurisdictional taxing rights (Pillar One) and the minimum rate of tax applicable to certain types of income (Pillar Two).

Many countries have enacted legislation to apply the Pillar Two directive for tax years beginning in January 2024, which generally provides for a minimum effective tax rate of 15% on the income arising in each jurisdiction where the Company operates.

These rules do not impact our current year’s financial results as the Company is below the revenue threshold.

If applicable in the future, these rules could have an impact on our financial results, the extent of which is currently uncertain.

The Organization for Economic Cooperation and Development (OECD) has issued model rules in connection with the Base Erosion and Profit Shifting integrated framework that determine multi-jurisdictional taxing rights (Pillar One) and the minimum rate of tax applicable to certain types of income (Pillar Two).

However, on January 5, 2026, the OECD announced a “side-by-side” elective safe harbor that exempts U.S.

multinational entities from certain provisions of Pillar Two for fiscal years beginning on or after January 1, 2026.

We may be audited in various jurisdictions, and such jurisdictions may assess additional taxes, including sales taxes and value-added taxes against us.

39 unchanged sentences

If such options are exercised and restricted stock units are released, these additional shares will become available for sale.

As of December 31, 2024 , we had an aggregate of 2.3 million shares of our common stock reserved for future issuance under our Restated 2012 Equity Incentive Plan and 0.4 million shares reserved for future purchase under our 2021 Employee Stock Purchase Plan, which can be freely sold in the public market upon issuance.

As of December 31, 2025 , we had an aggregate of 1.7 million shares of our common stock reserved for future issuance under

our Restated 2012 Equity Incentive Plan and 0.4 million shares reserved for future purchase under our 2021 Employee Stock Purchase Plan, which can be freely sold in the public market upon issuance.

If a large number of these shares are sold in the public market, the sales could reduce the trading price of our common stock.

1 unchanged sentence

On February 12, 2018, we announced that our board of directors had authorized a $100.0 million repurchase program.

On each of October 30, 2018, October 30, 2019, May 7, 2020, February 10, 2021 and February 9, 2023, we announced that our board of directors had authorized an increase of $100.0 million, and on each of November 3, 2021, May 4, 2022 and February 7, 2024, we announced that our board of directors had authorized an increase of $200.0 million to the share repurchase program.

On each of October 30, 2018, October 30, 2019, May 7, 2020, February 10, 2021 and February 9, 2023, we announced that our board of directors had authorized an increase of $100.0 million, and on each of November 3, 2021, May 4, 2022, February 7, 2024, and February 6, 2025, we announced that our board of directors had authorized an increase of $200.0 million to the share repurchase program.

On February 5, 2026 we announced that our board of directors had authorized an increase of $200.0 million to the share repurchase program, resulting in an aggregate authorization of $1.6 billion to date ($1.4 billion as of December 31, 2025).

2 unchanged sentences

In addition, it may be suspended or terminated at any time, which may result in a decrease in the price of our common stock.

Finally, our share repurchases in 2023 and 2024 were subject to the 1% excise tax introduced in the Inflation Reduction Act.

The amount of share repurchases subject to the excise tax are reduced by the fair market value of any shares issued during the taxable year.

This provision does not currently have a material impact to our results of operations.

Finally, our net share repurchases are subject to the 1% excise tax introduced in the Inflation Reduction Act, which could increase the cost to us of share repurchases.

During the year ended December 31, 2025, we repurchased 1.4 million shares of our common stock for approximately $182.9 million.

53 unchanged sentences

Any failure to maintain effective internal control over financial reporting also could adversely affect the results of periodic management evaluations regarding the effectiveness of our internal control over financial reporting that we are required to include in our periodic reports we file with the SEC under Section 404 of the Sarbanes-Oxley Act.

While we are able to assert in our Annual Report on Form 10-K that our internal control over financial reporting was effective as of December 31, 2024 , we cannot predict the outcome of our testing in future periods.

While we were able to assert in our Annual Report on Form 10-K that our internal control over financial reporting was effective as of December 31, 2025 , we cannot predict the outcome of our testing in future periods.

If we are unable to assert in any future reporting period that our internal control over financial reporting is effective (or if our independent registered public accounting firm is unable to express an opinion on the effectiveness of our internal controls), investors may lose confidence in our operating results and our stock price could decline.

1 unchanged sentence

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors