What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2022-02-22 compared with 2021-02-22 · 65 added, 76 removed, 548 unchanged (20% of the section changed)

9 unchanged sentences

On March 11, 2020, the World Health Organization characterized COVID-19 as a pandemic.

The spread of COVID-19 has resulted in authorities imposing, and businesses and individuals implementing, numerous unprecedented measures to try to contain the virus, such as travel bans and restrictions, quarantines, shelter-in-place/stay-at-home and social distancing orders, and shutdowns.

The continued spread of COVID-19 and the resurgence of infection rates in certain regions has resulted in authorities imposing, and businesses and individuals implementing, numerous unprecedented measures to try to contain the virus, such as travel bans and restrictions, quarantines, shelter-in-place/stay-at-home and social distancing orders, and shutdowns.

These measures have impacted and may further impact our workforce and operations, the operations of our customers, and those of our respective vendors, suppliers, and partners.

The pandemic has significantly increased economic and demand uncertainty.

It is likely that the current outbreak and continued spread of COVID-19 will cause an economic slowdown, and it is possible that it could cause a global recession, which could decrease demand for our solutions and negatively impact our operating results.

The pandemic has significantly increased economic and demand uncertainty and disrupted the global supply chain.

It is possible that the pandemic could cause an economic slowdown or a global recession, which could decrease demand for our solutions and negatively impact our operating results.

There is a significant degree of uncertainty and lack of visibility as to the extent and duration of any such slowdown or recession.

The ultimate extent of the impact of COVID-19 on our business, financial position, results of operations and cash flows will depend on future developments, which are highly uncertain and cannot be predicted at this time, including but not limited to, the duration of the pandemic, its severity, the actions to contain the virus or treat its impact, future spikes of COVID-19 infections resulting in additional preventative measures to contain or mitigate the spread of the virus, the effectiveness, distribution and acceptance of COVID-19 vaccines, including the vaccines’

efficacy against emerging COVID-19 variants, and how quickly and to what extent normal economic and operating conditions can resume.

These impacts, individually or in the aggregate, could have a material and adverse effect on our business, financial position, results of operations and cash flows.

28 unchanged sentences

our ability to integrate any products or services that we may acquire in the future into our product suite or migrate existing customers of any companies that we may acquire in the future to our products and services;

our effective tax rate;

the amount and timing of income tax benefits that we recognize resulting from excess tax benefits related to stock-based compensation;

our effective tax rate, changes in tax rules, tax effects of infrequent or unusual transactions, and tax audit settlements;

the amount and timing of income tax that we recognize resulting from stock-based compensation;

the timing of expenses related to the development or acquisition of technologies, services or businesses;

1 unchanged sentence

Further, the interpretation and application of international laws and regulations in many cases is uncertain, and our legal and regulatory obligations in foreign jurisdictions are subject to frequent and unexpected changes, including the potential for various regulatory or other governmental bodies to enact new or additional laws or regulations or to issue rulings that invalidate prior laws or regulations.

For example, a Data Protection Act that substantially implements the European Union’s General Data Protection Regulation (GDPR) was implemented in the United Kingdom in May 2018, and "Brexit" could also lead to further legislative and regulatory changes.

It is unclear, however, how United Kingdom data protection laws or regulations will develop in the medium to longer term, and how data transfers to and from the United Kingdom will be regulated.

Each factor above or discussed elsewhere in this Annual Report on Form 10-K or the cumulative effect of some of these factors may result in fluctuations in our operating results.

54 unchanged sentences

We and our service providers face threats from a variety of sources, including attacks on our networks and systems from numerous sources, including traditional “hackers,”

sophisticated nation-state and nation-state supported actors, other sources of malicious code (such as viruses and worms), and phishing attempts.

sophisticated nation-state and nation-state supported actors, other sources of malicious code (such as viruses and worms), ransomware, social engineering, denial of service attacks, and phishing attempts.

We and our service providers could be a target of cyber-attacks or other malfeasance designed to impede the performance of our solutions, penetrate our network security or the security of our cloud platform or our internal systems, misappropriate proprietary information and/or cause interruptions to our services. We and our service providers have experienced and may continue to experience security incidents and attacks of varying degrees from time to time.

For example, in December 2020, we were notified by a service provider, Accellion, of a zero-day vulnerability affecting an Accellion FTA server that we deployed to transfer information as part of our customer support system.

In response to this incident, we engaged third-party forensic experts to investigate and determined that attackers illegally obtained certain information from the Accellion FTA server.

We notified affected customers, as we deemed was required or appropriate.

We have incurred costs to respond to this incident and may continue to incur costs to support our efforts to enhance our security measures.

Our solutions, platforms, and system, and those of our service providers, may also suffer security incidents as a result of non-technical issues, including intentional or inadvertent acts or omissions by our employees or service providers. With the increase in personnel working remotely during the current COVID-19 pandemic, we and our service providers are at increased risk for security breaches.

We are taking steps to monitor and enhance the security of our solutions, cloud platform, and other relevant systems, IT infrastructure, networks, and data;

We have taken and intend to continue to take steps to monitor and enhance the security of our solutions, cloud platform, and other relevant systems, IT infrastructure, networks, and data;

however, the unprecedented scale of remote work may require additional personnel and resources, which nevertheless cannot be guaranteed to fully safeguard our solutions, our cloud platform, or any systems, IT infrastructure networks, or data upon which we rely.

Further, because our operations involve providing IT security solutions to our customers, we may be targeted for cyber-attacks and other security incidents.

A breach in our data security or an attack against our service availability, or that of our third-party service providers, could impact our networks or networks secured by our solutions, creating system disruptions or slowdowns and exploiting security vulnerabilities of our solutions, and the information stored on our networks or those of our third-party service providers could be accessed, publicly disclosed, altered, lost, or stolen, which could subject us to liability and cause us financial harm.

A breach in our data security or an attack against our service availability, or that of our third-party service providers, could impact our networks or networks secured by our solutions, creating system disruptions or slowdowns and exploiting security vulnerabilities of our solutions, and the information stored on our networks or those of our third-party service providers could be accessed, used, publicly disclosed, altered, lost, or stolen, which could subject us to liability and cause us financial harm.

If an actual or perceived disruption in the availability of our solutions or the breach of our security measures or those of our service providers occurs, it could adversely affect the market perception of our solutions, result in a loss of competitive advantage, have a negative impact on our reputation, or result in the loss of customers, channel partners and sales, and it may expose us to the loss or alteration of information, litigation, regulatory actions and investigations and possible liability.

19 unchanged sentences

Furthermore, the continued weakness and uncertainty in worldwide credit markets, including the sovereign debt situation in certain countries in the European Union, may adversely impact our customers' available budgetary spending, which could lead to delays in planned purchases of our solutions.

Additionally, concerns regarding the effects of the "Brexit" decision, uncertainties related to changes in public policies such as domestic and international regulations, taxes or international trade agreements as well as geopolitical turmoil and other disruptions to global and regional economies and markets in many parts of the world, have and may continue to put pressure on global economic conditions and overall spending on IT security.

Additionally, uncertainties related to changes in public policies such as domestic and international regulations, taxes or international trade agreements as well as geopolitical turmoil and other disruptions to global and regional economies and markets in many parts of the world, have and may continue to put pressure on global economic conditions and overall spending on IT security.

We have operations, as well as current and potential customers, throughout most of Europe.

2 unchanged sentences

Future or continued economic weakness for us or our customers, failure of our customers and markets to recover from such weakness, customer financial difficulties, and reductions in spending on IT security could have a material adverse effect on demand for our platform and consequently on our business, financial condition and results of operations.

Our IT, security and compliance solutions are delivered from eight data centers, and any disruption of service at these facilities would interrupt or delay our ability to deliver our solutions to our customers which could reduce our revenues and harm our operating results.

We currently host substantially all of our solutions from third-party data centers located in the United States, Canada, Switzerland, the Netherlands, United Arab Emirates and India.

Our IT, security and compliance solutions are delivered from eleven shared cloud platforms, and any disruption of service at these facilities would interrupt or delay our ability to deliver our solutions to our customers which could reduce our revenues and harm our operating results.

We currently host substantially all of our solutions from third-party shared cloud platforms in the United States, Canada, Switzerland, the Netherlands, United Arab Emirates, Australia, United Kingdom and India.

These facilities are vulnerable to damage or interruption from earthquakes, hurricanes, floods, fires, cybersecurity attacks, terrorist attacks, employee negligence, power losses, telecommunications failures and similar events.

1 unchanged sentence

The occurrence of a natural disaster, an act of terrorism or misconduct, a decision to close the facilities without adequate notice or other unanticipated problems could result in interruptions in our services.

Some of our data centers are not currently redundant and we may not be able to rapidly move our customers from one data center to another, which may increase delays in the restoration of our service for our customers if an adverse event occurs.

We have added data center facilities to provide additional capacity for our cloud platform and to enable disaster recovery.

Some of our shared cloud platforms are not currently redundant and we may not be able to rapidly move our customers from one shared cloud platform to another, which may increase delays in the restoration of our service for our customers if an adverse event occurs.

We have added shared cloud platforms to provide additional capacity and to enable disaster recovery.

We continue to build out these facilities;

however, these additional facilities may not be operational in the anticipated time-frame and we may incur unplanned expenses.

Additionally, our existing data center facilities providers have no obligations to renew their agreements with us on commercially reasonable terms, or at all.

If we are unable to renew our agreements with the facilities providers on commercially reasonable terms or if in the future we add additional data center facility providers, we may experience costs or downtime in connection with the loss of an existing facility or the transfer to, or addition of, new data center facilities.

Additionally, our existing shared cloud platform providers have no obligations to renew their agreements with us on commercially reasonable terms, or at all.

If we are unable to renew our agreements with the facilities providers on commercially reasonable terms or if in the future we add additional shared cloud platform providers, we may experience costs or downtime in connection with the loss of an existing facility, or the transfer to, or addition of, new facilities.

Any disruptions or other performance problems with our solutions could harm our reputation and business and may damage our customers’

3 unchanged sentences

We face significant competition for each of our solutions from companies with broad product suites and greater name recognition and resources than we have, as well as from small companies focused on specialized security solutions.

We compete with large and small public companies, such as Belden (Tripwire), Broadcom (Symantec Enterprise Security), CrowdStrike, F5 Networks, FireEye, International Business Machines, McAfee, Micro Focus International, Palo Alto Networks, Rapid7, Tenable Holdings and VMware, as well as privately held security providers including Barracuda Networks, BeyondTrust Software, Flexera, Forescout Technologies, Imperva, SentinelOne, Tanium, Trustwave Holdings, Venafi, and Veracode.

We compete with large and small public companies, such as Belden (Tripwire), Broadcom (Symantec Enterprise Security), CrowdStrike, Palo Alto Networks, Rapid7, and Tenable Holdings, as well as privately held security providers including Axonius, Checkmarx, Flexera, Ivanti, Netsparker, Tanium, Trustwave Holdings and Veracode.

We also seek to replace IT, security and compliance solutions that organizations have developed internally.

17 unchanged sentences

These competitors may also offer their products at a lower price as part of this larger sale, which could increase pricing pressure on our solutions and cause the average sales price for our solutions to decline.

These larger competitors are also often in a better position to withstand any significant reduction in capital spending, and will therefore not be as susceptible to economic downturns.

These larger competitors are also often in a better position to withstand any significant reduction in capital spending and will therefore not be as susceptible to economic downturns.

Furthermore, our current and potential competitors may establish cooperative relationships among themselves or with third parties that may further enhance their resources and product and services offerings in the markets we address.

29 unchanged sentences

To the extent current or potential customers, channel partners, or others believe there has been an occurrence of an actual or perceived failure of our solutions to detect a vulnerability or otherwise to function as effectively as competitive products in any particular test, or indicates our solutions do not provide significant value, our business, competitive position, and reputation could be harmed.

In addition, our solutions do not currently extend to cover mobile devices or personal devices that employees may bring into an organization.

As such, our solutions would not identify or address vulnerabilities in mobile devices, such as mobile phones or tablets, or personal devices, and our customers’

In addition, our solutions do not currently extend to cover all mobile and personal devices that employees may bring into an organization.

As such, our solutions would not identify or address vulnerabilities in all mobile and personal devices, and our customers’

IT infrastructures may be compromised by attacks that infiltrate their networks through such devices.

47 unchanged sentences

If we are unable to successfully manage the challenges of international operations, our business and operating results could be adversely affected.

In addition, as of

December 31, 2020

, approximately 73% of our employees were located outside of the United States, of which 63% of our employees were located in Pune, India.

Accordingly, we are exposed to changes in laws governing our employee relationships in various U.S.

In addition, as of December 31, 2021 , approximately 75% of our employees were located outside of the United States, with 67% of our employees located in Pune, India. Accordingly, we are exposed to changes in laws governing our employee relationships in various U.S.

and foreign jurisdictions, including laws and regulations regarding wage and hour requirements, fair labor standards, employee data privacy, unemployment tax rates, workers’

6 unchanged sentences

dollar and we generate a majority of our revenues in U.S.

However, for the year ended

December 31, 2020, we incurred approximately 28% of our expenses in foreign currencies, primarily Euros, British Pounds, and Indian Rupee, principally with respect to salaries and related personnel expenses associated with our European and Indian operations.

Additionally, for the year ended

December 31, 2020, approximately 21% of our revenues were generated in foreign currencies.

However, for the year ended December 31, 2021, we incurred approximately 28% of ou r expenses in foreign currencies, primarily Euros, British Pounds, and Indian Rupee, principally with respect to salaries and related personnel expenses associated with our European and Indian operations.

Additionally, for the year ended December 31, 2021, approximately 23% of our revenues were generated in foreign currencies.

Accordingly, changes in exchange rates may have a material adverse effect on our business, operating results and financial condition.

The exchange rate between the U.S.

dollar and foreign currencies has fluctuated substantially in recent years and may continue to fluctuate substantially in the future.

dollar and foreign currencies has fluctuate d substantially in recent years and may continue to fluctuate substantially in the future.

We expect that a majority of our revenues will continue to be generated in U.S.

8 unchanged sentences

We have experienced significant growth over the last several years.

From 2018 to 2020, our revenues grew from $278.9 million to $363.0 million, and our headcount increased from 869 employees at the beginning of 2018 to 1,498 employees as of December 31, 2020.

Our revenues grew from $321.6 million in 2019 to $411.2 million in 2021, and our headcount increased from 

1,194 employee s at the beginning of 2019 to 1,823 employees as of December 31, 2021 .

We rely on information technology systems to help manage critical functions such as order processing, revenue recognition and financial forecasts.

To manage any future growth effectively we must continue to improve and expand our IT systems, financial infrastructure, and operating and administrative systems and controls, and continue to manage headcount, capital and processes in an efficient manner.

To manage any future growth effectively we must continue to improve and ex pand our IT systems, financial infrastructure, and operating and administrative systems and controls, and continue to manage headcount, capital and processes in an efficient manner.

We may not be able to successfully implement improvements to these systems and processes in a timely or efficient manner.

4 unchanged sentences

We depend on the continued services and performance of our senior management and other key employees, the loss of any of whom could adversely affect our business, operating results and financial condition.

Our future performance depends on the continued services and continuing contributions of our senior management, particularly Philippe F.

Courtot, our Chairman and Chief Executive Officer, and other key employees, to execute on our business plan and to identify and pursue new opportunities and product innovations.

We do not maintain key-man insurance for Mr.

Courtot or for any other member of our senior management team.

From time to time, there may be changes in our senior management team resulting from the termination or departure of executives.

Our senior management and key employees are generally employed on an at-will basis, which means that they could terminate their employment with us at any time. In February 2021, we announced that Mr.

Courtot was taking a medical leave of absence and Sumedh Thakar, our President and Chief Product Officer, had been appointed interim Chief Executive Officer and principal executive officer. The loss of the services of our senior management, particularly Mr.

Courtot, or other key employees for any reason could significantly delay or prevent the achievement of our development and strategic objectives and harm our business, financial condition and results of operations.

Our future performance depends on the continued services and continuing contributions of our senior management and other key employees, to execute on our business plan and to identify and pursue new opportunities and product innovations.

We do not maintain key-man insurance for any member of our senior management team.

Our senior management and key employees are generally employed on an at-will basis, which means that they could terminate their employment with us at any time. From time to time, there may be changes in our senior management team resulting from the termination or departure of executives.

For example, our former chief executive officer resigned for health reasons in March 2021, and our current chief executive officer was appointed to the role in April 2021. The loss of the services of our senior management or other key employees for any reason could significantly delay or prevent the achievement of our development and strategic objectives and harm our business, financial condition and results of operations.

If we are unable to hire, retain and motivate qualified personnel, our business may suffer.

2 unchanged sentences

Any of our employees may terminate their employment at any time.

Competition for highly skilled personnel is frequently intense, especially in the San Francisco Bay Area and Pune, India, locations in which we have a substantial presence and need for highly skilled personnel and we may not be able to compete for these employees.

Competition for highly skilled personnel is frequently intense, especially within our industry, and we may not be able to compete for such personnel.

We are required under accounting principles generally accepted in the United States (U.S.

12 unchanged sentences

In order to remain competitive, we have in the past and may in the future seek to acquire additional businesses, products, services or technologies.

For example, we acquired 1Mobility on April 1, 2018, Layered Insight on October 16, 2018, Adya on January 10, 2019, and certain intellectual property of Spell Security on July 24, 2020. The environment for acquisitions in our industry is very competitive and acquisition candidate purchase prices may exceed what we would prefer to pay.

For example, we acquired Adya on January 10, 2019, certain intellectual property of Spell Security on July 24, 2020, and certain intellectual property of TotalCloud on August 19, 2021.

The environment for acquisitions in our industry is very competitive and acquisition candidate purchase prices may exceed what we would prefer to pay.

Moreover, achieving the anticipated benefits of future acquisitions will depend in part upon whether we can integrate acquired operations, products and technology in a timely and cost-effective manner, and even if we achieve benefits from acquisitions, such acquisitions may still be viewed negatively by customers, financial markets or investors.

13 unchanged sentences

In addition, replacing this manufacturer may be difficult and could result in an inability or delay in deploying our solutions to customers that request physical scanner appliances as part of their subscriptions.

Furthermore, our manufacturer’s ability to timely manufacture and ship our physical scanner appliances depends on a variety of factors, such as the availability of hardware components, supply shortages or contractual restrictions.

Furthermore, our manufacturer’s ability to timely manufacture and ship our physical scanner appliances depends on a variety of factors, such as the availability of hardware compon ents, supply shortages or contractual restrictions.

In the event of an interruption from this manufacturer, we may not be able to develop alternate or secondary sources in a timely manner.

46 unchanged sentences

Additionally, new laws and regulations relating to privacy and data protection continue to be proposed and enacted.

For example, the European Union has adopted the GDPR.

This regulation, which took effect in May of 2018, causes EU data protection requirements to be more stringent and provides for greater penalties.

For example, the European Union has adopted the Global Data Protection Regulation (“GDPR”).

This regulation, which took effect in May of 2018, provides for substantial obligations relating to the handling, storage and other processing of data relating to individuals and administrative fines for violations, which can be up to four percent of the previous year’s annual revenue or €20 million, whichever is higher.

The GDPR may be subject to new or changing interpretations by courts, and our interpretation of the law and efforts to comply with the rules and regulations of the law may be ruled invalid.

Noncompliance with the GDPR can trigger fines of up to €20 million or 4% of global annual revenues, whichever is higher.

Similarly, California recently enacted the California Consumer Privacy Act (“CCPA”), which, among other things, requires covered companies to provide new disclosures to California consumers and afford such consumers new rights to opt-out of certain sales of personal information.

The CCPA creates a private right of action for statutory damages for certain breaches of information. Aspects of the CCPA and its interpretation remain unclear. 

Additionally, a new privacy law, the California Privacy Rights Act (“CPRA”), was approved by voters in the November 3, 2020 election.

Similarly, the California Consumer Privacy Act (“CCPA”) requires covered companies to, among other things, provide new disclosures to California consumers and affords such consumers new rights to opt-out of certain sales of personal information.

The CCPA also creates a private right of action for statutory damages for certain breaches of information. Certain aspects of the CCPA and its interpretation remain uncertain and are likely to remain uncertain for an extended period. Additionally, a new privacy law, the California Privacy Rights Act (“CPRA”), was approved by voters in the November 3, 2020 election.

The CPRA modifies the CCPA significantly, creating obligations relating to consumer data beginning on January 1, 2022, with implementing regulations expected on or before July 1, 2022, and enforcement beginning July 1, 2023.

1 unchanged sentence

In addition, other states have enacted or proposed legislation that regulates the collection, use, and sale of personal information, and such regimes might not be compatible with the GDPR, the CCPA or the CPRA or may require us to undertake additional practices.

Accordingly, we cannot yet predict the impact of the CCPA, CRPA or other evolving privacy and data protection obligations on our business or operations, but it may require us to modify our data processing practices and policies and incur substantial costs and expenses in an effort to comply.

Accordingly, we cannot yet predict the impact of the CCPA, CRPA or other evolving privacy and data protection obligations on our business or operations, but it may require us to modify our data processing practices an d policies and incur substantial costs and expenses in an effort to comply.

The privacy, data protection, and information security laws and regulations we must comply with also are subject to change.

4 unchanged sentences

Privacy Shield Framework and a related program, the Swiss-U.S.

Privacy Shield Framework and make use of certain model clauses approved by the European Commission (the “SCCs”), with regard to certain transfers of personal data from the European Economic Area (“EEA”) to the U.S.

Privacy Shield Framework and make use of certain standard contractual clauses (the “SCCs”) approved by the European Commission, with regard to certain transfers of personal data from the European Economic Area (“EEA”) to the U.S.

Both the EU-U.S.

Privacy Shield Framework and SCCs have been subject to legal challenge, however, and on July 16, 2020, the Court of Justice of the European Union (“CJEU”) issued a decision that invalidated the EU-U.S.

Privacy Shield and imposed additional obligations on companies when relying on the SCCs.

This CJEU decision may result in European data protection regulators applying differing standards for, and requiring ad hoc verification of, transfers of personal data from Europe to the U.S.

We are analyzing the impacts of this decision, and we may find it necessary or appropriate to take different or additional steps with respect to transfers of personal data, which may result in increased costs of compliance and limitations on our customers and us. We may be unsuccessful in maintaining legitimate means for our transfer and receipt of personal data from the EEA or Switzerland.

Privacy Shield Framework and SCCs have been subject to legal challenge.

We continue to analyze the July 2020 “Schrems II”

decision by the Court of Justice of the European Union (“CJEU”) and its impact on our data transfer mechanisms as well as subsequent guidance from data privacy regulators and new SCCs published by the European Commission in June 2021, and we may find it necessary or appropriate to take different or additional steps with respect to transfers of personal data, which may result in increased costs of compliance and limitations on our customers and us. We may be unsuccessful in maintaining legitimate means for our transfer and receipt of personal data from the EEA or Switzerland.

We may experience reluctance or refusal by current or prospective European customers to use our products, and we and our customers may face a risk of enforcement actions by data protection authorities in the EEA relating to personal data transfers to us and by us from the EEA.

83 unchanged sentences

It is possible that we could face sales tax audits and that our liability for these taxes could exceed our estimates as tax authorities could still assert that we are obligated to collect additional amounts as taxes from our customers and remit those taxes to those authorities.

We could also be subject to audits with respect to state and international jurisdictions for which we may not accrued tax liabilities.

We could also be subject to audits with respect to state and international jurisdictions for which we may not have accrued tax liabilities.

A successful assertion that we should be collecting additional sales or other taxes on our services in jurisdictions where we have not historically done so and do not accrue for sales taxes could result in substantial tax liabilities for past sales, discourage customers from purchasing our solutions or otherwise harm our business and operating results.

Changes in our provision for income taxes or adverse outcomes resulting from examination of our income tax returns could adversely affect our operating results.

Changes in our income tax provision or adverse outcomes resulting from examination of our income tax returns could adversely affect our operating results.

We could be subject to additional taxes.

We are subject to income taxes in the United States and various foreign jurisdictions, and our domestic and international tax liabilities are subject to the allocation of expenses in differing jurisdictions.

Our tax rate is affected by changes in the mix of earnings and losses in countries with differing statutory tax rates, certain non-deductible expenses arising from the requirement to expense stock options, excess tax benefits from stock-based compensation, and the valuation of deferred tax assets and liabilities, including our ability to utilize our federal and state net operating losses, which were $1.4 million and $0.1 million, respectively, as of December 31, 2020.

Our tax rate is affected by changes in the mix of earnings and losses in countries with differing statutory tax rates, certain non-deductible expenses and excess tax benefits arising from stock-based compensation, other tax benefits and credits, and the valuation of deferred tax assets and liabilities.

Increases in our effective tax rate could harm our operating results.

Additionally, significant judgment is required in evaluating our tax positions and our worldwide provision for taxes.

Additionally, significant judgment is required in evaluating our tax positions and our worldwide tax provisions.

During the ordinary course of business, there are many activities and transactions for which the ultimate tax determination is uncertain.

38 unchanged sentences

section in this Annual Report on Form 10-K could result in our actual operating results being different from our guidance, and the differences may be adverse and material.

Concentration of ownership among our existing executive officers, directors and holders of 10% or more of

our outstanding common stock may prevent new investors from influencing significant corporate decisions.

As of December 31, 2020, our executive officers, directors and holders of 10% or more of our outstanding common stock beneficially owned, in the aggregate, approximately 27.7% of our outstanding common stock.

As a result, such persons, acting together, have significant ability to control our management and affairs and substantially all matters submitted to our stockholders for approval, including the election and removal of directors and approval of any significant transaction.

This concentration of ownership may have the effect of delaying, deferring or preventing a change in control, impeding a merger, consolidation, takeover or other business combination involving us, or discouraging a potential acquirer from making a tender offer or otherwise attempting to obtain control of our business, even if such a transaction would benefit other stockholders.

Future sales of shares by existing stockholders could cause our stock price to decline.

The market price of shares of our common stock could decline as a result of substantial sales of our common stock, particularly sales by our directors, executive officers, employees and significant stockholders, a large number of shares of our common stock becoming available for sale, or the perception in the market that holders of a large number of shares intend to sell their shares.

As of December 31, 2020, we had approximately 39.1 million shares of our common stock outstanding.

In addition, as of December 31, 2020 , there were approximately 1.0 million restricted stock units and options to purchase approximately 2.2 million shares of our common stock outstanding.

If such options are exercised and restricted stock units are released, these additional shares will become available for sale.

As of December 31, 2020 , we had an aggregate of 6.6 million shares of our common stock reserved for future issuance under our 2012 Equity Incentive Plan, which can be freely sold in the public market upon issuance.

As of December 31, 2021, we had 39.1 million shares of our common stock outstanding.

In addition, as of December 31, 2021 , there were 0.9 million restricted stock units and stock options to purchase 1.8 million shares of our common stock outstanding.

If such stock options are exercised and restricted stock units are released, these additional shares will become available for sale.

As of December 31, 2021 , we had 8.1 million shares of our common stock reserved for future grants under our 2012 Equity Incentive Plan and 0.6 million shares reserved for future purchases under our 2021 Employee Stock Purchase Plan, which can be freely sold in the public market upon issuance.

If a large number of these shares are sold in the public market, the sales could reduce the trading price of our common stock.

We cannot guarantee that our stock repurchase program will be fully consummated or that it will enhance stockholder value, and any stock repurchases we make could affect the price of our common stock.

In February 2018, we announced a $100.0 million stock repurchase program.

On each of October 30, 2018, October 30, 2019, May 7, 2020 and February 10, 2021, we announced that our board of directors had authorized an increase of $100.0 million to the share repurchase program, resulting in an aggregate authorization of $500.0 million. Although our board of directors authorized this stock repurchase program, we are not obligated to repurchase any specific dollar amount or to acquire any specific number of shares.

On February 12, 2018, we announced a $100.0 million stock repurchase program.

On each of October 30, 2018, October 30, 2019, May 7, 2020, February 10, 2021, we announced that our board of directors had authorized an increase of $100.0 million, and on November 3, 2021, we announced that our board of directors had authorized an increase of $200.0 million to the share repurchase program, resulting in an aggregate authorization of $700.0 million to date. Although our board of directors authorized this stock repurchase program, we are not obligated to repurchase any specific dollar amount or to acquire any specific number of shares.

The stock repurchase program could affect the price of our common stock, increase volatility and diminish our cash reserves.

In addition, it may be suspended or terminated at any time, which may result in a decrease in the price of our common stock.

In the year ended December 31, 2020, we repurchased 352,000 shares of our common stock for an aggregate purchase price of approximately $126.7 million.

During the year ended December 31, 2021, we repurchased 1.1 million shares of our common stock for approximately $130.0 million in total.

As of December 31, 2021, approximately $271.8 million remained available for share repurchases pursuant to our share repurchase program.

We do not intend to pay dividends on our common stock and therefore any returns will be limited to the value of our stock.

13 unchanged sentences

In addition, because we are incorporated in Delaware, we are governed by the provisions of Section 203 of the Delaware General Corporation Law, which limits the ability of stockholders owning in excess of 15% of our outstanding voting stock to merge or combine with us.

Although we believe these provisions collectively provide for an opportunity to obtain greater value for stockholders by requiring potential acquirers to negotiate with our board of directors, they would apply even if an offer rejected by our board were considered beneficial by some stockholders.

In addition, these provisions may frustrate or prevent any attempts by our stockholders to replace or remove our current management by making it more difficult for stockholders to replace members of our board of directors, which is responsible for appointing the members of our management.

23 unchanged sentences

Our operating results may be adversely affected if our assumptions change or if actual circumstances differ from those in our assumptions, which could cause our operating results to fall below the expectations of securities analysts and investors, resulting in a decline in our stock price.

Significant assumptions and estimates used in preparing our consolidated financial statements include those related to revenue recognition, accounting for income taxes, stock-based compensation, and fair value measurement.

Significant assumptions and estimates used in preparing our consolidated financial statements include those related to revenue recognition, accounting for income taxes and stock-based compensation.

Changes in financial accounting standards may cause adverse and unexpected revenue fluctuations and impact our reported results of operations.

11 unchanged sentences

Any failure to maintain effective internal control over financial reporting also could adversely affect the results of periodic management evaluations regarding the effectiveness of our internal control over financial reporting that we are required to include in our periodic reports we file with the SEC under Section 404 of the Sarbanes-Oxley Act.

While we were able to assert in this Annual Report on Form 10-K that our internal control over financial reporting was effective as of December 31, 2020, we cannot predict the outcome of our testing in future periods.

While we were able to assert in this Annual Report on Form 10-K that our internal control over financial reporting was effective as of December 31, 2021, we cannot predict the outcome of our testing in future periods.

If we are unable to assert in any future reporting period that our internal control over financial reporting is effective (or if our independent registered public accounting firm is unable to express an opinion on the effectiveness of our internal controls), investors may lose confidence in our operating results and our stock price could decline.

2 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors