What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2020-08-10 compared with 2020-05-07 · 65 added, 58 removed, 567 unchanged (18% of the section changed)

15 unchanged sentences

These impacts, individually or in the aggregate, could have a material and adverse effect on our business, financial position, results of operations and cash flows.

Such effect may be exacerbated in the event the outbreak and the measures taken in response to it persist for an extended period of time, or if there is a resurgence of the outbreak.

Such effect may be exacerbated in the event the pandemic and the measures taken in response to it persist for an extended period of time.

Under any of these circumstances, the resumption of normal business operations may be delayed or hampered by lingering effects of COVID-19 on our operations, partners, and customers.

Subscriptions to our Vulnerability Management solutions generate most of our revenues, and if we are unable to continue to renew and grow subscriptions for these solutions, our operating results would suffer.

We derived approximately 72% and 73% of our revenues from subscriptions to our VM solutions for the three months ended March 31, 2020 and 2019, respectively.

We derived approximately 72% and 73% of our revenues from subscriptions to our VM solutions for the six months ended June 30, 2020 and 2019, respectively.

We expect to continue to derive a significant majority of our revenues from subscriptions to our VM solutions.

10 unchanged sentences

• seasonal buying patterns of our customers;

security breaches, technical difficulties or interruptions with our service;

• actual or perceived security breaches, technical difficulties or interruptions with our service;

• changes in the growth rate of the IT, security and compliance market;

46 unchanged sentences

• reluctance of customers to purchase cloud solutions for IT, security and compliance.

providers that may be better established or have greater resources than we do, require additional investment of time and resources in the development and training of our channel partners and entail significant risk of failure.

Furthermore, diversifying our solutions and expanding into new IT, security and compliance markets will require significant investment and planning, require that our research and development and sales and marketing organizations develop expertise in these new markets, bring us more directly into competition with IT, security and compliance providers that may be better established or have greater resources than we do, require additional investment of time and resources in the development and training of our channel partners and entail significant risk of failure.

If we fail to anticipate market requirements or fail to develop and introduce solution enhancements or new solutions to satisfy those requirements in a timely manner, such failure could substantially decrease or delay market acceptance and sales of our present and future solutions and cause us to lose existing customers or fail to gain new customers, which would significantly harm our business, financial condition and results of operations.

7 unchanged sentences

If we are unable to sell subscriptions to additional solutions, our future revenue growth may be harmed and our business may suffer.

We will need to increase the revenues that we derive from our current and future solutions other than VM for our business and revenues to grow as we expect.

We will need to increase the revenues that we derive from our current and future solutions for our business and revenues to grow as we expect.

Revenues from our other solutions such as Policy Compliance, PCI Compliance, Web Application Scanning, Web Application Firewall, CMDB Sync, Security Assessment Questionnaire, File Integrity Monitoring, Indication of Compromise, Global IT Asset Inventory, Security Configuration Assessment, Cloud Security Assessment, Certificate Inventory, Container Security and Patch Management have been relatively modest compared to revenues from our VM solutions.

18 unchanged sentences

Our solutions, platforms, and system, and those of our service providers, may also suffer security incidents as a result of non-technical issues, including intentional or inadvertent acts or omissions by our employees or service providers.

Because our operations involve providing IT security solutions to our customers, we may be targeted for cyber-attacks and other security incidents.

With the increase in personnel working remotely during the current COVID-19 pandemic, we and our service providers are at increased risk for security breaches.

We are taking steps to monitor and enhance the security of our solutions, cloud platform, and other relevant systems, IT infrastructure, networks, and data;

however, the unprecedented scale of remote work may require additional personnel and resources, which nevertheless cannot be guaranteed to fully safeguard our solutions, our cloud platform, or any systems, IT infrastructure networks, or data upon which we rely.

Further, because our operations involve providing IT security solutions to our customers, we may be targeted for cyber-attacks and other security incidents.

A breach in our data security or an attack against our service availability, or that of our third-party service providers, could impact our networks or networks secured by our solutions, creating system disruptions or slowdowns and exploiting security vulnerabilities of our solutions, and the information stored on our networks or those of our third-party service providers could be accessed, publicly disclosed, altered, lost, or stolen, which could subject us to liability and cause us financial harm.

If an actual or perceived disruption in the availability of our solutions or the breach of our security measures or those of our service providers occurs, it could adversely affect the market perception of our solutions, result in a loss of competitive advantage, have a negative impact on our reputation, or result in the loss of customers, channel partners and sales, and it may expose us to the loss or alteration of information, litigation, regulatory actions and investigations and possible liability.

possible liability.

Any such actual or perceived security breach or disruption could also divert the efforts of our technical and management personnel.

23 unchanged sentences

Our business depends on the overall demand for IT and on the economic health of our current and prospective customers.

Economic weakness, customer financial difficulties, and constrained spending on IT security may result in decreased revenue and earnings.

Economic weakness, customer financial difficulties, and constrained spending on IT security may result

in decreased revenue and earnings.

Such factors could make it difficult to accurately forecast our sales and operating results and could negatively affect our ability to provide accurate forecasts to our contract manufacturers.

22 unchanged sentences

We have a limited operating history, particularly in certain markets and solution offerings, and we believe that we need to continue to develop market awareness in the IT, security and compliance market.

Market awareness of our capabilities and solutions is essential to our continued growth and success in all of our markets, particularly for the large enterprise, service provider and government markets.

Market awareness of our capabilities and solutions is essential to our continued growth and success in all of our markets, particularly for

the large enterprise, service provider and government markets.

If our marketing programs are not successful in creating market awareness of our company and our full suite of solutions, our business, financial condition and results of operations may be adversely affected, and we may not be able to achieve our expected growth.

25 unchanged sentences

In addition, current or potential competitors may be acquired by third parties with greater available resources.

As a result of such relationships and acquisitions, our current or potential competitors might be able to adapt more quickly to new technologies and customer needs, devote greater resources to the promotion or sale of their products and services, initiate or withstand substantial price competition, take advantage of other opportunities more readily or develop and expand their product and service offerings more quickly than we do.

more readily or develop and expand their product and service offerings more quickly than we do.

For all of these reasons, we may not be able to compete successfully against our current or future competitors.

11 unchanged sentences

We may incur losses in the future for a number of reasons, including without limitation, the other risks and uncertainties described in this Quarterly Report on Form 10-Q.

Additionally, we

may encounter unforeseen operating expenses, difficulties, complications, delays and other unknown factors that may result in losses in future periods.

Additionally, we may encounter unforeseen operating expenses, difficulties, complications, delays and other unknown factors that may result in losses in future periods.

If our revenue growth does not meet our expectations in future periods, our financial performance may be harmed and we may not again achieve or maintain profitability in the future.

10 unchanged sentences

Additionally, our IT, security and compliance solutions may falsely detect vulnerabilities or threats that do not actually exist.

For example, some of our solutions rely on information on attack sources aggregated from third-party data providers who monitor global malicious activity originating from a variety of sources, including anonymous proxies, specific IP addresses, botnets and phishing sites.

For example, some of our solutions rely on

information on attack sources aggregated from third-party data providers who monitor global malicious activity originating from a variety of sources, including anonymous proxies, specific IP addresses, botnets and phishing sites.

If the information from these data providers is inaccurate, the potential for false indications of security vulnerabilities increases.

10 unchanged sentences

Additionally, any failure to implement and configure our solutions correctly may result in our solutions failing to detect vulnerabilities or compliance issues, or otherwise to perform effectively, and may result in disruptions to our customers’ IT environments and businesses.

reliability or effectiveness of our solutions, and claims and litigation, and may result in negative press coverage, negative effects on our reputation and competitive position, a loss of sales, customers, and channel partners, and harm our financial results.

Any misuse of our solutions, including any failure to implement and configure them appropriately, could result in disruption to our customers’ businesses, customer dissatisfaction, negative impacts on the perceived reliability or effectiveness of our solutions, and claims and litigation, and may result in negative press coverage, negative effects on our reputation and competitive position, a loss of sales, customers, and channel partners, and harm our financial results.

Undetected software errors or flaws in our solutions could harm our reputation, decrease market acceptance of our solutions or result in liability.

1 unchanged sentence

We have experienced these errors or defects in the past in connection with new solutions and solution upgrades and we expect that these errors or defects will be found from time to time in the future in new or enhanced solutions after commercial release of these solutions.

Since our customers use our solutions for security and compliance reasons, any errors, defects, disruptions in service or other performance problems with our solutions, or any other failure of our solutions to detect vulnerabilities or compliance problems or otherwise to perform effectively, may result in disruptions or damage to the business of our customers, including security breaches or compliance failures.

Since our customers use our solutions for IT, security and compliance reasons, any errors, defects, disruptions in service or other performance problems with our solutions, or any other failure of our solutions to detect vulnerabilities or compliance problems or otherwise to perform effectively, may result in disruptions or damage to the business of our customers, including security breaches or compliance failures.

Additionally, any such issues, or the perception that they have occurred, whether or not relating to any actual or perceived error or defect in our solutions, could hurt our reputation and competitive position and we may incur significant costs, the attention of key personnel could be diverted, our customers may delay or withhold payment to us or elect not to renew, we could face a loss of sales, customers, and channel partners, and other significant problems with our relationships with customers and channel partners may arise.

19 unchanged sentences

The CCPA creates a private right of action for statutory damages for certain breaches of information.

The CCPA has been amended on multiple occasions and is the subject of proposed regulations of the California Attorney General that were released on February 7, 2020.

Aspects of the CCPA and its interpretation remain unclear.

In addition, other states have enacted or proposed legislation that regulates

the collection, use, and sale of personal information, and such regimes might not be compatible with either the GDPR or the CCPA, or may require us to undertake additional practices.

Additionally, a new privacy law, the California Privacy Rights Act (CPRA), recently was certified by the California Secretary of State to appear on the ballot for the November 3, 2020 election.

If this initiative is approved by California voters, the CPRA would significantly modify the CCPA, potentially resulting in further uncertainty and requiring us to incur additional costs and expenses.

In addition, other states have enacted or proposed legislation that regulates the collection, use, and sale of personal information, and such regimes might not be compatible with either the GDPR or the CCPA, or may require us to undertake additional practices.

We cannot yet predict the impact of the CCPA or impending legislation on our business or operations, but it may require us to modify our data processing practices and policies and incur substantial costs and expenses in an effort to comply .

2 unchanged sentences

It remains unclear how United Kingdom data protection laws or regulations will develop in the medium to longer term and how data transfers to and from the United Kingdom will be regulated.

Additionally, U.S.

and EU authorities reached a political agreement in February 2016 regarding a means for legitimizing personal data transfers from the EEA to the U.S., the EU-U.S.

Privacy Shield Framework, replacing a prior program that was invalidated.

We have joined the EU-U.S.

Additionally, we have joined the EU-U.S.

Privacy Shield Framework and a related program, the Swiss-U.S.

Privacy Shield Framework.

Privacy Shield Framework is subject to legal challenge, however, and it or the Swiss-U.S.

Privacy Shield Framework may be modified or invalidated.

We may be unsuccessful in maintaining legitimate means for our transfer and receipt of personal data from the EEA or Switzerland.

We may experience reluctance or refusal by current or prospective European customers to use our products, and we may find it necessary or desirable to make further changes to our handling of personal data of European residents.

Privacy Shield Framework, and make use of certain model clauses approved by the European Commission (the “SCCs”), with regard to certain transfers of personal data from the European Economic Area (“EEA”) to the U.S.

Both the EU-U.S.

Privacy Shield Framework and SCCs have been subject to legal challenge, however, and on July 16, 2020, the Court of Justice of the European Union (“CJEU”) issued a decision that invalidated the EU-U.S.

Privacy Shield and imposed additional obligations on companies when relying on the SCCs.

This CJEU decision may result in European data protection regulators applying differing standards for, and requiring ad hoc verification of, transfers of personal data from Europe to the U.S.

We are analyzing the impacts of

this decision, and we may find it necessary or appropriate to take different or additional steps with respect to transfers of personal data, which may result in increased costs of compliance and limitations on our customers and us We may be unsuccessful in maintaining legitimate means for our transfer and receipt of personal data from the EEA or Switzerland.

We may experience reluctance or refusal by current or prospective European customers to use our products, and we and our customers may face a risk of enforcement actions by data protection authorities in the EEA relating to personal data transfers to us and by us from the EEA.

Any such enforcement actions could result in substantial costs and diversion of resources, distract management and technical personnel and negatively affect our business, operating results and financial condition.

Some countries also are considering or have passed legislation requiring local storage and processing of data, or similar requirements, which could increase the cost and complexity of delivering our services.

In addition to laws and regulations, privacy advocacy and industry groups or other private parties may propose new and different privacy standards that either legally or contractually apply to us.

17 unchanged sentences

• trade and foreign exchange restrictions;

economic or political instability in foreign markets;

• economic or political instability in foreign markets, including as a result of increasing tensions between India and China;

• greater difficulty in enforcing contracts, accounts receivable collection and longer collection periods;

18 unchanged sentences

If we are unable to successfully manage the challenges of international operations, our business and operating results could be adversely affected.

In addition, as of March 31, 2020 , approximately 70% of our employees were located outside of the United States, and 61% of our employees were located in Pune, India.

In addition, as of June 30, 2020, approximately 71% of our employees were located outside of the United States, and 62% of our employees were located in Pune, India.

Accordingly, we are exposed to changes in laws governing our employee relationships in various U.S.

3 unchanged sentences

We may be unable to scale our infrastructure effectively or as quickly as our competitors in these markets and our revenues may not increase to offset any increased costs and operating expenses, which would cause our results to suffer.

Disruptive technologies could gain wide adoption and supplant our cloud security and compliance solutions, thereby weakening our sales and harming our results of operations.

Disruptive technologies could gain wide adoption and supplant our cloud-based IT, security and compliance solutions, thereby weakening our sales and harming our results of operations.

The introduction of products and services embodying new technologies could render our existing solutions obsolete or less attractive to customers.

Our business could be harmed if new security and compliance technologies are widely adopted.

Our business could be harmed if new IT, security and compliance technologies are widely adopted.

We may not be able to successfully anticipate or adapt to changing technology or customer requirements on a timely basis, or at all.

If we fail to keep up with technological changes or to convince our customers and potential

customers of the value of our solutions even in light of new technologies, our business could be harmed and our revenues may decline.

If we fail to keep up with technological changes or to convince our customers and potential customers of the value of our solutions even in light of new technologies, our business could be harmed and our revenues may decline.

Our business and operations have experienced significant growth, and if we do not appropriately manage any future growth, or are unable to improve our systems and processes, our operating results may be negatively affected.

We have experienced significant growth over the last several years.

From 2017 to 2019 , our revenues grew from $230.8 million to $321.6 million and our headcount increased from 684 employees at the beginning of 2017 to 1,322 employees as of March 31, 2020 .

We rely on information technology systems to help manage critical functions such as order processing, revenue recognition and financial forecasts.

From 2017 to 2019, our revenues grew from $230.8 million to $321.6 million and our headcount increased from 684 employees at the beginning of 2017 to 1,386 employees as of June 30, 2020.

We rely on information technology systems to help manage critical functions such as or der processing, revenue recognition and financial forecasts.

To manage any future growth effectively we must continue to improve and expand our IT systems, financial infrastructure, and operating and administrative systems and controls, and continue to manage headcount, capital and processes in an efficient manner.

11 unchanged sentences

Our success significantly depends upon establishing and maintaining relationships with a variety of channel partners, and we anticipate that we will continue to depend on these partners in order to grow our business.

For the three months ended March 31, 2020 , we derived approximately 42% of our revenues from sales of subscriptions for our solutions through channel partners, and the percentage of revenues derived from channel partners may increase in future periods.

For the six months ended June 30, 2020, we derived approximately 42% of our revenues from sales of subscriptions for our solutions through channel partners, and the percentage of revenues derived from channel partners may increase in future periods.

Our agreements with our channel partners are generally non-exclusive and do not prohibit them from working with our competitors or offering competing solutions, and many of our channel partners have more established relationships with our competitors.

6 unchanged sentences

Some of these channel partners may be unable to withstand adverse changes in economic conditions, which could result in insolvency and/or the inability of such distributors to obtain credit to finance purchases of our products and services.

In addition, weakness in the end-user market could negatively affect the cash flows of our channel partners who could, in turn, delay paying their obligations to us, which would increase our credit risk exposure.

In addition, weakness in the end-user market could negatively affect the cash flows of our channel partners who could, in turn, delay paying their obligations to us, which would

increase our credit risk exposure.

Our business could be harmed if the financial condition of some of these channel partners substantially weakened and we were unable to timely secure replacement channel partners.

35 unchanged sentences

dollar and we generate a majority of our revenues in U.S.

However, for the three months ended March 31, 2020 , we incurred approximately 25% of our expenses outside of the United States in foreign currencies, primarily Euros, GBP, and INR, principally with respect to salaries and related personnel expenses associated with our European and Indian operations.

Additionally, for the three months ended March 31, 2020 , approximately 21% of our revenues were generated in foreign currencies.

However, for the six months ended June 30, 2020, we incurred approximately 26% of our expenses in foreign currencies, primarily Euros, GBP, and INR, principally with respect to salaries and relat ed personnel expenses associated with our European and Indian operations.

Additionally, for the six months ended June 30, 2020, approximately 20% of our revenues were generated in foreign currencies.

Accordingly, changes in exchange rates may have a material adverse effect on our business, operating results and financial condition.

15 unchanged sentences

The contractual provisions that we enter into with employees, consultants, partners, vendors and customers may not prevent unauthorized use or disclosure of our proprietary technology or intellectual property rights and may not provide an adequate remedy in the event of unauthorized use or disclosure of our proprietary technology or intellectual property rights.

Moreover, policing unauthorized use of our technologies, solutions and intellectual property is difficult, expensive and time-consuming, particularly in foreign countries where the laws may not be as protective of intellectual property rights as those in the United States and where mechanisms for enforcement of intellectual property rights may be weak.

Moreover, policing unauthorized use of our technologies,

solutions and intellectual property is difficult, expensive and time-consuming, particularly in foreign countries where the laws may not be as protective of intellectual property rights as those in the United States and where mechanisms for enforcement of intellectual property rights may be weak.

We may be unable to determine the extent of any unauthorized use or infringement of our solutions, technologies or intellectual property rights.

As of December 31, 2019 , we had 18 issued patents and several pending U.S.

As of June 30, 2020, we had 20 issued patents and several pending U.S.

patent applications, and we may file additional patent applications in the future.

59 unchanged sentences

Selling to government entities can be highly competitive, expensive and time-consuming, often requiring significant upfront time and expense without any assurance that we will win a sale.

We have invested in the creation of a cloud offering certified under the Federal Information

Security Management Act for government usage but we cannot be sure that we will continue to sustain or renew this certification, that the government will continue to mandate such certification or that other government agencies or entities will use this cloud offering.

We have invested in the creation of a cloud offering certified under the Federal Information Security Management Act for government usage but we cannot be sure that we will continue to sustain or renew this certification, that the government will continue to mandate such certification or that other government agencies or entities will use this cloud offering.

Government demand and payment for our solutions may be impacted by public sector budgetary cycles and funding authorizations, with funding reductions or delays adversely affecting public sector demand for our solutions.

15 unchanged sentences

In order to remain competitive, we have in the past and may in the future seek to acquire additional businesses, products, services or technologies.

For example, we acquired 1Mobility on April 1, 2018, Layered Insight on October 16, 2018, and Adya on January 10, 2019.

The environment for acquisitions in our industry is very competitive and acquisition candidate purchase prices may exceed what we would prefer to pay.

For example, we acquired 1Mobility on April 1, 2018, Layered Insight on October 16, 2018, Adya on January 10, 2019, and certain intellectual property of Spell Security on July 24, 2020.

The environment for acquisitions in our industry is very competitive and acquisition candidate purchase

prices may exceed what we would prefer to pay.

Moreover, achieving the anticipated benefits of future acquisitions will depend in part upon whether we can integrate acquired operations, products and technology in a timely and cost-effective manner , and even if we achieve benefits from acquisitions, such acquisitions may still be viewed negatively by customers, financial markets or investors.

7 unchanged sentences

The preparation of financial statements in conformity with U.S.

GAAP requires management to make estimates and assumptions that affect the amounts reported in the condensed consolidated financial statements and

accompanying notes.

GAAP requires management to make estimates and assumptions that affect the amounts reported in the condensed consolidated financial statements and accompanying notes.

We base our estimates on historical experience and on various other assumptions that we believe to be reasonable under the circumstances, as provided in the section titled “Item 2 - Management’s Discussion and Analysis of Financial Condition and Results of Operations,” the results of which form the basis for making judgments about the carrying values of assets, liabilities, equity, revenues and expenses that are not readily apparent from other sources.

41 unchanged sentences

While we were able to assert in our Annual Report on Form 10-K that our internal control over financial reporting was effective as of December 31, 2019, we cannot predict the outcome of our testing in future periods.

If we are unable to assert in any future reporting period that our internal control over financial reporting is effective (or if our independent registered public accounting firm is unable to express an opinion on the effectiveness of our internal controls), investors may lose confidence in our operating results and our stock price could decline.

If we are unable to assert in any future reporting period that our internal control over financial reporting is effective (or if our independent registered public

accounting firm is unable to express an opinion on the effectiveness of our internal controls), investors may lose confidence in our operating results and our stock price could decline.

In addition, if we are unable to continue to meet these requirements, we may not be able to remain listed on the NASDAQ Stock Market.

33 unchanged sentences

Concentration of ownership among our existing executive officers, directors and holders of 10% or more of our outstanding common stock may prevent new investors from influencing significant corporate decisions.

As of March 31, 2020, our e xecutive officers, directors and holders of 10% or more of our outstanding common stock beneficially owned, in the aggregate, approximately 30% of our outstanding common stock.

As of June 30, 2020, our e xecutive officers, directors and holders of 10% or more of our outstanding common stock beneficially owned, in the aggregate, approximately 29% of our outstanding common stock.

As a result, such persons, acting together, have significant ability to control our management and affairs and substantially all matters submitted to our stockholders for approval, including the election and removal of directors and approval of any significant transaction.

1 unchanged sentence

Future sales of shares by existing stockholders could cause our stock price to decline.

The market price of shares of our common stock could decline as a result of substantial sales of our common stock, particularly sales by our directors, executive officers, employees and significant stockholders, a large number of shares of our common stock becoming available for sale, or the perception in the market that holders of a large

number of shares intend to sell their shares.

As of March 31, 2020 , we had approximately 39.0 million shares of our common stock outstanding.

In addition, as of March 31, 2020 , there were approximately 1.1 million restricted stock units and options to purchase approximately 2.8 million shares of our common stock outstanding.

As of June 30, 2020, we had approximately 39.3 million shares of our common stock outstanding.

In addition, as of June 30, 2020, there were approximately 0.9 million restricted stock units and options to purchase approximately 2.4 million shares of our common stock outstanding.

If such options are exercised and restricted stock units are released, these additional shares will become available for sale.

As of March 31, 2020 , we had an aggregate of 7.2 million shares of our common stock reserved for future issuance under our 2012 Equity Incentive Plan, which can be freely sold in the public market upon issuance.

As of June 30, 2020, we had an aggregate of 7.2 million shares of our common stock reserved for future issuance under our 2012 Equity Incentive Plan, which can be freely sold in the public market upon issuance.

If a large number of these shares are sold in the public market, the sales could reduce the trading price of our common stock.

5 unchanged sentences

In addition, it may be suspended or terminated at any time, which may result in a decrease in the price of our common stock.

In the three months ended March 31, 2020 , we repurchased 346,250 shares of our common stock for an aggregate purchase price of approximately $28.9 million .

As of March 31, 2020, approximately $99.6 million remained available for share repurchases pursuant to our stock repurchase program.

In the three and six months ended June 30, 2020, we repurchased 242,500 and 588,750 shares of our common stock, respectively, for an aggregate purch ase price of approximately $25.3 million and $54.2 million, respectively.

As of June 30, 2020, approximately $174.4 million remained available for share repurchases pursuant to our stock repurchase program.

We do not intend to pay dividends on our common stock and therefore any returns will be limited to the value of our stock.

15 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-Q

Item 1A. Risk Factors