What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2026-03-19 compared with 2025-03-20 · 405 added, 362 removed, 817 unchanged (48% of the section changed)

7 unchanged sentences

Our rapid growth also makes it difficult to evaluate our future prospects.

Our revenue was $886.5 million, $627.9 million and $599.8 million for the fiscal years ended January 31, 2025, 2024 and 2023, respectively.

You should not rely on the revenue growth of any prior quarterly or annual period as an indication of our future performance.

Even if our revenue continues to increase, we expect that our revenue growth rate will fluctuate in the future as a result of a variety of factors, including our transition for new and existing customers to sales of Rubrik Security Cloud ("RSC"), for which an increasing amount of our software revenue will be recognized ratably.

Our revenue was $1.32 billion, $886.5 million and $627.9 million for the fiscal years ended January 31, 2026, 2025 and 2024, respectively.

You should not rely on the revenue growth of any prior period as an indication of our future performance.

Even if our revenue continues to increase, we expect that our revenue growth rate will fluctuate in the future as a result of a variety of factors.

While we have largely completed both the sales of Rubrik-branded Appliances transitioning from us to our contract manufacturers in fiscal 2025 and the transition for new and existing customers to sales of RSC in fiscal 2026, we expect our subscription revenue to continue to benefit from customers exercising or forfeiting their Subscription Credits (which are customer options that are accounted for as material rights) through fiscal 2027, although we expect the benefits to significantly reduce sequentially.

These business transitions cause fluctuations to our total revenue growth and limit the comparability of our revenue with past performance.

Overall growth of our revenue also depends on a number of factors, including our ability to:

• expand the features and functionality of our data security products as well as increase the amount of data sources protected across enterprise, cloud, and SaaS applications;

• expand the features and functionality of our data security products as well as increase the amount of data sources protected across enterprise, cloud, SaaS, unstructured data, and identity providers;

• securely deploy generative AI while delivering exceptional accuracy and efficiency using agentic applications;

• extend our product leadership to expand our addressable market;

11 unchanged sentences

If the assumptions that we use to plan our business are incorrect or if we are unable to maintain consistent revenue or revenue growth, our stock price could be volatile and we may not be able to achieve and maintain profitability.

You should not rely on our revenue for any prior quarterly or annual periods as any indication of our future revenue or revenue growth.

In addition, we expect to continue to expend substantial financial and other resources on:

2 unchanged sentences

• our cloud infrastructure technology, including systems architecture, scalability, availability, performance, and security;

• our use and development of AI technologies and tools;

• our partner ecosystem;

2026 Form 10-K 15

• international expansion;

1 unchanged sentence

• our information security program;

2025 Form 10-K 15

• general administration, including increased legal, human resources, and accounting expenses associated with being a public company.

3 unchanged sentences

If our revenue does not meet our expectations in future periods, our business, financial condition, and results of operations may be harmed.

If the market for data security solutions does not grow, our ability to grow our business and our results of operations may be adversely affected.

We believe our future success will depend in large part on the growth, if any, in the market for data security solutions.

If the market for data security and AI solutions does not grow, our ability to grow our business and our results of operations may be adversely affected.

We believe our future success will depend in large part on the growth, if any, in the market for data security and AI solutions.

Traditionally, the cybersecurity industry has been focused on securing information technology infrastructure to prevent, detect, and investigate cyberattacks.

Our platform brings a new approach to cybersecurity, which involves protecting our customers’ data across enterprise, cloud, and SaaS applications, observing the data itself to proactively identify emergent threats, remediating data security threats, and recovering protected data following a cybersecurity event.

The market for data security solutions, such as our platform and data security products, is at an early stage and rapidly evolving.

Our platform brings a new approach to cybersecurity, which involves protecting our customers’ data across enterprise, cloud, SaaS, unstructured data, and identity providers, observing the data itself to proactively identify emergent threats, remediating data security threats, and recovering protected data following a cybersecurity event, as well as helping customers manage risks associated with AI agents.

The market for data security and AI solutions, such as our platform and data security products, is at an early stage and rapidly evolving.

As such, it is difficult to predict this market’s potential growth, if any, customer adoption and retention rates, customer demand for data security platforms, or the success of competitive products.

1 unchanged sentence

We do not know whether the trends of increasing ransomware activity, or of increasing adoption of our platform and data security products such as ours that we have experienced in the past, will continue in the future.

Any expansion in this market depends on a number of factors, including the cost, performance, and perceived value associated with our platform and data security products and similar solutions of our competitors, including preference to manage security with existing infrastructure security tools alone, rather than investing in a platform based data security solution.

The markets for some of our solutions are new, unproven, and evolving, and our future success depends on growth and expansion of these markets.

1 unchanged sentence

You should consider our business and growth prospects in light of the risks and difficulties we encounter in this new and evolving market.

We have a limited operating history, particularly with respect to our offering of RSC, which makes it difficult to forecast our future results of operations.

Although we were founded in December 2013, we only began offering our products and services in the fiscal year ended January 31, 2016, and we began offering RSC as a cloud native SaaS solution in fiscal 2023.

We have a limited operating history, particularly with respect to our offerings of RSC and RAC, which makes it difficult to forecast our future results of operations.

As a result of our limited operating history, our ability to accurately forecast our future results of operations is limited and subject to a number of uncertainties, including our ability to plan for and forecast future growth.

Our historical revenue growth should not be considered indicative of our future performance.

Further, in future periods, we expect our revenue growth to fluctuate, slow, and possibly decline for a number of reasons, including mix shifts in our platform and data security products, as well as the impact on our revenue recognition resulting from our transition from selling our products primarily on the basis of subscription term-based licenses to SaaS subscriptions.

The timing for this transition and related implications on our revenue recognition and trends will depend on our ability to transition existing customers to RSC in a timely manner.

We are implementing certain initiatives to accelerate our existing customers’ migration to RSC as part of our business transition to SaaS, which include enforcement of migration deadlines.

These initiatives may be perceived negatively by our customers.

For example, these initiatives may require customers to prioritize preparation for their migration over other organizational needs, potentially resulting in diversion of resources.

For certain existing customers, the perceived benefits from undertaking the migration may be outweighed by the anticipated time and effort required to prepare for and execute the migration, resulting in potential delays in customers’ transition to RSC.

We expect these customers may consume our platform and products through a mix of RSC and a transitional license for Cloud Data Management ("RCDM-T"), for an extended period of time, resulting in the continued recognition of a portion of the associated revenue for some of these customers upfront at the time we transfer control of the license to the customer.

Conversely, if some or all of these customers complete their transition to RSC sooner than we expect, less revenue would be recognized upfront during this period, which could cause our revenue to be lower than our estimates or forecasts or even result in a decrease in our revenue growth rates.

Any of these factors could result in continued fluctuations in our revenue growth and adversely impact our ability to accurately predict our future revenue.

Further, in future periods, we expect our revenue growth to fluctuate, slow, and possibly decline for a number of reasons, including mix shifts in our platform and data security products.

In future periods, our revenue growth may fluctuate, slow or decline due to a number of factors, including changes in product mix.

While we have largely completed both the transition of sales of Rubrik-branded Appliances from us to our contract manufacturers in fiscal 2025 and the transition for new and existing customers to sales of RSC in fiscal 2026, we expect our subscription revenue to continue to benefit from customers exercising or forfeiting their Subscription Credits (which are customer options that are accounted for as material rights) through fiscal 2027, although we expect the benefits to significantly reduce sequentially.

These business transitions cause fluctuations to our total revenue growth and limit the comparability of our revenue with past performance.

2026 Form 10-K 16

In addition, we operate in a new market for data security solutions, and as such we have encountered, and will continue to encounter, risks and uncertainties frequently experienced by growing companies in new and rapidly changing markets, such as the risks and uncertainties described throughout this section.

In addition, we operate in a new market for data security and AI solutions, and as such we have encountered, and will continue to encounter, risks and uncertainties frequently experienced by growing companies in new and rapidly changing markets, such as the risks and uncertainties described throughout this section.

Further, our business and growth strategies are also dependent on continued development, and implementation and integration of our AI offerings and initiatives, including RAC, which is designed to accelerate enterprise AI agent deployments.

While we have invested significantly in our AI offerings and initiatives and intend to continue doing so in the future, AI technology is expected to continue to rapidly advance.

We may not be successful in obtaining and maintaining market acceptance of our AI offerings and initiatives, including RAC, particularly as competitive technologies and solutions are introduced.

Any of these outcomes could harm our business, results of operations, and financial condition.

Moreover, in future periods, our revenue growth could slow or decline due to slowing demand for our platform or data security products, increasing competition, decreased productivity of our sales and marketing organization, failure to retain existing customers or expand existing subscriptions, changing technology, a decrease in the growth of our overall market, evolving macroeconomic conditions, such as high inflation and recessionary environments, or our failure, for any reason, to continue to take advantage of growth opportunities.

1 unchanged sentence

If we are unable to attract new customers, our future results of operations could be harmed.

To expand our customer base, we need to convince organizations to allocate a portion of their discretionary budgets to purchase our platform and data security products.

Our sales efforts often involve educating organizations about the uses and benefits of our data security solutions.

We may have difficulty convincing organizations of the value of adopting our data security solutions.

Even if we are successful in convincing organizations that a platform like ours is critical to secure their data, they may not decide to purchase our data security solutions for a variety of reasons, some of which are out of our control.

To expand our customer base, we need to convince organizations to allocate a portion of their discretionary budgets to purchase our platform and products.

Our sales efforts often involve educating organizations about the uses and benefits of our data security and AI solutions.

We may have difficulty convincing organizations of the value of adopting our solutions.

Even if we are successful in convincing organizations that a platform like ours is critical to secure their data, they may not decide to purchase our solutions for a variety of reasons, some of which are out of our control.

For example, any deterioration in general economic conditions has in the past caused, and may in the future cause, our current and prospective customers to delay or cut their overall security and IT operations spending.

Macroeconomic concerns, customer financial difficulties, and constrained spending on security and IT operations may result in decreased revenue and adversely affect our financial condition and results of operations.

In particular, uncertainty related to recent global tariffs may impact customer adoption and use of our offerings and revenue from sales of our products and services.

Additionally, if the incidence of cyberattacks were to decline, or enterprises or governments perceive that the general level of cyberattacks has declined, our ability to attract new customers could be adversely affected.

We may face additional difficulties in attracting organizations that use legacy data management products to purchase our data security products if they believe that these legacy products are more cost-effective or provide a level of IT security that is sufficient to meet their needs.

Furthermore, the use of our data security products to manage data security, movement, and restoration across data centers is relatively new, and if we are unable to convince organizations of the benefits of our data security products, then our business, financial condition, and results of operations could be adversely impacted.

Furthermore, the use of our data security products to manage data security, movement, and restoration across data centers is relatively new, and if we are unable to convince organizations of the benefits of our products, then our business, financial condition, and results of operations could be adversely impacted.

2026 Form 10-K 17

We have a history of operating losses and may not achieve or sustain profitability in the future.

We have experienced net losses in each period since inception.

We generated net losses of $(1,154.8) million, $(354.2) million and $(277.7) million for the fiscal years ended January 31, 2025, 2024 and 2023, respectively.

As of January 31, 2025 and January 31, 2024, we had an accumulated deficit of $(2,837.3) million and $(1,682.5) million, respectively.

We generated net losses of $(348.8) million, $(1.15) billion and $(354.2) million for the fiscal years ended January 31, 2026, 2025 and 2024, respectively.

As of January 31, 2026 and January 31, 2025, we had an accumulated deficit of $(3.19) billion and $(2.84) billion, respectively.

While we have experienced rapid revenue growth in recent periods, we are not certain whether or when we will obtain a high enough volume of sales to achieve or maintain profitability in the future.

3 unchanged sentences

We will also face increased compliance costs associated with growth, the planned expansion of our customer base and pipeline, international expansion, and being a public company.

In addition, our data security solutions operate on a public cloud infrastructure provided by third-party vendors, including Google Cloud ("GCP"), Microsoft Azure ("Azure"), and Amazon Web Services ("AWS"), and our costs and gross margins are significantly influenced by the prices we are able to negotiate with these public cloud providers.

In addition, our data security and AI solutions operate on a public cloud infrastructure provided by third-party vendors, including Google Cloud ("GCP"), Microsoft Azure ("Azure"), and Amazon Web Services ("AWS"), and our costs and gross margins are significantly influenced by the prices we are able to negotiate with these public cloud providers.

To the extent we are able to drive adoption of our platform and data security products, we may incur increased costs related to our public cloud contracts, which would negatively impact our gross margins.

3 unchanged sentences

If we are unable to achieve and sustain profitability, the value of our business and Class A common stock may significantly decrease.

2025 Form 10-K 17

Furthermore, we have historically sold our products to customers as perpetual licenses with associated maintenance contracts or as subscription term-based licenses with associated support, and with respect to the latter, we recognized a portion of the revenue upfront at the time we transferred control of the subscription term-based license to the customer and deferred the remainder.

Moving forward, we expect that substantially all of our new and existing customers will continue to adopt RSC primarily on a SaaS subscription basis.

As of the end of fiscal 2024, RSC represented a majority of our total revenue.

In addition, we have historically sold Rubrik-branded Appliances to help our customers secure their enterprise data.

In the third quarter of fiscal 2023, we began transitioning the sale of Rubrik-branded Appliances from us to our contract manufacturers, and as a result, the amount of revenue we recognize from sales of Rubrik-branded Appliances has and will continue to decline over time.

We expect these transitions to adversely affect our revenue as well as our profitability through the fiscal year ending January 31, 2027.

However, this timing will depend in part on when a substantial portion of our existing customers complete their transition to RSC.

In addition, following the completion of our IPO, the stock-based compensation expense related to our RSUs has resulted in and will continue to result in significant increases in our expenses in future periods, which may negatively impact our ability to achieve profitability.

If our customers do not renew their subscriptions for our platform and data security products or expand their subscriptions to increase the amount of data secured, secure new applications, or include new features or capabilities, our results of operations could be harmed.

In order for us to maintain or improve our results of operations, it is important that our customers renew their subscriptions for our data security solutions, add data security products, and increase the volume of their data protected by our data security solutions.

We have substantially completed our transition to offering our platform primarily through SaaS subscriptions, and a significant majority of our new and existing customers have adopted RSC on a SaaS subscription basis.

As of the end of fiscal 2026, SaaS subscriptions represented a majority of our total revenue.

We have also largely completed the transition of sales of Rubrik-branded Appliances from us to our contract manufacturers in fiscal 2025.

We expect our subscription revenue to continue to benefit from customers exercising or forfeiting their Subscription Credits (which are customer options that are accounted for as material rights) through fiscal 2027, although we expect the benefits to significantly reduce sequentially.

These business transitions may continue to cause fluctuations to our total revenue growth and limit the comparability of our revenue with past performance.

In addition, the stock-based compensation expense related to our RSUs has resulted in and will continue to result in significant increases in our expenses in future periods, which may negatively impact our ability to achieve profitability.

2026 Form 10-K 18

If our customers do not renew their subscriptions for our platform and products or expand their subscriptions to increase the amount of data secured, secure new applications, or include new features or capabilities, our results of operations could be harmed.

In order for us to maintain or improve our results of operations, it is important that our customers renew their subscriptions for our data security solutions, add data security or AI products, and increase the volume of their data protected by our solutions.

Our AI solutions, including RAC, are relatively new, and customer adoption and expansion of these solutions may be uncertain.

We expand our commercial purchase relationships with our existing customers as they increase the volume of their data protected by our data security solutions and secure additional applications and workloads.

1 unchanged sentence

In addition, customers may elect to shorten the term of their subscription, select a lower subscription edition, or purchase less capacity.

Our customer retention and expansion may also decline or fluctuate as a result of a number of factors, including our customers’ satisfaction with our data security solutions, our pricing, customer prioritization of security, our customers’ spending levels, our customers’ ability to procure Rubrik-branded Appliances or other compatible third-party commodity servers to implement our data security products, mergers and acquisitions involving our customers, industry developments, competition, changing regulatory environments, and general economic conditions.

Our strategies and initiatives to accelerate the transition of our existing customers to RSC, even if executed properly by our sales and support teams, may result in customer dissatisfaction, the loss of customers, or reduced usage of our platform, any of which would harm our business, financial condition, and results of operations.

Our customer retention and expansion may also decline or fluctuate as a result of a number of factors, including our customers’ satisfaction with our data security solutions, our pricing, customer prioritization of security, our customers’ security and IT operations spending, our customers’ ability to procure Rubrik-branded Appliances or other compatible third-party commodity servers to implement our data security products, mergers and acquisitions involving our customers, industry developments, competition, changing regulatory environments, and macroeconomic uncertainty related to recent global tariffs, the direct and indirect impact of which continues to evolve.

Moreover, customers tend to expand their usage of our data security solutions over time as the amount of data they need to protect grows.

As a result, strong customer retention over time generally leads to a higher degree of usage of our data security solutions.

As a result, strong customer retention over time generally leads to a higher degree of usage of our solutions.

Therefore, a decline in customer retention may have a significant impact on our results of operations, including a decline in our average subscription dollar-based net retention rate, which could cause the price of our Class A common stock to decline or fluctuate.

If our efforts to maintain and expand our relationships with our existing customers are not successful, our business, financial condition, and results of operations may suffer.

If our data security solutions fail or do not perform as intended or are perceived to have defects, errors, or vulnerabilities, our brand and reputation will be harmed, which would adversely affect our business and results of operations.

Our data security solutions are complex and, like all software, have in the past contained and may in the future contain undetected defects, errors, or vulnerabilities.

If our solutions fail or do not perform as intended or are perceived to have defects, errors, or vulnerabilities, our brand and reputation will be harmed, which would adversely affect our business and results of operations.

Our solutions are complex and, like all software, have in the past contained and may in the future contain undetected defects, errors, or vulnerabilities.

From time to time, we identify certain vulnerabilities in our information systems.

1 unchanged sentence

Moreover, we may also experience delays in developing and deploying remedial measures and patches designed to address any identified vulnerabilities.

Real or perceived defects, errors, or vulnerabilities in our data security solutions, the failure of our data security solutions to secure, observe, and restore our customers’ data, misconfiguration of our data security solutions, the exploitation of any known or unknown vulnerabilities, or the failure of customers to deploy our data security solutions in combination with industry best practices could harm our reputation, result in a loss of, or delay in, market acceptance of our data security solutions, result in a loss of existing or potential customers, and adversely affect our business, financial condition, and results of operations.

We are continuing to evolve the features and functionality of our data security products through updates and enhancements, and as we do so, we may inadvertently introduce defects, errors, or vulnerabilities that may not be detected until after deployment by our customers.

In addition, implementation or use of our data security solutions that is not correct or as intended may result in adverse consequences such as inadequate performance and disruptions in service.

Real or perceived defects, errors, or vulnerabilities in our solutions, the failure of our solutions to secure, observe, and restore our customers’ data, misconfiguration of our solutions, the exploitation of any known or unknown vulnerabilities, or the failure of customers to deploy our solutions in combination with industry best practices could harm our reputation, result in a loss of, or delay in, market acceptance of our solutions, result in a loss of existing or potential customers, and adversely affect our business, financial condition, and results of operations.

We are continuing to evolve the features and functionality of our products through updates and enhancements, and as we do so, we may inadvertently introduce defects, errors, or vulnerabilities that may not be detected until after deployment by our customers.

In addition, implementation or use of our solutions that is not correct or as intended may result in adverse consequences such as inadequate performance and disruptions in service.

Moreover, if we acquire companies or technologies developed by third parties, difficulties integrating such acquired technologies may result in product flaws or software vulnerabilities.

2025 Form 10-K 18

Additionally, we cannot assure you that our data security solutions will prevent all data loss or other types of data security incidents, especially in light of the rapidly changing security threat landscape that our data security solutions seek to address.

Due to a variety of both internal and external factors, our data security solutions could become vulnerable to security incidents (both from intentional attacks and accidental causes) that could cause them to fail to adequately secure or observe data or to restore data in the event of a security incident.

Moreover, our data security solutions are adopted by, and part of the supply chain of, a large and increasing number of organizations worldwide, our solutions have been and may in the future be subject to continued, persistent research and reconnaissance by threat actors in order to discover and exploit weaknesses in our technology that can be exploited.

If our data security solutions are compromised, a significant number or, in some instances, all, of our customers and their data could be adversely affected.

Additionally, we cannot assure you that our solutions will prevent all data loss or other types of data security incidents, especially in light of the rapidly changing security threat landscape that our solutions seek to address.

Due to a variety of both internal and external factors, our solutions could become vulnerable to security incidents (both from intentional attacks and accidental causes) that could cause them to fail to adequately secure or observe data or to restore data in the event of a security incident.

Moreover, our solutions are adopted by, and part of the supply chain of, a large and increasing number of organizations worldwide, our solutions have been and may in the future be subject to continued, persistent research and reconnaissance by threat actors in order to discover and exploit weaknesses in our technology that can be exploited.

If our solutions are compromised, a significant number or, in some instances, all of our customers and their data could be adversely affected.

The potential liability and associated consequences we could suffer as a result of such a large-scale event could be catastrophic and result in irreparable harm.

Since our business is focused on providing data security services to our customers, an actual or perceived security incident affecting our data security solutions would be especially detrimental to our reputation and our business.

Since our business is focused on providing data security services to our customers, an actual or perceived security incident affecting our solutions would be especially detrimental to our reputation and our business.

Because we can access customer data in certain limited circumstances, such as when providing customer support, and such customer data in some cases may contain personal data or confidential information, a security compromise, or an accidental or intentional misconfiguration or malfunction of our platform, could result in personal data and other confidential information being compromised.

If a high-profile cyberattack occurs with respect to our or another cloud-based security platform or a third-party cloud provider, organizations may lose trust in SaaS platforms and associated products such as ours.

We and our service providers have been subject to cyberattacks that have occurred in the past and may occur in the future, and our customers or other organizations may lose trust in solutions such as ours.

2026 Form 10-K 19

Organizations are increasingly subject to a wide variety of cyberattacks on their networks, systems, and data.

If any of our customers experience a cyberattack while using our data security solutions and are unable to secure, observe, or restore their data, such customers could discontinue use of our data security solutions, regardless of whether our data security solutions were adequately deployed, configured, or used to protect the data in the customer’s environment.

If any of our customers experience a cyberattack while using our solutions and are unable to secure, observe, or restore their data, such customers could discontinue use of our solutions, regardless of whether our solutions were adequately deployed, configured, or used to protect the data in the customer’s environment.

Real or perceived security incidents involving our customers' networks could cause disruption or damage to their networks or other negative consequences and could result in negative publicity to us, damage to our reputation, and other customer relations issues, any of which may adversely affect our revenue and results of operations.

In addition, errors in our data security solutions could cause system failures, loss of data, or other adverse effects for our customers, which may result in the assertion of warranty and other claims for substantial damages against us.

In addition, errors in our solutions could cause system failures, loss of data, or other adverse effects for our customers, which may result in the assertion of warranty and other claims for substantial damages against us.

The potential liability and associated consequences we could suffer as a result of such an incident could be catastrophic and cause irreparable harm to our reputation and results of operations.

7 unchanged sentences

We collect such information from individuals located both in the United States and abroad and may store or process such information outside the country in which it was collected.

2025 Form 10-K 19

Organizations, particularly organizations like ours that provide data security solutions, experience and are subject to a wide variety of attacks on their networks, systems, and endpoints, and techniques used to sabotage or to obtain unauthorized access to networks in which data is stored or through which data is transmitted change frequently.

For example, in March 2023, we announced that a malicious third party gained unauthorized access to a limited amount of information in one of our non-production information technology testing environments.

In addition, in February 2025, we announced that we observed anomalous activity on a server that contained log files, certain of which were accessed by an unauthorized actor.

Neither of these incidents resulted in access to data that we secure on behalf of customers or access to our internal code, and there was no disruption to our business or financial systems or to other operations.

For example, in February 2025, we announced that we observed anomalous activity on a server that contained log files, certain of which were accessed by an unauthorized actor.

This incident did not result in access to data that we secure on behalf of customers or access to our internal code, and there was no disruption to our business or financial systems or to other operations.

However, there can be no guarantee that any attack in the future will have a similarly minimal impact, should one occur.

2 unchanged sentences

Some actors now engage in and are expected to continue to engage in cyberattacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities.

During times of war and other major conflicts, we and the third parties with whom we work, and our customers may be vulnerable to a heightened risk of these attacks, including retaliatory cyberattacks, that could materially disrupt our systems and operations, supply chain, and ability to produce, sell, and distribute our data security solutions.

We and the third parties with whom we work are subject to a variety of evolving threats, including but not limited to social-engineering attacks (including through phishing attacks), malicious code (such as viruses and worms), computer generated or altered fraudulent content (i.e., “deep fakes,” which may be increasingly difficult to identify), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks, credential stuffing attacks, credential harvesting, personnel misconduct or error, other inadvertent compromises of our systems and data (including those arising from process, coding, or human error), ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or commodity appliance failures, loss of data or other information technology assets, adware, telecommunications failures, attacks enhanced or facilitated by artificial intelligence ("AI"), and other similar threats.

2026 Form 10-K 20

In particular, severe ransomware attacks are becoming increasingly prevalent and can lead to significant interruptions in our operations, loss of sensitive information and income, reputational harm, and diversion of funds.

13 unchanged sentences

Vulnerabilities in our information systems have been, and could in the future be, exploited and result in a security incident.

2025 Form 10-K 20

We employ a shared responsibility model where our customers are responsible for using, configuring and otherwise implementing security measures related to our platform, services and products in a manner that meets applicable cybersecurity standards, complies with laws, and addresses their information security risk.

2 unchanged sentences

In certain cases where our customers choose not to implement, or incorrectly implement, such features or measures, misuse our services, or otherwise experience their own vulnerabilities, policy violations, credential exposure or security incidents, even if we are not the cause of customer security issue or incident that may result, our customer relationships reputation, and revenue may be adversely impacted.

Any of the previously identified vulnerabilities or cybersecurity threats could cause a security incident or other interruption that could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our Sensitive Information or our information technology systems, or those of the third parties upon whom we rely.

Furthermore, threat actors may also gain access to other networks and systems after a compromise of our networks and systems.

For example, threat actors may use an initial compromise of one part of our environment to gain access to other parts of our environment, or leverage a compromise of our networks or systems to gain access to the networks or systems of third parties with whom we work, such as through phishing or supply chain attacks.

Any of the previously identified vulnerabilities or cybersecurity threats have in the past caused and may in the future cause a security incident or other interruption resulting in consequences such as unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our Sensitive Information or our information technology systems, or those of the third parties upon whom we rely.

A security incident or other interruption could partially or fully disrupt our ability (and that of third parties upon whom we rely) to provide our platform.

2 unchanged sentences

Even if such an incident is unrelated to our security practices, it could result in our incurring significant economic and operational costs in investigating, remediating, and implementing additional measures to further protect our customers from their own security issues or vulnerabilities and could result in reputational harm.

2026 Form 10-K 21

Certain data privacy and security obligations may require us to implement and maintain specific security measures or industry standard, reasonable security measures to protect our information technology systems and sensitive information.

Additionally, applicable data privacy and security obligations may require us, or we may voluntarily choose, to notify relevant stakeholders, including affected individuals, customers, regulators, and investors, of security incidents, or to implement other requirements, such as providing credit monitoring.

Additionally, applicable data privacy and security obligations have in the past required us and may in the future require us, or we may voluntarily choose, to notify relevant stakeholders, including affected individuals, customers, regulators, and investors, of security incidents, or to implement other requirements, such as providing credit monitoring.

Such disclosures, and compliance with such requirements, are costly, and the disclosure or the failure to comply with such requirements could lead to adverse consequences.

Though we have expended, and anticipate continuing to expend, significant resources to try to protect against security incidents by implementing technical, administrative, and physical measures designed to protect the privacy and security of data running through our, and our third parties’, systems, it is virtually impossible for us to entirely eliminate the risk of such security incidents or interruptions.

If we (or a third party with whom we work) experience a security incident or are perceived to have experienced a security incident, which has happened in the past, we may experience adverse consequences such as government enforcement actions (for example, investigations, fines, penalties, audits, and inspections);

If we (or a third party with whom we work, including our suppliers) experience a security incident or are perceived to have experienced a security incident, which has happened in the past, we may experience adverse consequences such as government enforcement actions (for example, investigations, fines, penalties, audits, and inspections);

additional reporting requirements and/or oversight;

9 unchanged sentences

and other similar harms.

Security incidents and attendant material consequences may prevent or cause customers to stop purchasing our data security solutions, deter new customers from purchasing our data security solutions, and negatively impact our ability to grow and operate our business.

Security incidents and attendant material consequences may prevent or cause customers to stop purchasing our solutions, deter new customers from purchasing our solutions, and negatively impact our ability to grow and operate our business.

As a data security company, we could be exposed to additional reputational risks should a security incident occur.

1 unchanged sentence

We cannot be sure that our insurance coverage will be adequate or sufficient to protect us from or to mitigate liabilities arising out of our privacy and security practices, that such coverage will continue to be available on commercially reasonable terms or at all, or that such coverage will pay future claims.

The limited number of contract manufacturers and original equipment manufacturers that produce commodity servers that are compatible with our solutions are susceptible to supply chain disruptions and have recently experienced shortages of key components for their servers, which may adversely affect our ability to accurately forecast demand for these commodity servers or successfully manage the relationship with such manufacturers, and could negatively impact demand for our offerings, and adversely affect our business and financial results.

A limited number of Manufacturers produce commodity servers that are compatible with our solutions.

We do not own or operate any manufacturing facilities and rely on these Manufacturers for such products.

These Manufacturers manage the supply chain for these products and, alone or together with us or our distributors and resellers ("Channel Partners"), negotiate component costs.

Our reliance on Manufacturers and Channel Partners reduces our control over the assembly process, quality assurance, production costs, and product supply.

If the relationships with Manufacturers are not properly managed or if Manufacturers experience delays, interruptions, or supply-chain disruptions, including due to international conflicts and geopolitical tensions (such as the imposition of new trade restrictions and tariffs due to escalating tensions, hostilities, or trade disputes), health epidemics or pandemics, new trade laws and regulations, capacity constraints, or quality control problems in their operations, the ability for customers to procure compatible commodity servers could be impaired.

For example, key components of the commodity servers that are compatible with our solutions have been, and continue to be, adversely affected by global chip shortages and allocation constraints, in part due to elevated industry demand, which in certain cases have resulted in extended lead times and increased server prices.

While we have largely completed the sales of Rubrik-branded Appliances transitioning from us to our contract manufacturers in fiscal 2025, such delays, constraints and increased costs may adversely affect our customers’ purchasing decisions and deployment timelines.

In response, we may in the future provide commercial accommodations, which could reduce our margins or adversely affect our business if such practices become widespread or prolonged.

If such conditions persist or worsen, potential new customers could defer, delay, scale back, or in some cases forego purchases or deployments of our solutions until compatible commodity servers are available or total solution costs decline.

Any such disruptions, shortages, or resulting delays may also require us or our Channel Partners to adjust forecasts, reschedule orders, or qualify alternative Manufacturers.

If we or our Channel Partners are required to change or qualify a new Manufacturer for any reason, including financial considerations, reduction of manufacturing output made available to us, or the termination of our or our Channel Partners’ contract with the Manufacturers, we may lose revenue and incur increased costs to the extent that we are even able to identify and qualify a new Manufacturer.

In addition, our contract manufacturers may terminate the agreement with us or our Channel Partners with prior notice for reasons such as failure to perform a material contractual obligation.

2026 Form 10-K 22

Our use of generative artificial intelligence tools may pose risks to our proprietary software and systems and subject us to legal liability.

We use generative AI tools in our business, and we expect to use generative AI tools in the future, including to generate code and other materials incorporated into our products, proprietary software, and systems, and for other internal and external uses.

Generative AI refers to deep-learning models that can generate new data, such as text, images, and other content, by analyzing and emulating existing data.

A large majority of the customer enterprise data we secure relies upon Rubrik-branded Appliances, which are currently built on servers supplied and designed by Super Micro Computer, Inc.

("Supermicro").

If we are unable to manage our relationship with Supermicro effectively, or if Supermicro continues to suffer delays or disruptions for any reason, including due to the global chip shortage that the broader industry is currently experiencing, any other component allocation constraints, increased manufacturing lead-times, capacity constraints, quality control problems in its manufacturing operations, or international trade disputes, tariffs or other protectionist measures, or fails to meet our requirements for timely delivery, or if Supermicro no longer produces the servers for our Rubrik-branded Appliances, our indirect costs may increase and our end-customer’s ability to procure Rubrik-branded Appliances in a timely manner would be impaired to the extent that any alternative commodity servers are available at all.

Our agreement with Supermicro does not provide long-term price assurances for certain components used in Rubrik-branded Appliances, and increases in component or server costs could increase the total price customers pay to implement our solutions.

While we have largely completed the sales of Rubrik-branded Appliances transitioning from us to our contract manufacturers in fiscal 2025, any such cost increases, including those resulting from chip shortages or allocation constraints, could adversely affect customer demand for our offerings or the timing of purchases and deployments.

While customers would have the ability to purchase compatible third-party commodity servers from other OEMs, and we have the ability to qualify new commodity servers for Rubrik-branded Appliances, this may create increased costs or delays for our customers and impact their customer experience, which could negatively impact our sales and our business.

See the section titled “Business—Manufacturing” in our Annual Report for additional information regarding our contractual relationship with Supermicro.

Certain of our OEMs carry products that compete with our solutions and may not continue producing or supporting compatible commodity servers for our customers in the future.

We or our Channel Partners provide forecasts and purchase orders to Manufacturers for compatible commodity servers, and these orders may only be rescheduled or canceled under certain limited conditions.

If we inaccurately forecast demand for our solutions and need for compatible commodity servers, our Manufacturers may have excess or inadequate inventory, and we may incur cancellation charges or penalties, which could adversely impact our operating results.

If we experience increased demand for compatible commodity servers, then we, our Channel Partners, or Manufacturers may need to increase component purchases, contract manufacturing capacity, or internal test and quality functions.

Our customers’ orders may represent a relatively small percentage of the overall orders received by Manufacturers from their customers.

As a result, fulfilling our customers’ orders may not be considered a priority in the event Manufacturers are constrained in their ability to fulfill all of their customer obligations in a timely manner.

Although we have largely transitioned the sale of Rubrik-branded Appliances from us to our contract manufacturers, if Manufacturers are unable to provide adequate supplies of high-quality products, or if we, our Channel Partners, or Manufacturers are unable to obtain adequate quantities of components, or control the costs of components, it could cause a delay in the fulfillment of our customers’ orders, in which case our business, financial condition, and results of operations could be adversely affected.

Tariffs and other restrictive trade policies, such as those regarding hardware and technology infrastructure from China, have had and may continue to have an indirect impact on the total price customers pay for our products and may also impact production and supply of our Rubrik-branded Appliances and the commodity servers compatible with our solutions.

These impacts could negatively affect customer experience, demand, and the attractiveness of our solutions relative to alternatives.

2026 Form 10-K 23

Our use of generative and other AI tools may pose risks to business and operations, including our proprietary software and systems, and may subject us to legal liability.

We use AI tools in our business, including generative AI and agentic AI, and we expect to use AI tools in the future, including to generate code and other materials incorporated into our products, proprietary software, and systems, and for other internal and external uses, and we are making investments to expand our generative and agentic AI capabilities, including recent and future product offerings such as Rubrik Agent Cloud, which is designed to accelerate enterprise AI agent deployments.

Advanced generative AI tools, which may produce content indistinguishable from that generated by humans, are a relatively novel development, with benefits, risks, and liabilities still unknown.

8 unchanged sentences

Likewise, the availability of such IP protections in other countries is unclear.

In addition, we may have little or no insight into and no control over the content and materials used by vendors to train these generative AI tools.

In addition, we may have little or no insight into and no control over the content and materials used by vendors and model providers to train these generative AI tools, or that otherwise use or incorporate these generative AI tools into their own offerings.

There is ongoing litigation over whether the use of copyrighted materials to train the AI models used in these tools is lawful, and the impact of decisions in such litigation on our use of generative AI tools is unknown.

Additionally, our use of third-party generative AI tools to develop source code, text, images, inventions, or other materials may expose us to greater risks than utilizing contracted human developers, as third-party generative AI vendors typically do not provide warranties or indemnities with respect to the output generated by such generative AI tools, and generative AI tools may also hallucinate, providing output that appears correct but is erroneous.

Furthermore, some generative AI tools may be offered under terms that do not protect the confidentiality of the prompts or inputs that users submit to such tools and may use prompts or inputs to train shared AI models, potentially resulting in third-party users receiving outputs containing information from prompts or inputs (including confidential, competitive, proprietary, or personal data) that we submitted to the tool.

Furthermore, our vendors who use generative and agentic AI tools in their own offerings may not meet existing or rapidly evolving regulatory or industry standards, including with respect to the rights of others, privacy and data security.

Additionally, our use of open-source and other third-party generative and agentic AI tools, including to develop source code, text, images, inventions, or other materials, may expose us to greater risks than utilizing contracted human developers, as such AI tools typically do not come with warranties or indemnities with respect to the output generated by such AI tools, and generative and agentic AI tools may also hallucinate, providing erroneous output or making erroneous decisions.

Furthermore, some AI tools may be offered under terms that do not protect the confidentiality of the prompts or inputs that users submit to such tools and may use prompts or inputs to train shared AI models, potentially resulting in third-party users receiving outputs containing information from prompts or inputs (including confidential, competitive, proprietary, or personal data) that we submitted to the tool.

The disclosure and use of personal data in AI technologies is also subject to various privacy laws and other privacy obligations.

Prior to implementing a generative AI tool, our AI governance committee (including leaders from our Engineering, Product, Legal, and Information Security teams) performs an analysis and review of the tool, including evaluation of potential legal, security, and business risks and steps that can be taken to mitigate any such risks.

The selection criteria and analysis include consideration of how use of the generative AI tool could raise issues relating to confidential information, personal data and privacy, customer data and contractual obligations, open source software, copyright and other intellectual property rights, transparency, output accuracy and reliability, and security.

Additionally, while we employ practices designed to evaluate, track, and mitigate risk around our use of third-party generative AI tools, our use of such tools may inadvertently violate a third party’s rights, be non-compliant with the applicable terms of use or our other legal obligations, or result in a security or privacy risk or data leakage.

Our use of this technology could result in additional compliance costs, regulatory investigations and actions, and lawsuits.

For example, we may face claims from third parties claiming infringement of their intellectual property rights or mandatory compliance with open-source software or other license terms with respect to software or other materials or content we believed to be available for use and not subject to license terms or other third-party proprietary rights.

Any of these claims could result in legal proceedings and could require us to purchase costly licenses, comply with the requirements of third-party licenses, or limit or cease using the implicated software or other materials or content, unless and until we can re-engineer such software, materials, or content to avoid infringement or change the use of, or remove, the implicated third-party materials, which could reduce or eliminate the value of our technologies and services.

Our use of generative AI tools to generate code may also present additional security risks because the generated source code may contain security vulnerabilities.

Additionally, the vendors of these generative AI tools may fail to comply with their contractual obligations to us regarding the confidentiality or security of any data or other inputs provided to such vendor or outputs generated by their generative AI tools.

Our sensitive information or that of our customers could be leaked, disclosed, or revealed as a result of or in connection with our employees’, personnel’s, or vendors’ use of third-party generative AI technologies.

Prior to implementing an AI tool (including generative AI tools), our AI governance committee (including leaders from our Engineering, Product, Legal, and Information Security teams) performs an analysis and review of each AI tool for which pre-approval is required according to our policies, including evaluation of potential legal, security, and business risks and steps that can be taken to mitigate any such risks.

The selection criteria and analysis include consideration of how use of the AI tool could raise issues relating to confidential information, personal data and privacy, customer data and contractual obligations, open source software, copyright and other intellectual property rights, transparency, output accuracy and reliability, and security.

Additionally, while we employ practices designed to evaluate, track, and mitigate risk around our use of third-party AI tools, our practices may not be error free, and our use of such tools may inadvertently violate a third party’s rights, be non-compliant with the applicable terms of use or our other legal obligations, or result in a security or privacy risk or data leakage.

Our use of AI technology could result in additional compliance costs, regulatory investigations and actions, and lawsuits.

For example, we may face new or enhanced governmental scrutiny, or claims from third parties claiming infringement of their intellectual property rights or mandatory compliance with open-source software or other license terms with respect to software or other materials or content we believed to be available for use and not subject to license terms or other third-party proprietary rights.

Any of these claims could result in legal investigations or proceedings.

Furthermore, if we are found to be in violation of third party rights based on our use of AI tools, we could be required to purchase costly licenses, comply with the requirements of third-party licenses, or limit or cease using the implicated software or other materials or content, unless and until we can re-engineer such software, materials, or content to avoid infringement or change the use of, or remove, the implicated third-party materials, which could reduce or eliminate the value of our technologies and services.

Our use of generative and agentic AI tools to generate code may also present additional security risks because the generated source code may contain security vulnerabilities.

Additionally, vendors of AI tools may fail to comply with their contractual obligations to us regarding the confidentiality or security of any data or other inputs provided to such vendor or outputs generated by their AI tools.

2026 Form 10-K 24

We also market some of our own products or features as generative AI tools ("Generative AI Products").

Some of our customers, especially those in highly regulated industries, may be reluctant or unwilling to adopt Generative AI Products.

Accordingly, adoption of generative AI features in our products and marketing our products as Generative AI Products could reduce or delay customer adoption.

Because generative AI models can hallucinate and provide erroneous output, offering Generative AI Products could result in customer dissatisfaction or potentially claims against us arising out of customer reliance on erroneous output to their detriment.

Our Generative AI Products may require us to train or fine-tune AI models using datasets collected by us or from third-party vendors.

While we have processes and practices designed to ensure that we and any vendors that we use to source training data have the necessary rights to use such datasets for training our Generative AI Products, we may not in every instance be able to confirm that all of the information contained in such datasets has been obtained with the necessary permissions for us to use for purposes of our Generative AI Products.

For example, we may use publicly available data to train our Generative AI Products that contains information that was unlawfully acquired from third parties without our knowledge.

While we have employed processes designed to help us avoid using any personal data to train or fine-tune our Generative AI Products, it may be difficult for us to avoid or identify all instances where a user might nonetheless submit personal data to our Generative AI Products.

Furthermore, if we were to receive claims from third parties asserting rights against our use of certain datasets used to train our Generative AI Products, it may be difficult or impossible for us to disentangle our trained models from the subject matter of the claims.

Several jurisdictions around the globe, including in Europe and certain U.S.

states, have proposed, enacted, or are considering laws governing AI tools, including the EU’s AI Act and the Colorado AI Act.

We expect other jurisdictions will adopt similar laws.

We also market some of our own products or features as generative AI tools and AI infrastructure services ("AI Products").

Some of our customers, especially those in highly regulated industries, may be reluctant or unwilling to adopt AI Products.

Accordingly, adoption of AI features in our products and marketing our products as AI Products could reduce or delay customer adoption.

Because AI models and AI agents can hallucinate and provide erroneous output or make erroneous decisions, offering AI Products could result in customer dissatisfaction or potentially claims against us arising out of erroneous output or decisions.

Some of our AI Products may require us to train or fine-tune AI models using datasets collected by us or from third-party providers.

While we have processes and practices designed to ensure that we and any third-party providers of training data have the necessary rights to use such datasets for training our AI Products, we may not in every instance be able to confirm that all of the information contained in such datasets has been obtained with the necessary permissions for us to use for purposes of our AI Products.

For example, we may use publicly available data to train our AI Products that contain information that was unlawfully acquired from third parties without our knowledge.

While we have employed processes designed to help us avoid using any personal data to train or fine-tune our AI Products, it may be difficult for us to avoid or identify all instances where a user might nonetheless submit personal data to our AI Products.

Furthermore, if we were to receive claims from third parties asserting rights against our use of certain datasets used to train our AI Products, it may be difficult or impossible for us to disentangle our trained models from the subject matter of the claims.

Our AI Products may also rely on certain third party providers of AI technology.

Our success in deploying AI features and tools for our AI Products is reliant on these third parties and their platforms.

We cannot control the quality, availability or pricing of such third-party platforms, especially in a highly competitive environment.

If any such third-party platforms become incompatible with our offerings or unavailable for use or have degradations in performance, or if the providers of such models unfavorably change the terms on which their AI platforms are offered or terminate their relationship with us, our solutions may become less appealing to our customers.

In addition, for any third party providers of AI platforms that host platforms on our behalf any disruption, outage, or loss of information, data breaches, cybersecurity threats or other data loss through such hosted services could disrupt our operations or solutions, damage our reputation, cause a loss of confidence in our solutions, or result in legal claims or proceedings, for which we may be unable to recover damages from the affected provider.

Several jurisdictions around the globe, including in Europe, have proposed, enacted, or are considering laws governing AI tools, including the EU’s AI Act.

In the United States, where our operations are headquartered, several states are applying their data and consumer protection laws to AI, and/or have enacted, or are enacting or considering legal frameworks on AI, such as the California Bot Disclosure Law, the Utah Artificial Intelligence Policy Act, the Colorado Artificial Intelligence Act and the CCPA’s regulations regarding automated decision-making technology.

We expect other jurisdictions will adopt similar laws, and, as a result of the rapidly evolving regulatory landscape, implementation standards, enforcement practices, and available scope of protection are likely to remain uncertain for the foreseeable future, and we cannot yet determine the impact future laws, regulations, or standards may have on our business (including our positioning with respect to our competition) and may not always be able to anticipate how to respond to these laws or regulations.

Additionally, certain privacy laws extend rights to consumers (such as the right to delete certain personal data) and regulate automated decision making, which may be incompatible with our use of AI.

These obligations may make it harder for us to conduct our business using AI, lead to regulatory fines or penalties, require us to disclose or provide greater transparency regarding the nature of our Generative AI Products and the data we have employed to train them, require us to change our business practices, retrain our Generative AI Products, or prevent or limit our use of AI.

These obligations may make it harder for us to conduct our business using AI, lead to regulatory fines or penalties, require us to disclose or provide greater transparency regarding the nature of our AI Products and the data we have employed to train them, require us to change our business practices, retrain our AI Products, or prevent or limit our use of AI.

For example, the FTC has required other companies to delete (or “disgorge”) both the personal data that the FTC alleged were collected in violation of privacy laws as well as the algorithms and other insights that were developed or generated using such data.

If we cannot use AI or that use is restricted, our business may be less efficient, or we may be at a competitive disadvantage.

Also, the rapid evolution of AI technologies may require the expenditure of significant resources to design, develop, test and maintain our products and services to help ensure that our AI features and tools are implemented in accordance with applicable law and regulation and in a socially responsible manner and to minimize any real or perceived unintended harmful impacts.

We also may need to expend further resources to adjust our business practices, as these laws and regulations evolve, especially where requirements across jurisdictions are inconsistent.

Any of these risks could be difficult to eliminate or manage, and, if not addressed, could adversely affect our business, financial condition, results of operations, and growth prospects.

We expect our revenue mix and certain business factors to impact the amount of revenue recognized period to period, which could make period-to-period revenue comparisons not meaningful and difficult to predict.

We expect our revenue mix to vary over time due to a number of factors, including the timing of when customers adopt RSC and the mix of our subscriptions for different data security products.

2026 Form 10-K 25

Changes in our revenue mix may cause fluctuations in revenue recognized from period to period, which could make period-to-period revenue comparisons not meaningful and difficult to predict.

Our revenue mix may vary over time due to a number of factors, including the mix of our subscriptions for different data security products and the timing of remaining customer migrations to RSC or other SaaS offerings.

Our subscription revenue includes revenue from sales of subscription term-based licenses, a portion of which is recognized upfront when we transfer control of the subscription term-based license to the customer, and revenue from sales of SaaS subscriptions and support, which is recognized ratably over the contract period.

Due to the proportion of our contracts trending from subscription term-based licenses to SaaS subscriptions, the timing of the migration of our existing customers from Cloud Data Management to RSC, as well as the estimates and assumptions used to account for certain customers’ Subscription Credits (as defined below) related to their Refresh Rights (as defined below), our revenue may fluctuate and period-to-period revenue comparisons may not be meaningful, and our past results may not be indicative of future performance.

We cannot be certain how long these factors may persist.

For example, as our existing customers prepare to migrate to RSC, we expect certain of them to consume our solutions through a mix of RSC and RCDM-T during which time we will continue recognizing a portion of the associated revenue upfront.

As we have substantially completed our transition from subscription term-based licenses to SaaS subscriptions and migrated a significant majority of our existing customers to RSC, the proportion of revenue recognized upfront versus ratably over time has evolved.

However, the timing of remaining customer migrations, as well as the estimates and assumptions used to account for certain customer arrangements, including Subscription Credits (which are customer options that are accounted for as material rights) related to Refresh Rights, may continue to affect the amount and timing of revenue recognized.

In addition, future changes in our product offerings, pricing models, contract structures, customer purchasing patterns, or other business initiatives may further affect our revenue mix and the timing of revenue recognized.

These factors make it challenging to forecast our revenue as the mix of solutions and services, the timing of our customers’ RSC transition, as well as the size of contracts, are difficult to predict.

We rely upon third-party cloud providers to host our data security solutions, and any disruption of, or interference with, our use of third-party cloud products would adversely affect our business, financial condition, and results of operations.

Customers of RSC and our other cloud services need to be able to access our data security solutions at any time, without interruption or degradation of performance, and we provide them with service-level commitments with respect to uptime.

We leverage third-party cloud providers for substantially all of the infrastructure that supports our data security solutions.

We rely upon third-party cloud providers to host our solutions, and any disruption of, or interference with, our use of third-party cloud products would adversely affect our business, financial condition, and results of operations.

Customers of RSC and our other cloud services need to be able to access our solutions at any time, without interruption or degradation of performance, and we provide them with service-level commitments with respect to uptime.

We leverage third-party cloud providers for substantially all of the infrastructure that supports our solutions.

Our cloud services depend on the cloud infrastructure hosted by these third-party providers to support our configuration, architecture, features, and interconnection specifications, as well as secure the information stored in these virtual data centers, which is transmitted through third-party internet service providers.

Any limitation on the capacity of our third-party hosting providers, including due to technical failures, shifts in product capabilities or licensing models, natural disasters, fraud, or security attacks, could impede our ability to fulfill our current contractual commitments, onboard new customers, or expand the usage of our existing customers, which could adversely affect our business, financial condition, and results of operations.

2025 Form 10-K 23

In addition, third-party cloud providers run their own platforms that we access, and we are, therefore, vulnerable to their service interruptions.

16 unchanged sentences

We cannot be sure that the expansion of and improvements to our internal infrastructure will be effectively implemented on a timely basis, if at all, and such failures could harm our business, financial condition, and results of operations.

2026 Form 10-K 26

The markets in which we participate are competitive, and if we do not compete effectively, our business, financial condition, and results of operations could be harmed.

1 unchanged sentence

Our main competitors fall into the following categories:

• Data management and protection vendors, such as Dell-EMC, IBM, Commvault, Veeam, and Cohesity (which recently acquired Veritas’ data protection business);

• Data management and protection vendors, such as Dell-EMC, IBM, Commvault, Veeam, and Cohesity;

• Cloud and SaaS data management vendors with products that compete in some of our markets;

• Vendors that provide cyber/ransomware detection and investigation, data security posture management, identity security posture management, Active Directory security and protection, insider threat detection, data classification, and other data security or data governance technologies.

• Vendors that provide cyber/ransomware detection and investigation, data security posture management, identity security posture management, Active Directory and Entra ID security and protection, insider threat detection, data classification, and other data security or data governance technologies.

The principal competitive factors in our industry include product functionality, product integration, platform coverage, ability to scale, price, worldwide sales infrastructure, global technical support, labor and development costs, name recognition, and reputation.

1 unchanged sentence

If we are unable to address these factors, our competitive position could weaken, and we could experience a decline in revenue that could adversely affect our business.

Many of our current and potential competitors have longer operating histories and have substantially greater financial, technical, sales, marketing, and other resources than we do, as well as larger installed customer bases, greater name recognition, lower labor and development costs, and broader product solutions, including servers.

Many of our current and potential competitors have longer operating histories and may have substantially greater financial, technical, sales, marketing, and other resources than we do, as well as larger installed customer bases, greater name recognition, lower labor and development costs, and broader product solutions, including servers.

Some of these competitors can devote greater resources to the development, promotion, sale, and support of their data security products than we can.

As a result, these competitors may be able to respond more quickly to new or emerging technologies and changes in customer requirements.

For example, many of our competitors are investing in AI technology to improve their data security products, which could enable them to respond more quickly to new or emerging threats and changes in customer requirements.

2025 Form 10-K 24

For example, many of our competitors are also investing in AI technology to improve their data security products, which could enable them to respond more quickly to new or emerging threats and changes in customer requirements.

It is also costly and time-consuming to change data management systems.

4 unchanged sentences

If so, new competitors, alliances, or merged entities that include our competitors may emerge that could acquire significant market share.

In addition, large operating systems, applications, and cloud vendors have introduced products or functionality that include some of the same functions offered by our data security solutions.

In the future, further development by these vendors could cause our data security solutions to become redundant, which could seriously harm our business, financial condition, and results of operations.

In addition, large operating systems, applications, and cloud vendors have introduced products or functionality that include some of the same functions offered by our solutions.

In the future, further development by these vendors could cause our solutions to become redundant, which could seriously harm our business, financial condition, and results of operations.

In addition, we expect to encounter new competitors, including public cloud providers and SaaS companies that build native data security and management solutions, as we expand in current markets or enter new markets.

1 unchanged sentence

We expect that competition will increase as a result of future software industry consolidation.

Increased competition could harm our business by causing, among other things, price reductions of our data security solutions, reduced profitability, and loss of market share.

Increased competition could harm our business by causing, among other things, price reductions of our solutions, reduced profitability, and loss of market share.

2026 Form 10-K 27

Our estimates of market opportunity, forecasts of market growth, and potential return on investment may prove to be inaccurate, and even if the market in which we compete achieves the forecasted growth, our business could fail to grow at similar rates, if at all.

5 unchanged sentences

Moreover, the market segments we are targeting may grow at different rates.

The variables that go into the calculation of our market opportunity are subject to change over time, and there is no guarantee that any particular number or percentage of addressable businesses covered by our market opportunity estimates will purchase our data security solutions or generate any particular level of revenue for us.

Any expansion in our market opportunity depends on a number of factors, including the cost, performance, and perceived value associated with our data security solutions and the products of our competitors.

The variables that go into the calculation of our market opportunity are subject to change over time, and there is no guarantee that any particular number or percentage of addressable businesses covered by our market opportunity estimates will purchase our solutions or generate any particular level of revenue for us.

Any expansion in our market opportunity depends on a number of factors, including the cost, performance, and perceived value associated with our solutions and the products of our competitors.

Even if the areas in which we compete achieve the forecasted growth, our business could fail to grow at similar rates, if at all.

There are a limited number of contract manufacturers and original equipment manufacturers of commodity servers that are compatible with our data security solutions, and failure to accurately forecast demand for these commodity servers or successfully manage the relationship with such manufacturers could negatively impact the ability to sell our offerings.

A limited number of Manufacturers produce commodity servers that are compatible with our data security solutions.

We do not own or operate any manufacturing facilities and rely on these Manufacturers for such products.

These Manufacturers manage the supply chain for these products and, alone or together with us or our distributors and resellers ("Channel Partners"), negotiate component costs.

Our reliance on Manufacturers and Channel Partners reduces our control over the assembly process, quality assurance, production costs, and product supply.

If we or our Channel Partners are required to change or qualify a new Manufacturer for any reason, including financial considerations, reduction of manufacturing output made available to us, or the termination of our or our Channel Partners’ contract with the Manufacturers, we may lose revenue, incur increased costs, and our customer relationships may be damaged.

In addition, our contract manufacturers may terminate the agreement with us or our Channel Partners with prior notice for reasons such as failure to perform a material contractual obligation.

2025 Form 10-K 25

A large majority of the customer enterprise data we secure relies upon Rubrik-branded Appliances, which are currently built on servers supplied and designed by Super Micro Computer, Inc.

("Supermicro").

If we are unable to manage our relationship with Supermicro effectively, or if Supermicro suffers delays or disruptions for any reason, including due to recent reports of challenges at Supermicro, experiences increased manufacturing lead-times, capacity constraints, quality control problems in its manufacturing operations, potential delays or increased costs from international trade disputes, tariffs or other protectionist measures, or fails to meet our requirements for timely delivery, or if Supermicro no longer produces the servers for our Rubrik-branded Appliances, our indirect costs may increase and our end-customer’s ability to procure Rubrik-branded Appliances in a timely manner would be impaired.

See the section titled “Business—Manufacturing” for additional information regarding our contractual relationship with Supermicro.

Certain of our OEMs carry products that compete with our data security solutions and may not continue producing or supporting compatible commodity servers for our customers in the future.

If we inaccurately forecast demand for our data security solutions and need for compatible commodity servers, our Manufacturers may have excess or inadequate inventory, and we may incur cancellation charges or penalties, which could adversely impact our operating results.

Our customers’ orders may represent a relatively small percentage of the overall orders received by Manufacturers from their customers.

If customers have not utilized their Subscription Credits before they expire, this could result in customer dissatisfaction and our future results of operations could be harmed.

1 unchanged sentence

Historically, we sold Rubrik-branded Appliances produced by contract manufacturers to our customers.

We started transitioning the sale of Rubrik-branded Appliances from us to our contract manufacturers in fiscal 2023 and offered limited-time incentives ("Subscription Credits"), upon qualification, to certain existing customers in exchange for historically offered rights to next generation Rubrik-branded Appliances at no cost, which we refer to as Refresh Rights.

If customers have not utilized their Subscription Credits before they expire, this could result in customer dissatisfaction or a decision not to purchase our data security solutions, which would have an adverse impact on our results of operations.

We started transitioning the sale of Rubrik-branded Appliances from us to our contract manufacturers in fiscal 2023 and offered limited-time incentives, Subscription Credits (which are customer options that are accounted for as material rights), upon qualification, to certain existing customers in exchange for historically offered rights to next generation Rubrik-branded Appliances at no cost, which we refer to as Refresh Rights.

If customers have not utilized their Subscription Credits before they expire, this could result in customer dissatisfaction or a decision not to purchase our solutions, which would have an adverse impact on our results of operations.

We rely on the performance of highly skilled personnel, including senior management and engineering, services, sales, and technology professionals.

4 unchanged sentences

The loss of one or more of our executive officers, or the failure by our executive team to effectively work with our employees and lead our company, could harm our business.

We also are dependent on the continued service of our existing software engineers because of the complexity of our data security solutions.

We also are dependent on the continued service of our existing software engineers because of the complexity of our solutions.

In addition, a significant portion of our software engineers are located in Palo Alto, California and Bangalore, India.

These locations offer access to a deep pool of highly skilled professionals, which is crucial for the development and maintenance of our complex data security solutions.

These locations offer access to a deep pool of highly skilled professionals, which is crucial for the development and maintenance of our complex solutions.

However, this concentration also exposes us to potential continuity risk if these specific locations are negatively impacted by unforeseen events, such as natural disasters, political unrest, or disruptions in critical infrastructure.

13 unchanged sentences

Our growth will depend in large part on our ability to attract new customers and expand sales to existing customers, expand the features and functionality of our platform, hire sufficient sales personnel to support our growth, and decrease the ramp time for our sales personnel.

In addition, the success of our business is substantially dependent on the actual and perceived viability, benefits, and advantages of our platform as a preferred provider for data security.

As such, market adoption of our platform and data security products is critical to our continued success.

Demand for our platform and data security products is affected by a number of factors, including increased market acceptance by new and existing customers, increased activity by or prevalence of cybersecurity bad actors, including the use of ransomware, effectiveness of our sales and marketing strategy, the extension of our platform to new applications and use cases, the timing of development and release of new capabilities by us and our competitors, technological change, and growth or contraction of the market in which we compete.

In addition, the success of our business is substantially dependent on the actual and perceived viability, benefits, and advantages of our platform.

As such, market adoption of our platform, data security and agentic AI operations solutions is critical to our continued success.

Demand for our platform and data security products is affected by a number of factors, including increased market acceptance by new and existing customers, increased market acceptance of our AI offerings, such as Rubrik Agent Cloud, increased activity by or prevalence of cybersecurity bad actors, including the use of ransomware, effectiveness of our sales and marketing strategy, the extension of our platform to new applications and use cases, the timing of development and release of new capabilities by us and our competitors, technological change, and growth or contraction of the market in which we compete.

Failure to successfully address or account for these factors, satisfy customer demands, achieve continued market acceptance over competitors, and achieve growth in sales of our data security products would harm our business, financial condition, results of operations, and growth prospects.

5 unchanged sentences

• changes in actual and anticipated growth rates of our revenue, customers, and key operating metrics;

• fluctuations in demand for or pricing of our data security solutions;

• fluctuations in demand for or pricing of our solutions;

• our ability to attract new customers;

• the level of awareness and prevalence of cybersecurity threats, particularly advanced cyberattacks and ransomware attacks;

• timing of our existing customers’ transition to RSC, including the impact on our revenue recognition and customer retention and expansion;

• timing of our customers exercising or forfeiting their Subscription Credits (which are customer options that are accounted for as material rights), including the impact on our revenue recognition and causing fluctuations to our total revenue growth and limit the comparability of our revenue with past performance;

• our ability to retain our existing customers, particularly large customers, and secure renewals of subscriptions, as well as the timing of customer renewals or non-renewals;

1 unchanged sentence

• downgrades in customer subscriptions;

• customers and potential customers opting for alternative data security solutions, including developing their own in-house solutions;

• customers and potential customers opting for alternative solutions, including developing their own in-house solutions;

• timing and amount of our investments to expand the capacity of our third-party cloud service providers;

1 unchanged sentence

2026 Form 10-K 29

• investments in new data security products, including protection of new enterprise, cloud, and SaaS applications, new features, and functionality;

• fluctuations or delays in development, release, or adoption of new features and functionality for our data security solutions;

• investments in new data security products, including protection of new enterprise, cloud, SaaS, unstructured data, identity providers, new features, and functionality;

• fluctuations or delays in development, release, or adoption of new features and functionality for our solutions;

• delays in closing sales, including the timing of renewals, which may result in revenue being pushed into the next fiscal quarter, particularly because a large portion of our sales occur toward the end of each fiscal quarter;

2 unchanged sentences

• our customers’ ability to procure Rubrik-branded Appliances or compatible commodity servers from Manufacturers;

• the number of qualified customers that elect to utilize their Subscription Credits before they expire;

• the number of qualified customers that elect to utilize their Subscription Credits (which are customer options that are accounted for as material rights) before they expire;

• our ability to control costs, including hosting costs and our operating expenses;

11 unchanged sentences

• changes in the competitive dynamics of our market, including consolidation among competitors or customers;

• significant security incidents related to, technical difficulties with, or interruptions to, the delivery and use of our data security solutions.

• significant security incidents related to, technical difficulties with, or interruptions to, the delivery and use of our solutions.

Any of these and other factors, or the cumulative effect of some of these factors, may cause our results of operations to vary significantly.

1 unchanged sentence

In addition, while we recognize our SaaS subscription revenue ratably over the term of the subscription, our customers typically pay us for new multi-year subscriptions upfront and then annually upon one-year renewals.

Recently, due to the growth in our SaaS product offerings, changes in our customer mix, and the uncertain macroeconomic environment, we have experienced an increase in customers electing annual or consumption payments instead of multi-year upfront payments, which has caused and may continue to cause volatility in our period over period cash flow and may have an adverse effect on our business and results of operations.

Recently, due to the growth in our SaaS product offerings, changes in our customer mix, and the uncertain macroeconomic environment, we have experienced an increase in customers electing annual, monthly, or consumption payments instead of multi-year upfront payments, which has caused and may continue to cause volatility in our period over period cash flow and may have an adverse effect on our business and results of operations.

2026 Form 10-K 30

11 unchanged sentences

We rely on hosted SaaS applications from third parties in order to operate critical functions of our business, including enterprise resource planning, order management, billing, project management, human resources, technical support, accounting, and other operational activities.

If these services become unavailable due to extended outages, interruptions, or because they are no longer available on commercially reasonable terms, our expenses could increase, our ability to manage finances could be interrupted, and our processes for managing sales of our data security solutions and supporting our customers could be impaired until equivalent services, if available, are identified, obtained, and implemented, all of which could adversely affect our business and results of operations.

If we are unable to maintain successful relationships with our Channel Partners and technology alliance partners, or if our Channel Partners or technology alliance partners fail to perform, our ability to market, sell, and distribute our data security solutions will be limited, and our business, financial condition, and results of operations will be harmed.

In addition to our sales force, we rely on our Channel Partners, which include our distributors and resellers, to sell and support our data security solutions.

A vast majority of sales of our data security solutions flow through our Channel Partners with the support of our sales force.

Our three largest Channel Partners, Arrow Enterprise Computing Solutions, Exclusive Networks, and Ingram Micro Inc., and their respective affiliates collectively generated approximately 73% and 76% of our revenue for fiscal 2025 and fiscal 2024, respectively.

If these services become unavailable due to extended outages, interruptions, or because they are no longer available on commercially reasonable terms, our expenses could increase, our ability to manage finances could be interrupted, and our processes for managing sales of our solutions and supporting our customers could be impaired until equivalent services, if available, are identified, obtained, and implemented, all of which could adversely affect our business and results of operations.

If we are unable to maintain successful relationships with our Channel Partners and technology alliance partners, or if our Channel Partners or technology alliance partners fail to perform, our ability to market, sell, and distribute our solutions will be limited, and our business, financial condition, and results of operations will be harmed.

In addition to our sales force, we rely on our Channel Partners, which include our managed service providers and distributors and resellers, to sell and support our solutions.

A vast majority of sales of our solutions flow through our Channel Partners with the support of our sales force.

Our three largest Channel Partners, Arrow Enterprise Computing Solutions, Exclusive Networks, and Ingram Micro Inc., and their respective affiliates collectively generated approximately 68% and 73% of our revenue for fiscal 2026 and 2025, respectively.

Our agreements with our Channel Partners, including our agreements with our three largest Channel Partners, are non-exclusive, renew automatically in one-year term increments, and may be terminated by either party at any time.

5 unchanged sentences

Our agreements with our Channel Partners are generally non-exclusive and do not prohibit them from working with our competitors or offering competing products, and many of our Channel Partners may have more established relationships with our competitors.

If our Channel Partners choose to place greater emphasis on solutions other than our own, fail to effectively market and sell our data security solutions, or fail to meet the needs of our customers, then our ability to grow our business and sell our data security solutions may be adversely affected.

In addition, the loss of one or more of our larger Channel Partners or technology alliance partners, who may cease marketing our data security solutions with limited or no notice, and any inability to replace them, could adversely affect our business, financial condition, and results of operations.

Moreover, our ability to expand our distribution channels depends in part on our ability to maintain successful relationships with our Channel Partners and educate and train our current and future Channel Partners about our data security solutions, which can be complex.

If we fail to effectively manage our existing sales channels, or if our Channel Partners are unsuccessful in fulfilling the orders for our data security solutions, or if we are unable to enter into arrangements with, and retain a sufficient number of, high quality Channel Partners in each of the regions in which we sell data security solutions and keep them motivated to sell our data security solutions, our business, financial condition, and results of operations will be harmed.

If our Channel Partners choose to place greater emphasis on solutions other than our own, fail to effectively market and sell our solutions, or fail to meet the needs of our customers, then our ability to grow our business and sell our solutions may be adversely affected.

In addition, the loss of one or more of our larger Channel Partners or technology alliance partners, who may cease marketing our solutions with limited or no notice, and any inability to replace them, could adversely affect our business, financial condition, and results of operations.

If we fail to effectively manage our existing sales channels, or if our Channel Partners are unsuccessful in fulfilling the orders for our solutions, or if we are unable to enter into arrangements with, and retain a sufficient number of, high quality Channel Partners in each of the regions in which we sell solutions and keep them motivated to sell our solutions, our business, financial condition, and results of operations will be harmed.

Even if we are successful, these relationships may not result in greater customer usage of our data security products or increased revenue.

2 unchanged sentences

In addition, the financial health of our Channel Partners and our continuing relationships with them are important to our success.

Some of these Channel Partners may be unable to withstand adverse changes in economic conditions, including the current macroeconomic uncertainty, which could result in insolvency or the inability of such Channel Partners to obtain credit to finance purchases of our data security solutions and services.

In addition, weakness in the end-user market could negatively affect the cash flows of our Channel Partners who could, in turn, delay paying their obligations to us, which would increase our credit risk exposure.

2 unchanged sentences

We depend on our sales force to obtain new customers and retain and increase sales with existing customers.

Our ability to achieve significant revenue growth will depend, in large part, on our success in recruiting, training, and retaining sufficient numbers of sales personnel.

Our ability to achieve significant revenue growth will depend, in large part, on our success in recruiting, training, and retaining sufficient numbers of sales personnel, as well as effectively managing leadership transitions and maintaining stability within our sales organization.

Changes in sales leadership or organizational structure may result in temporary disruption, changes in strategy or execution, or challenges in maintaining sales team morale and productivity, and may increase the risk of attrition within our sales organization, including the potential loss of key sales personnel.

We have expanded our sales organization significantly in recent periods and expect to continue to add additional sales capabilities in the near term.

2 unchanged sentences

Our recent hires and planned hires may not become productive as quickly as we expect, and we may be unable to hire or retain sufficient numbers of qualified individuals in the markets where we do or plan to do business.

In addition, a large percentage of our sales force is new to our company and selling our data security solutions, and therefore, this group may be less effective than our more seasoned sales personnel.

In addition, a large percentage of our sales force is new to our company and selling our solutions, and therefore, this group may be less effective than our more seasoned sales personnel.

Furthermore, hiring sales personnel in new countries, or expanding our existing presence, requires upfront and ongoing expenditures that we may not recover if the sales personnel fail to achieve full productivity.

We may also incur additional compensation and training costs for our sales force, including as part of sales incentive realignment, as we work to migrate existing customers to RSC while ensuring retention and expansion.

These additional costs may be higher than we expect depending on timing to complete the transition to RSC and any unforeseen challenges that arise, including due to additional costs faced by customers.

Moreover, we could face challenges in our ability to retain sales personnel if the migration to RSC results in the loss of existing customers.

We cannot predict whether, or to what extent, our sales will increase as we expand our sales force or how long it will take for sales personnel to become productive.

2 unchanged sentences

Our sales cycles can be long and unpredictable, and our sales efforts require considerable time and expense.

Our revenue may fluctuate because of the length and unpredictability of the sales cycle for our data security solutions, particularly with respect to large organizations and government entities.

For example, in light of current macroeconomic conditions, we have observed a lengthening of our sales cycles, which may be attributed to higher cost-consciousness around information technology budgets.

Our revenue may fluctuate because of the length and unpredictability of the sales cycle for our solutions, particularly with respect to large organizations and government entities.

For example, in light of current macroeconomic conditions, such as higher cost-consciousness around information technology budgets, as well as constraints affecting the availability or pricing of compatible commodity servers needed to deploy our solutions, including as a result of global chip shortages or allocation constraints, we have observed a lengthening of our sales cycles.

Customers often view the subscription to our platform as a significant strategic decision and, as a result, frequently require considerable time to evaluate, test, and qualify our platform, including from a security and privacy perspective, prior to entering into or expanding a relationship with us.

5 unchanged sentences

As a result, it is difficult to predict whether and when a sale will be completed.

If we fail to adapt and respond effectively to rapidly changing technology, evolving industry standards, changing regulations, or to changing customer needs, requirements, or preferences, our data security solutions may become less competitive.

Our ability to attract new users and customers and increase revenue from existing customers depends in large part on our ability to enhance, improve, and differentiate our existing offering, increase adoption and usage of our data security solutions, and introduce new data security products and capabilities.

The market in which we compete is relatively new and subject to rapid technological change, evolving industry standards, and changing regulations, as well as changing customer needs, requirements, and preferences.

If we fail to adapt and respond effectively to rapidly changing technology, including technologies related to AI, evolving industry standards, changing regulations, or to changing customer needs, requirements, or preferences, our solutions may become less competitive.

Our ability to attract new users and customers and increase revenue from existing customers depends in large part on our ability to enhance, improve, and differentiate our existing offering, increase adoption and usage of our solutions, and introduce new products and capabilities.

The market in which we compete is relatively new and subject to rapid technological change, including advances in AI, evolving industry standards, and changing regulations, as well as changing customer needs, requirements, and preferences.

The success of our business will depend, in part, on our ability to adapt and respond effectively to these changes on a timely basis.

Because the market for our data security solutions is relatively new, it is difficult to predict customer adoption, increased customer usage and demand for our data security solutions, the size and growth rate of this market, the entry of competitive products, or the success of existing competitive products.

If we are unable to enhance our data security solutions and keep pace with rapid technological change, or if new technologies emerge that are able to deliver competitive products at lower prices, more efficiently, more conveniently, or more securely than our data security solutions, our business, financial condition, and results of operations could be adversely affected.

To remain competitive, we need to continuously modify and enhance our data security solutions to adapt to changes and innovation in existing and new technologies.

We expect that we will need to continue to differentiate our data management and data security capabilities, as well as expand and enhance our data security solutions to support a variety of use cases.

If we are unable to enhance our solutions and keep pace with rapid technological change, including developments related to AI and automated systems, or if new technologies emerge that are able to deliver competitive products at lower prices, more efficiently, more conveniently, or more securely than our solutions, our business, financial condition, and results of operations could be adversely affected.

To remain competitive, we need to continuously modify and enhance our solutions to adapt to changes and innovation in existing and new technologies.

We expect that we will need to continue to differentiate our data management and data security capabilities, as well as expand and enhance our data security and AI solutions to support a variety of use cases.

This development effort will require significant engineering, sales, and marketing resources.

Any failure to effectively offer data security solutions for these adjacent use cases could reduce customer demand for our platform.

Further, our data security solutions must also integrate with a variety of network, commodity appliance, mobile, cloud, and software platforms and technologies, and we need to continuously modify and enhance our data security solutions to adapt to changes and innovation in these technologies.

Any failure to effectively offer solutions for these adjacent use cases could reduce customer demand for our platform.

Further, our solutions must also integrate with a variety of network, commodity appliance, mobile, cloud, and software platforms and technologies, and we need to continuously modify and enhance our solutions to adapt to changes and innovation in these technologies.

This development effort may require significant investment in engineering, support, marketing, and sales resources, all of which would affect our business and results of operations.

Any failure of our data security solutions to operate effectively with widely adopted data infrastructure platforms, applications, and technologies would reduce the demand for our data security solutions.

If we are unable to respond to customer demand in a cost-effective manner, our data security solutions may become less marketable and less competitive or obsolete, and our business, financial condition, and results of operations could be adversely affected.

The competitive position of our data security solutions depends in part on their ability to operate with third-party products and services, including those of our technology alliance partners, and if we are not successful in maintaining and expanding the compatibility of our data security solutions with such products and services, our business may be harmed.

The competitive position of our data security solutions depends in part on their ability to operate with products and services of third parties, including software companies, software services, and infrastructure, and our data security solutions must be continuously modified and enhanced to adapt to changes in commodity appliance, software, networking, browser, and database technologies.

In the future, one or more technology companies, whether our technology alliance partners or otherwise, may choose not to support the operation of their software, software services, and infrastructure with our data security solutions, or our data security solutions may not support the capabilities needed to integrate with such software, software services, and infrastructure.

Any failure of our solutions to operate effectively with widely adopted data infrastructure platforms, applications, and technologies would reduce the demand for our solutions.

If we are unable to respond to customer demand in a cost-effective manner, our solutions may become less marketable and less competitive or obsolete, and our business, financial condition, and results of operations could be adversely affected.

The competitive position of our solutions depends in part on their ability to operate with third-party products and services, including those of our technology alliance partners, and if we are not successful in maintaining and expanding the compatibility of our solutions with such products and services, our business may be harmed.

The competitive position of our solutions depends in part on their ability to operate with products and services of third parties, including software companies, software services, and infrastructure, and our solutions must be continuously modified and enhanced to adapt to changes in commodity appliance, software, networking, browser, and database technologies.

In the future, one or more technology companies, whether our technology alliance partners or otherwise, may choose not to support the operation of their software, software services, and infrastructure with our solutions, or our solutions may not support the capabilities needed to integrate with such software, software services, and infrastructure.

In addition, to the extent that a third party was to develop software or services that compete with ours, that provider may choose not to support our offering.

2 unchanged sentences

2026 Form 10-K 33

Incorrect or improper implementation or use of our data security solutions could result in customer dissatisfaction and harm our business, financial condition, and results of operations.

Our data security solutions are deployed in a wide variety of IT infrastructures, including large-scale, complex technology environments, and we believe our future success will depend, at least in part, on our ability to support such deployments.

Implementations of our data security solutions may be technically complicated, and it may not be easy to maximize the value of our data security solutions without proper implementation, training, and support.

Some of our customers have experienced difficulties implementing our data security solutions in the past and may experience implementation difficulties in the future.

If we or our customers are unable to implement our data security solutions successfully, customer perceptions of our data security solutions may be impaired, our reputation and brand may suffer, or customers may choose not to renew their subscriptions or purchase additional data security products from us.

Any failure by customers to appropriately implement our data security solutions or any failure of our data security solutions to effectively integrate and operate within our customers’ data management infrastructure could result in customer dissatisfaction, impact the perceived reliability of our data security solutions, result in negative press coverage, negatively affect our reputation, and harm our business, financial condition, and results of operations.

We use third-party open-source software in our data security solutions, which could negatively affect our ability to sell our data security solutions or subject us to litigation or other actions.

Our data security solutions include third-party open-source software, and we intend to continue to incorporate third-party open-source software in our data security solutions in the future.

There is a risk that the use of third-party open-source software in our software could impose conditions or restrictions on our ability to monetize our software or require making available the source code of all or part of our software that include, incorporate or rely upon such open-source software.

Although we have internal policies in place designed to monitor the incorporation of open-source software into our data security solutions to avoid such restrictions, we cannot be certain that we have not incorporated open-source software in our data security solutions in a manner that is inconsistent with our licensing model or the licensing terms of any such open-source software.

Certain open-source projects also incorporate other open-source software and there is a risk that those dependent open-source libraries may be subject to inconsistent licensing terms that affect our ability to use the software.

This could create further uncertainties as to the governing terms for the open-source software we incorporate.

Incorrect or improper implementation or use of our solutions could result in customer dissatisfaction and harm our business, financial condition, and results of operations.

Our solutions are deployed in a wide variety of IT infrastructures, including large-scale, complex technology environments, and we believe our future success will depend, at least in part, on our ability to support such deployments.

Implementations of our solutions may be technically complicated, and it may not be easy to maximize the value of our solutions without proper implementation, training, and support.

Some of our customers have experienced difficulties implementing our solutions in the past and may experience implementation difficulties in the future.

If we or our customers are unable to implement our solutions successfully, customer perceptions of our solutions may be impaired, our reputation and brand may suffer, or customers may choose not to renew their subscriptions or purchase additional products from us.

Any failure by customers to appropriately implement our solutions or any failure of our solutions to effectively integrate and operate within our customers’ data management infrastructure could result in customer dissatisfaction, impact the perceived reliability of our solutions, result in negative press coverage, negatively affect our reputation, and harm our business, financial condition, and results of operations.

We use third-party open-source components in our solutions, which could negatively affect our ability to sell our solutions or subject us to litigation or other actions.

Our solutions include third-party open-source components, including software and models, and we intend to continue to incorporate third-party open-source components in our solutions in the future.

There is a risk that the use of third-party open-source components in our software could impose conditions or restrictions on our ability to monetize our software or require making available the source code of all or part of our software that include, incorporate or rely upon such open-source components.

Although we have internal policies in place designed to monitor the incorporation of open-source components into our solutions to avoid such restrictions, we cannot be certain that we have not incorporated open-source components in our solutions in a manner that is inconsistent with our licensing model or the licensing terms of any such open-source components.

Open-source software is incorporated into or relied upon by many other software projects, including open source projects as well as AI tools, and there is a risk that those dependent open-source libraries may be subject to inconsistent licensing terms that affect our ability to use the software.

This could create further uncertainties as to the governing terms for the open-source components we incorporate.

In addition, the terms of certain open-source licenses to which we are subject have not been interpreted by U.S.

or foreign courts, and there is a risk that open-source software licenses could be construed in a manner that imposes unanticipated restrictions or conditions on our use of such software.

Additionally, we may from time to time face claims from third parties claiming ownership of, or demanding release of, the software or derivative works that we developed using such open-source software, which could include proprietary portions of our source code, or otherwise seeking to enforce the terms of the open-source licenses.

or foreign courts, and there is a risk that open-source licenses could be construed in a manner that imposes unanticipated restrictions or conditions on our use of such components.

Additionally, we may from time to time face claims from third parties claiming ownership of, or demanding release of, the software or derivative works that we developed using such open-source components, which could include proprietary portions of our source code, or otherwise seeking to enforce the terms of the open-source licenses.

These claims could result in litigation and could require us to make those proprietary portions of our source code freely available, purchase a costly license or cease offering the implicated software or services unless and until we can re-engineer them to avoid infringement.

This re-engineering process could require significant additional research and development resources, and we may not be able to complete it successfully.

In addition to risks related to license requirements, use of third-party open-source software can lead to greater risks than use of third-party commercial software, as open-source licensors generally do not provide warranties.

Use of open-source software may also introduce security risks as it may contain security vulnerabilities, and hackers and other third parties may exploit the public availability of such open-source software to determine how to compromise our data security solutions.

In addition, licensors of open-source software included in our data security solutions may, from time to time, modify the terms of their license agreements applicable to any updates in such a manner that those license terms may include restrictions that make the use of such software incompatible with our business, and thus could, among other consequences, prevent us from using or incorporating new updates of such software that are subject to the modified license.

In addition to risks related to license requirements, use of third-party open-source components can lead to greater risks than use of third-party commercial components, as open-source licensors generally do not provide warranties.

Use of open-source components may also introduce security risks as it may contain security vulnerabilities, and hackers and other third parties may exploit the public availability of such open-source components to determine how to compromise our solutions.

In addition, licensors of open-source components included in our solutions may, from time to time, modify the terms of their license agreements applicable to any updates in such a manner that those license terms may include restrictions that make the use of such components incompatible with our business, and thus could, among other consequences, prevent us from using or incorporating new updates of such components that are subject to the modified license.

In addition, any source code that we contribute to open-source projects becomes publicly available, subject to the relevant open source license.

3 unchanged sentences

Our success depends, in part, on the integrity and scalability of our systems and infrastructures.

System interruption or delays from third-party data center hosting facilities and the lack of integration, redundancy, and scalability in our systems and infrastructures could impair the delivery of our data security solutions and harm our business.

Our success depends, in part, on our ability to maintain the integrity of our systems and infrastructure, including websites, information, and related systems.

System interruption and the lack of integration and sufficient redundancy in our information systems and infrastructures may harm our ability to operate websites, respond to customer inquiries, and generally maintain cost-efficient operations.

We may experience occasional system interruptions that make some or all systems or data unavailable or prevent us from efficiently providing data security solutions.

We may experience occasional system interruptions that make some or all systems or data unavailable or prevent us from efficiently providing solutions.

We currently utilize third-party data center hosting facilities located in the United States and internationally.

Any damage to, or failure of, the data facilities generally could result in interruptions in our data security solutions.

Any damage to, or failure of, the data facilities generally could result in interruptions in our solutions.

As we continue to add data center hosting facilities and add capacity in our existing data facilities, we may move or transfer our data and our customers’ data.

Despite precautions taken during this process, any unsuccessful data transfers may impair the delivery of our data security solutions.

Despite precautions taken during this process, any unsuccessful data transfers may impair the delivery of our solutions.

We also rely on affiliate and third-party computer systems, broadband, and other communications systems and service providers in connection with the provision of services generally, as well as to facilitate, process, and fulfill transactions.

Interruptions in our data security solutions may reduce our revenue, cause us to issue credits or pay penalties, cause customers to terminate their subscriptions or data security solutions contracts, or harm our renewal rates or our ability to attract new customers.

Our business will also be harmed if our customers and potential customers believe our data security solutions are unreliable.

Interruptions in our solutions may reduce our revenue, cause us to issue credits or pay penalties, cause customers to terminate their subscriptions or solutions contracts, or harm our renewal rates or our ability to attract new customers.

Our business will also be harmed if our customers and potential customers believe our solutions are unreliable.

Fire, flood, power loss, telecommunications failure, hurricanes, tornadoes, earthquakes, acts of war or terrorism, acts of God, and similar events or disruptions may damage or interrupt computer, broadband, or other communications systems and infrastructures at any time.

Any of these events could cause system interruption, delays, and loss of critical data, and could prevent us from providing our data security solutions.

Any of these events could cause system interruption, delays, and loss of critical data, and could prevent us from providing our solutions.

While we have backup systems for certain aspects of our operations, disaster recovery planning by its nature cannot be sufficient for all eventualities.

In addition, we may not have adequate insurance coverage to compensate for losses from a major interruption.

As we continue to expand the number of our customers and data security solutions products available to our customers, we may not be able to scale our technology to accommodate the increased capacity requirements, which may result in interruptions or delays in data security solutions.

As we continue to expand the number of our customers and solutions products available to our customers, we may not be able to scale our technology to accommodate the increased capacity requirements, which may result in interruptions or delays in the delivery or performance of our solutions.

If any of these events were to occur, it could harm our business, financial condition, and results of operations.

We rely on software and data licensed from other parties.

Defects in or the loss of software or access to data from third parties could increase our costs and harm the quality of our data security solutions.

Components of our data security solutions include or rely upon software and data licensed from third parties.

Defects in or the loss of software or access to data from third parties could increase our costs and harm the quality of our solutions.

Components of our solutions include or rely upon software and data licensed from third parties.

Our business could be disrupted if any of the software or data we license from others and functional equivalents thereof were either no longer available to us or no longer offered on commercially reasonable terms.

In either case, we may be required to either redesign our data security solutions to function with software or data available from other parties or develop these components ourselves, which would result in increased costs and could result in delays in the release of new data security solutions.

Furthermore, we might be forced to limit the features available in our current or future data security solutions.

In either case, we may be required to either redesign our solutions to function with software or data available from other parties or develop these components ourselves, which would result in increased costs and could result in delays in the release of new solutions.

Furthermore, we might be forced to limit the features available in our current or future data security or AI solutions.

If we fail to maintain or renegotiate any of these software or data licenses, we could face significant delays and diversion of resources in attempting to license and integrate functional equivalents.

3 unchanged sentences

Our data security solutions are subject to U.S.

export controls, including the Export Administration Regulations, and we incorporate encryption technology into our data security solutions.

Our data security solutions and the underlying technology may be exported outside of the United States only in compliance with the required export authorizations, including by license, applicability of a license exception, or other appropriate government authorizations, including the filing of an encryption classification request or self-classification report, as applicable.

export controls, including the Export Administration Regulations, and we incorporate encryption technology into our solutions.

Our data security solutions and the underlying technology may be exported outside of the United States only in compliance with the applicable regulations and any required export authorizations, including an export license, applicability of a license exception, or other appropriate government authorizations, such as the filing of an encryption classification request or self-classification report, as applicable.

Obtaining the necessary export license or other authorization for a particular sale may be time-consuming and may result in the delay or loss of sales opportunities.

Furthermore, we are required to comply with economic and trade sanctions laws and regulations of the countries where we do business, including those administered and enforced by the U.S.

government (including through the Office of Foreign Assets Control of the U.S.

government (for example, through the Office of Foreign Assets Control of the U.S.

Treasury Department and the U.S.

Department of State).

These economic and trade sanctions prohibit or restrict the provisions of products and services to embargoed jurisdictions or sanctioned persons, unless otherwise authorized.

These economic and trade sanctions prohibit or restrict the provisions of products and services to embargoed jurisdictions and sanctioned persons, unless otherwise authorized.

2026 Form 10-K 35

While we have taken certain precautions to prevent our data security solutions from being provided in violation of trade controls and are in the process of enhancing our policies and procedures relating to trade controls, our data security solutions may have been in the past, and could in the future be, provided inadvertently and without our knowledge in violation of such laws.

While we have taken certain precautions to prevent our solutions and related technology and services from being provided in violation of trade controls and are in the process of enhancing our compliance policies and procedures relating to trade controls, our solutions may have been in the past, and could in the future be, provided inadvertently and/or without our knowledge in violation of such trade control laws and regulations.

Violations of U.S.

trade controls can result in significant fines or penalties and possible criminal liability for responsible employees and managers, in addition to potential reputational harm.

trade controls or other applicable laws/regulations can result in significant fines or penalties and possible criminal liability for responsible employees and managers, in addition to potential reputational harm.

If our partners, including our Channel Partners, fail to obtain appropriate import, export, or re-export licenses or permits, we may also be adversely affected through reputational harm, as well as other negative consequences, including government investigations and penalties.

Also, various countries, in addition to the United States, regulate the import and export of certain encryption and other technology, including import and export licensing requirements, and have enacted laws that could limit our ability to distribute our data security solutions or could limit our customers’ ability to implement our data security solutions in those countries.

Changes in our data security solutions or future changes in export and import regulations may create delays in the introduction of our data security solutions in international markets, prevent our customers with international operations from deploying our data security solutions globally or, in some cases, prevent the export or import of our data security solutions to certain countries, governments, or persons altogether.

From time to time, various governmental agencies have proposed additional regulation of encryption technology.

Any change in export or import regulations, economic sanctions, or related laws or regulations, or change in the countries, governments, persons, or technologies targeted by such regulations, could result in decreased use of our data security solutions by, or in our decreased ability to export or sell our data security solutions to, existing or potential customers with international operations.

Any decreased use of our data security solutions or limitation on our ability to export or sell our data security solutions would adversely affect our business, financial condition, results of operations, and growth prospects.

Also, various countries, in addition to the United States, regulate the import and export of certain encryption software and related technology, including import and export licensing requirements, and have enacted laws that could limit our ability to distribute our solutions or could limit our customers’ ability to implement our solutions in those countries.

Changes in our solutions or future changes in export and import regulations may create delays in the introduction of our solutions in international markets, prevent our customers with international operations from deploying our solutions globally or, in some cases, prevent the export or import of our solutions to certain countries, governments, or persons altogether.

From time to time, various governmental agencies have proposed, and are expected to implement additional regulation of encryption technology.

Any change in export or import regulations, economic sanctions, or related laws or regulations, or change in the countries, governments, persons, or technologies targeted by such regulations, could result in decreased use of our solutions by, or in our decreased ability to export or sell our solutions to, existing or potential customers.

Any decreased use of our solutions or limitation on our ability to export or sell our solutions would adversely affect our business, financial condition, results of operations, and growth prospects.

We are subject to anti-corruption, anti-bribery, and similar laws, and non-compliance with such laws can subject us to criminal or civil liability and harm our business, financial condition, and results of operations.

1 unchanged sentence

Foreign Corrupt Practices Act ("FCPA"), U.S.

domestic bribery laws, the UK Bribery Act, and other anti-corruption and anti-bribery laws in the countries in which we conduct activities.

Anti-corruption and anti-bribery laws are interpreted broadly to generally prohibit companies, their officers and employees, and their third-party intermediaries from authorizing, offering, or providing, or in some cases receiving, directly or indirectly, improper payments or benefits to or from recipients in the public or private sector.

As a public company, the FCPA separately requires that we keep accurate books and records and maintain internal accounting controls sufficient to assure management’s control, authority, and responsibility over our assets.

As we engage in and increase our international business and sales to the public sector, we may engage with business partners and third-party intermediaries, including Channel Partners, to market and sell our data security solutions and to obtain necessary permits, licenses, and other regulatory approvals.

domestic bribery laws, the UK Bribery Act, and other anti-corruption and anti-bribery laws in the countries in which we conduct business.

Anti-corruption and anti-bribery laws are interpreted broadly to prohibit companies, their officers and employees, and their third-party intermediaries from authorizing, offering, or providing, or in some cases receiving, directly or indirectly, improper payments or benefits to or from persons in the public or private sector.

As a public company, we are also required by the FCPA to keep accurate books and records and maintain internal accounting controls sufficient to assure management’s control, authority, and responsibility over our assets.

As we engage in and increase our international business and sales to the public sector, we may engage with business partners and third-party intermediaries, including Channel Partners, to market and sell our solutions and to obtain necessary permits, licenses, and other regulatory approvals from government authorities.

In addition, we or our third-party intermediaries may have direct or indirect interactions with officials, employees, or other representatives of government agencies or state-owned or affiliated entities.

We can be held liable for the corrupt or other illegal activities of these third-party intermediaries and our employees, representatives, contractors, partners, and agents, even if we do not explicitly authorize or have actual knowledge of such activities.

While we have policies and procedures and conduct training designed to address compliance with such laws, our employees and agents may take actions in violation of our policies and applicable law, for which we may be ultimately held responsible.

As we increase our international sales and business, our risks under these laws may increase.

Detecting, investigating, responding to, and resolving actual or alleged violations of anti-corruption laws can require a materially significant diversion of time, resources, and attention from senior management, as well as significant defense costs and other professional fees.

Detecting, investigating, responding to, and resolving actual or alleged violations of anti-corruption laws can lead to a materially significant diversion of time, resources, and attention from senior management, as well as significant defense costs and other professional fees.

In addition, noncompliance with anti-corruption and anti-bribery laws, could subject us to whistleblower complaints, investigations, sanctions, settlements, prosecution, enforcement actions, fines, damages, other civil or criminal penalties or injunctions, suspension, or debarment from contracting with certain persons, reputational harm, adverse media coverage, and other collateral consequences.

2 unchanged sentences

Downturns or upturns in our sales may not be immediately reflected in our financial condition and results of operations.

We recognize a significant portion of our revenue ratably over the term of subscriptions to our data security solutions.

We recognize a significant portion of our revenue ratably over the term of subscriptions to our solutions.

As a result, any decreases in new subscriptions or renewals in any one period may not immediately be fully reflected as a decrease in revenue for that period but would negatively affect our revenue in future quarters.

7 unchanged sentences

As such, these metrics may not provide an accurate indication of our actual performance or our future results.

Subscription ARR, Cloud ARR, and other non-GAAP operational metrics are based on numerous assumptions and limitations, are calculated using our internal data from non-financial systems, have not been independently audited by third parties, and may not accurately reflect actual financial results nor provide an accurate indication of future or expected results.

Subscription ARR, Cloud ARR, and other non-GAAP operational metrics are based on numerous assumptions and limitations, are calculated using our internal data from non-financial systems, have not been independently audited by third party financial audit firms as is typical for GAAP financials, and may not accurately reflect actual financial results nor provide an accurate indication of future or expected results.

Further, the definitions and assumptions for these metrics may differ from those calculated by other businesses.

6 unchanged sentences

We will face risks associated with the growth of our business with certain heavily regulated industry verticals.

We market and sell our data security solutions to customers in heavily regulated industry verticals, including the banking, healthcare, and financial services industries.

We market and sell our solutions to customers in heavily regulated industry verticals, including the banking, healthcare, and financial services industries.

As a result, we face additional regulatory scrutiny, risks, and burdens from the governmental entities and agencies that regulate those industries.

14 unchanged sentences

Further, there can be no assurance that we will secure commitments or contracts with government entities even following such certifications, which could harm our margins, business, financial condition, and results of operations.

Government demand and payment for our data security solutions are affected by public sector budgetary cycles and funding authorizations, with funding reductions or delays adversely affecting public sector demand for our data security solutions.

Government demand and payment for our data security solutions are affected by public sector budgetary cycles, procurement policies and funding authorizations, with funding reductions or delays, including in connection with an extended government shutdown, adversely affecting public sector demand for our data security solutions.

Further, governmental entities may demand contract terms that differ from our standard arrangements and are less favorable than terms agreed with private sector customers.

27 unchanged sentences

We have in the past and may in the future seek to acquire or invest in businesses, joint ventures, products and platform capabilities, technologies, or technical know-how that we believe could complement or expand our platform capabilities, enhance our technical capabilities, or otherwise offer growth opportunities.

Further, the proceeds we received from the IPO increase the likelihood that we will devote resources to exploring larger and more complex acquisitions and investments than we have previously attempted.

Any such acquisition or investment may divert the attention of management and cause us to incur various expenses in identifying, investigating, and pursuing suitable opportunities, whether or not the transactions are completed, and may result in unforeseen operating difficulties and expenditures.

In particular, we may encounter difficulties assimilating or integrating the businesses, technologies, products and platform capabilities, personnel, or operations of any acquired companies, particularly if the key personnel of an acquired company choose not to work for us, their software is not easily adapted to work with our data security solutions, or we have difficulty retaining the customers of any acquired business due to changes in ownership, management, or otherwise.

In particular, we may encounter difficulties assimilating or integrating the businesses, technologies, products and platform capabilities, personnel, or operations of any acquired companies, particularly if the key personnel of an acquired company choose not to work for us, their software is not easily adapted to work with our solutions, or we have difficulty retaining the customers of any acquired business due to changes in ownership, management, or otherwise.

These transactions may also disrupt our business, divert our resources, and require significant management attention that would otherwise be available for development of our existing business.

5 unchanged sentences

Any inability to maintain a high-quality customer support organization could lead to a lack of customer satisfaction, which could hurt our customer relationships and have an adverse effect on our business, financial condition, and results of operations.

Once our data security solutions are deployed, customers rely on our technical support services to assist with service customization and optimization and to resolve certain issues relating to the implementation and maintenance of our data security solutions.

Once our solutions are deployed, customers rely on our technical support services to assist with service customization and optimization and to resolve certain issues relating to the implementation and maintenance of our solutions.

Customers also rely on our or our Channel Partners’ support personnel to resolve issues and realize the full benefits that our solutions provide.

If we or our Channel Partners do not effectively assist customers in deploying our data security solutions, succeed in helping customers quickly resolve technical issues or provide effective ongoing support, our ability to sell additional data security solutions as part of our platform to existing customers would be adversely affected, and our reputation with potential customers could be damaged.

If we or our Channel Partners do not effectively assist customers in deploying our solutions, succeed in helping customers quickly resolve technical issues or provide effective ongoing support, our ability to sell additional solutions as part of our platform to existing customers would be adversely affected, and our reputation with potential customers could be damaged.

In addition, our sales process is highly dependent on our product and business reputation and on positive recommendations from existing customers.

Any failure to maintain high-quality technical support, or a market perception that we do not maintain high-quality technical support, could adversely affect our reputation, our ability to sell our services to existing and prospective customers, and our business, financial condition, and results of operations.

Our business is subject to the risks of warranty and product liability claims from real or perceived defects in our data security solutions or their misuse by customers or third parties and indemnity provisions in various agreements that potentially expose us to substantial liability for intellectual property infringement and other losses.

We may in the future be subject to liability claims for damages related to undetected defects, errors, or vulnerabilities in our data security solutions.

Our business is subject to the risks of warranty and product liability claims from real or perceived defects in our solutions or their misuse by customers or third parties and indemnity provisions in various agreements that potentially expose us to substantial liability for intellectual property infringement and other losses.

We may in the future be subject to liability claims for damages related to undetected defects, errors, or vulnerabilities in our solutions.

A material liability claim or other occurrence that harms our reputation or decreases market acceptance of our platform could harm our business, financial condition, and results of operations.

13 unchanged sentences

We may also have to seek a license for the technology.

Such licenses may not be available on reasonable terms, if at all, and may significantly increase our operating expenses or may require us to restrict our business activities and limit our ability to deliver certain data security solutions or features.

We may also be required to develop alternative non-infringing technology, which could either require significant effort and expense or cause us to alter our data security solutions, or both, which could harm our business.

We may also be required to develop alternative non-infringing technology, which could either require significant effort and expense or cause us to alter our solutions, or both, which could harm our business.

Large indemnity obligations, whether for intellectual property or in certain limited circumstances, other claims, would harm our business, financial condition, and results of operations.

1 unchanged sentence

An employee may take advantage of such access to conduct malicious activities or fail to follow internal policies or make errors that could cause system failures, loss of data, or other adverse effects on our customers.

Misuse of our data security solutions by our personnel could result in claims from our customers for damages related to such misuse.

Such misuse of our data security solutions could also result in negative press coverage and negatively affect our reputation, which could result in harm to our reputation, business, financial condition, and results of operations.

In addition, misuse of our data security solutions could also result in contractual breaches and damages to customers that may assert warranty and other claims for substantial damages against us.

We maintain insurance to protect against certain claims associated with the use of our data security solutions, but our insurance coverage may not adequately cover any claim asserted against us and is subject to deductibles.

Misuse of our solutions by our personnel could result in claims from our customers for damages related to such misuse.

Such misuse of our solutions could also result in negative press coverage and negatively affect our reputation, which could result in harm to our reputation, business, financial condition, and results of operations.

In addition, misuse of our solutions could also result in contractual breaches and damages to customers that may assert warranty and other claims for substantial damages against us.

We maintain insurance to protect against certain claims associated with the use of our solutions, but our insurance coverage may not adequately cover any claim asserted against us and is subject to deductibles.

In addition, even claims that ultimately are unsuccessful could result in our expenditure of funds in litigation, divert management’s time and other resources, and harm our reputation, business, financial condition, and results of operations.

2026 Form 10-K 40

Failure to effectively develop and expand our sales and marketing capabilities or improve the productivity of our sales and marketing organization could harm our ability to expand our potential customer and sales pipeline, increase our customer base, and achieve broader market acceptance of our data security solutions.

Our ability to increase our customer base, achieve broader market adoption and acceptance of our data security solutions, and expand our potential customer and sales pipeline and brand awareness will depend to a significant extent on our ability to expand and improve the productivity of our sales and marketing organization.

Our ability to increase our customer base, achieve broader market adoption and acceptance of our solutions, and expand our potential customer and sales pipeline and brand awareness will depend to a significant extent on our ability to expand and improve the productivity of our sales and marketing organization.

We plan to continue expanding our sales force, both domestically and internationally.

2 unchanged sentences

Our increased sales and marketing efforts will also involve investing significant financial and other resources, which could result in increased costs and negatively impact margins.

We are one of the only providers of a unified data security platform, so we must therefore invest heavily in our sales and marketing functions in order to educate customers and potential customers about our data security solutions.

Our business and results of operations will be harmed if our sales and marketing efforts fail to successfully expand our potential customer and sales pipeline, including through increasing brand awareness, new customer acquisition, and market adoption of our platform and data security solutions, particularly for RSC, or fail to generate significant increases in revenue or result in increases that are smaller than anticipated.

Our business and results of operations will be harmed if our sales and marketing efforts fail to successfully expand our potential customer and sales pipeline, including through increasing brand awareness, new customer acquisition, and market adoption of our platform and solutions, particularly for RSC, or fail to generate significant increases in revenue or result in increases that are smaller than anticipated.

We may not achieve anticipated revenue growth from expanding our sales force if we are unable to hire, develop, integrate, and retain talented and effective sales personnel, if our new and existing sales personnel, on the whole, are unable to achieve desired productivity levels in a reasonable period of time or at all, or if our sales and marketing programs are not effective.

If we fail to enhance our brand cost-effectively, our ability to expand our customer base will be impaired and our business, financial condition, and results of operations may be adversely affected.

We believe that developing and maintaining awareness of our brand in a cost-effective manner is critical to achieving widespread acceptance of our existing and future data security solutions and is an important element in attracting new customers.

In addition, creating brand awareness of our relatively new data security solutions will require added investment in our marketing and branding activities.

We believe that developing and maintaining awareness of our brand in a cost-effective manner is critical to achieving widespread acceptance of our existing and future solutions for data security and agentic AI operations and is an important element in attracting new customers.

In addition, creating brand awareness of our data security and agentic AI operations solutions will require added investment in our marketing and branding activities.

We believe that the importance of brand recognition will increase as competition in our market increases.

Successful promotion of our brand as a provider of data security solutions will depend largely on the effectiveness of our marketing efforts and on our ability to develop and deploy high-quality, reliable, and differentiated data security solutions to our customers.

Successful promotion of our brand will depend largely on the effectiveness of our marketing efforts and on our ability to develop and deploy high-quality, reliable, and differentiated data security and agentic AI operations solutions to our customers.

In the past, our efforts to build our brand have involved significant expense.

1 unchanged sentence

If we fail to successfully promote and maintain our brand or incur substantial expense in an unsuccessful attempt to promote and maintain our brand, we may fail to attract new customers or retain our existing customers to the extent necessary to realize a sufficient return on our brand-building efforts, and our business, financial condition, and results of operations could be adversely affected.

We have a limited history with pricing models for our data security solutions, and we may need to adjust the pricing terms of our data security solutions, which could have an adverse effect on our revenue and results of operations.

We have limited experience with respect to determining the optimal prices for subscriptions to and renewals of our data security solutions, new subscription editions, and new enterprise, cloud, and SaaS applications.

We have a limited history with pricing models for our solutions, and we may need to adjust the pricing terms of our data security solutions, which could have an adverse effect on our revenue and results of operations.

We have limited experience with respect to determining the optimal prices for our offerings across an expanding portfolio of solutions and capabilities, including new offerings and subscriptions to and renewals of our solutions and new subscription editions.

As the market for cloud data security evolves, or as new competitors introduce new products or services that compete with ours, we may be unable to attract new customers.

In the past, we have been able to increase our prices for our data security solutions, but we may choose not to introduce or be unsuccessful in implementing future price increases.

Furthermore, since we have limited experience pricing RSC editions and solutions, we may be unsuccessful in implementing future price increases and our future pricing power may erode due to changing market dynamics, increased competition, ability to sell to information security teams, or other factors.

As a result of these and other factors, in the future we may be required to reduce our prices or be unable to increase our prices, or it may be necessary for us to increase our services or data security solutions without additional revenue to remain competitive, all of which could harm our financial condition and results of operations.

In the past, we have been able to increase our prices for our solutions, but we may choose not to introduce or be unsuccessful in implementing future price increases.

Furthermore, since we have limited experience pricing RSC editions and solutions, as well as new products we may introduce from time to time, we may be unsuccessful in implementing future price increases and our future pricing power may erode due to changing market dynamics, increased competition, ability to sell to information security teams, or other factors.

As a result of these and other factors, in the future we may be required to reduce our prices or be unable to increase our prices, or it may be necessary for us to increase our services or solutions without additional revenue to remain competitive, all of which could harm our financial condition and results of operations.

2026 Form 10-K 41

We may require additional capital to support the growth of our business, and this capital might not be available on acceptable terms, if at all.

We have funded our operations since inception primarily through equity financings, sales of our data security solutions, and the utilization of debt products, including our Amended Credit Facility (as described in the section titled “Management’s Discussion and Analysis of Financial Condition and Results of Operations—Liquidity and Capital Resources”).

We have funded our operations since inception primarily through equity and debt financings and sales of our solutions.

We cannot be certain when or if our operations will generate sufficient cash to fully fund our ongoing operations or the growth of our business.

We intend to continue to make investments to support our business, which may require us to engage in equity or debt financings to secure additional funds.

We intend to continue to make investments to support our business, which may require us to engage in further equity or debt financings to secure additional funds.

Additional financing may not be available on terms favorable to us, if at all, particularly during times of market volatility, higher interest rates, inflationary pressures, and general economic instability.

If adequate funds are not available on acceptable terms, we may be unable to invest in future growth opportunities, which could harm our business, financial condition, and results of operations.

If we incur additional debt, the debt holders would have rights senior to holders of common stock to make claims on our assets, and the terms of any debt could restrict our operations, including our ability to pay dividends on our Class A common stock.

Furthermore, if we issue additional equity securities, stockholders will experience dilution, and the new equity securities could have rights senior to those of our Class A common stock.

Any debt we incur could give the debt holders rights senior to our stockholders to make claims on our assets and could involve covenants which may limit our ability to obtain additional capital, pursue business opportunities and strategic transactions and pay dividends on our Class A common stock.

For example, the holders of our Notes have rights senior to holders of our Class A common stock to make claims on our assets, and the indenture governing the Notes, include customary covenants for us, such as covenants to make payment of principal and special interest (if any) and remain current in our reporting obligations with the SEC.

Furthermore, if we issue additional equity securities, including shares of Class A common stock issued upon conversion of the Notes, stockholders will experience dilution, and in some cases we may issue new equity securities that have rights senior to those of our Class A common stock.

Because our decision to issue securities in the future will depend on numerous considerations, including factors beyond our control, we cannot predict or estimate the amount, timing, or nature of any future issuances of debt or equity securities.

As a result, our stockholders bear the risk of future issuances of debt or equity securities reducing the value of our Class A common stock and diluting their interests.

Servicing our debt may require a significant amount of cash.

We may not have sufficient cash flow from our business to pay our indebtedness.

Our ability to make scheduled payments of the principal of, to pay special interest, if any, on or to refinance the Notes, depends on our future performance, which is subject to economic, financial, competitive and other factors beyond our control.

Our business may not continue to generate sufficient cash flow from operations to service our debt and make necessary capital expenditures.

If we are unable to generate such cash flow, we may be required to adopt one or more alternatives, such as selling assets, restructuring debt, or obtaining additional equity capital on terms that may be onerous or highly dilutive.

Our ability to refinance the Notes will depend on the capital markets and our financial condition at such time.

We may not be able to engage in any of these activities or engage in these activities on desirable terms, which could result in a default on our debt obligations.

In addition, any of our future debt agreements may contain restrictive covenants that may prohibit us from adopting any of these alternatives.

Our failure to comply with these covenants could result in an event of default which, if not cured or waived, could result in the acceleration of our debt repayment.

We may not have enough available cash or the ability to raise the funds necessary to pay cash upon conversion of the Notes or to repurchase the Notes upon a fundamental change.

Holders of the Notes will have the right, subject to certain conditions and limited exceptions, to require us to repurchase all or any portion of their Notes upon the occurrence of a fundamental change (as defined and described in the Indenture).

In addition, upon any conversion of the Notes, unless we elect to deliver solely shares of our Class A common stock to settle such conversion, we will be required to make cash payments in respect of the Notes being converted.

However, we may not have enough available cash or be able to obtain financing at the time we are required to make repurchases of Notes surrendered therefor or pay cash with respect to Notes being converted.

Our failure to repurchase the Notes at a time when the repurchase is required by the Indenture or to pay any cash payable on future conversions of the Notes as required by the Indenture would constitute a default under the Indenture.

If the repayment of the related indebtedness were to be accelerated, we may not have sufficient funds to repay the indebtedness and repurchase the Notes or make cash payments upon conversions of the Notes.

We are exposed to fluctuations in currency exchange rates, which could negatively affect our results of operations.

Our data security solutions are billed in U.S.

Our solutions are billed in U.S.

dollars, and therefore, our revenue is not subject to foreign currency risk.

However, a strengthening of the U.S.

dollar could increase the real cost of our data security solutions to our customers outside of the United States, which could adversely affect our results of operations.

dollar could increase the real cost of our solutions to our customers outside of the United States and negatively impact sales to foreign customers.

Alternatively, if the U.S.

dollar weakens, our operating expenses could rise, which could adversely affect our results of operations.

In addition, an increasing portion of our operating expenses are incurred outside the United States.

4 unchanged sentences

Global business activities face widespread macroeconomic uncertainties, and our results of operations may vary based on the impact of changes in our industry or the global economy on us or our customers and potential customers.

Negative conditions in the general economy both in the United States and abroad, including conditions resulting from changes in gross domestic product growth, financial and credit market fluctuations, inflation and efforts to control further inflation, including rising interest rates, bank failures, international trade relations, including tariffs and trade tensions, political turmoil, including the conflict in the Middle East and the ongoing conflict between Russia and Ukraine, potential U.S.

Negative conditions in the general economy both in the United States and abroad, including conditions resulting from changes in gross domestic product growth, financial and credit market fluctuations, inflation and efforts to control further inflation, including high interest rates, bank failures, international trade relations, including tariffs and trade tensions, political turmoil, military conflicts, U.S.

federal government shutdowns, natural catastrophes, warfare, and terrorist attacks could cause a decrease in business investments by existing or potential customers, including spending on technology, and negatively affect the growth of our business.

As an example, in the United States, capital markets have experienced and continue to experience volatility and disruption.

Furthermore, inflation rates in the United States have recently increased to levels not seen in decades.

In addition to the foregoing, adverse developments that affect financial institutions, transactional counterparties, or other third parties, such as bank failures or concerns or speculation about any similar events or risks, could lead to market-wide liquidity problems, which in turn may cause third parties, including our customers, to become unable to meet their obligations under various types of financial arrangements as well as general disruptions or instability in the financial markets.

2 unchanged sentences

These customer dynamics may persist in the future, even if macroeconomic conditions improve, and to the extent there is a sustained general economic downturn, a recession, or another situation where technology budgets grow at a slower rate or contract, these customer dynamics may be exacerbated.

In addition to the foregoing, we have operations in Israel, which have been affected and may continue to be affected by the ongoing conflict in Israel and the surrounding area, and our growth, business, and results of operations could be further negatively impacted if the current conflict in Israel and the surrounding area continues, worsens, or expands to other nations or regions.

In addition to the foregoing, we have operations in Israel, which have been affected and may continue to be affected by the ongoing conflict in Israel and the Middle East, and our growth, business, and results of operations could be further negatively impacted if the current conflict in Israel and the Middle East continues, worsens, or expands to other nations or regions.

Similarly, we have a significant presence in Bangalore, India, which may be disrupted by future conflicts between India and Pakistan, potentially leading to development delays and operational interruptions to our software engineering and renewals teams.

Our competitors, many of whom are larger and have greater financial resources than we do, may respond to challenging market conditions by lowering prices in an attempt to attract our customers, which may require us to respond in kind and may negatively impact our existing customer relationships and new customer acquisition strategy.

In addition, the increased pace of consolidation in certain industries may result in reduced overall spending on our data security solutions.

In addition, the increased pace of consolidation in certain industries may result in reduced overall spending on our solutions.

We cannot predict the timing, strength, or duration of any economic slowdown, instability, or recovery, generally or within any particular industry.

12 unchanged sentences

These risks include longer sales cycles and negotiations, more complex customer requirements (including audit and other requirements driven by such customers’ regulatory and industry contexts), substantial upfront sales costs, and less predictability in completing some of our sales.

For example, enterprise customers may require considerable time to evaluate and test our data security solutions and those of our competitors prior to making a purchase decision and placing an order or may need specialized security features to meet regulatory requirements.

A number of factors influence the length and variability of our sales cycle, including the need to educate potential customers about the uses and benefits of our data security solutions, the discretionary nature of purchasing and budget cycles, the macroeconomic uncertainty and challenges and resulting increased technology spending scrutiny, and the competitive nature of evaluation and purchasing approval processes.

Since the processes for deployment, configuration, and management of our data security solutions are complex, we are also often required to invest significant time and other resources to train and familiarize potential customers with our data security solutions.

For example, enterprise customers may require considerable time to evaluate and test our solutions and those of our competitors prior to making a purchase decision and placing an order or may need specialized security features to meet regulatory requirements.

A number of factors influence the length and variability of our sales cycle, including the need to educate potential customers about the uses and benefits of our solutions, the discretionary nature of purchasing and budget cycles, the macroeconomic uncertainty and challenges and resulting increased technology spending scrutiny, and the competitive nature of evaluation and purchasing approval processes.

Since the processes for deployment, configuration, and management of our solutions are complex, we are also often required to invest significant time and other resources to train and familiarize potential customers with our solutions.

Customers may engage in extensive evaluation, testing, and quality assurance work before making a purchase commitment, which increases our upfront investment in sales, marketing, and deployment efforts, with no guarantee that these customers will make a purchase or increase the scope of their subscriptions.

In certain circumstances, an enterprise customer’s decision to use our data security solutions may be an organization-wide decision, and therefore, these types of sales require us to provide greater levels of education regarding the use and benefits of our data security solutions.

In certain circumstances, an enterprise customer’s decision to use our solutions may be an organization-wide decision, and therefore, these types of sales require us to provide greater levels of education regarding the use and benefits of our solutions.

As a result, the length of our sales cycle, from identification of the opportunity to deal closure, has varied, and may continue to vary, significantly from customer to customer, with sales to large enterprises and organizations typically taking longer to complete.

Moreover, large enterprise customers often begin to deploy our data security solutions on a limited basis but nevertheless demand configuration, integration services, and pricing negotiations, which increase our upfront investment in the sales effort with no guarantee that these customers will deploy our data security solutions widely enough across their organization to justify our substantial upfront investment.

Given these factors, it is difficult to predict whether and when a sale will be completed and when revenue from a sale will be recognized due to the variety of ways in which customers may purchase our data security solutions.

Moreover, large enterprise customers often begin to deploy our solutions on a limited basis but nevertheless demand configuration, integration services, and pricing negotiations, which increase our upfront investment in the sales effort with no guarantee that these customers will deploy our solutions widely enough across their organization to justify our substantial upfront investment.

This may result in lower than expected revenue in any given period, which would have an adverse effect on our business, financial condition, and results of operations.

7 unchanged sentences

• other practical, resource, or business limitations on our ability to detect and prevent infringement or misappropriation of our rights and to enforce our rights;

• uncertainty with respect to legal standards regarding the existence, validity and enforceability of proprietary rights in outputs from AI platforms (including those that we may use for coding our products and tools).

Further, the laws of certain foreign countries, particularly certain developing countries, do not provide the same level of protection of corporate proprietary information and assets, such as intellectual property, including trademarks, trade secrets, know-how, and records, as the laws of the United States and mechanisms for enforcement of intellectual property rights may be inadequate.

12 unchanged sentences

A component of our growth strategy involves the further expansion of our operations and customer base internationally.

Customers outside the United States generated 31% and 32% of our total revenue for fiscal 2025 and fiscal 2024, respectively.

Customers outside the United States generated 30% and 31% of our total revenue for fiscal 2026 and 2025, respectively.

We are continuing to adapt to and develop strategies to expand in international markets, but there is no guarantee that such efforts will have the desired effect.

29 unchanged sentences

Currently, we are a listed participant.

However, given historical challenges to similarly positioned frameworks, it is possible that the Data Privacy Framework is invalidated in the future, and we will need to rely on other established transfer mechanisms for cross border transfers.

However, given historical challenges to similarly positioned frameworks, it is possible that the Data Privacy Framework may be invalidated in the future, and we will need to rely on other established transfer mechanisms for cross border transfers.

Other jurisdictions may adopt similarly stringent interpretations of their cross-border data transfer laws.

2 unchanged sentences

Some European regulators have ordered certain companies to suspend or permanently cease certain transfers of personal data out of Europe for allegedly violating the GDPR cross-border data transfer limitations.

We may also become subject to new laws that regulate non-personal information.

For example, the European Union’s Data Act imposes certain data and cloud service interoperability and switching obligations to enable users to switch between cloud service providers without undue delay or cost, as well as certain requirements concerning cross-border international transfers of, and governmental access to, non-personal information outside the European Economic Area.

Depending on how this Act and any similar laws are implemented and interpreted, we may have to adapt our business practices, contractual arrangements, and services to comply with such obligations, which could impact our revenue and results of operations, if such changes impact our customers’ subscription terms.

Additionally, the U.S.

Department of Justice issued a rule entitled the Preventing Access to U.S.

Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons, which places additional restriction on certain data transactions involving countries of concern (e.g., China, Russia, Iran) and covered persons that may impact certain business activities such as vendor engagements, sale or sharing of data, employment of certain individuals, and investor agreements.

Violations of the rule could lead to significant civil and criminal fines and penalties.

In addition to privacy, data protection, and data security laws and regulations, we are and may in the future become contractually subject to industry standards adopted by industry groups, such as the Payment Card Industry Data Security Standards ("PCI").

1 unchanged sentence

Data protection laws, such as the EU GDPR, UK GDPR, and CCPA, increasingly require companies to impose specific contractual restrictions on their service providers and contractors.

In addition, customers that use certain of our data security solutions to process protected health information may require us to sign business associate agreements that subject us to the privacy and security requirements under HIPAA and HITECH, as well as state laws that govern the privacy and security of health information.

In addition, customers that use certain of our solutions to process protected health information may require us to sign business associate agreements that subject us to the privacy and security requirements under HIPAA and HITECH, as well as state laws that govern the privacy and security of health information.

Our customers’ increasing data privacy and data security standards also increase the cost and complexity of ensuring that we, and the third parties we work with on to operate our business and deliver our services, can meet these standards.

If we, or the third parties with whom we work, are unable to meet our customers’ demands or comply with the increasingly stringent legal or contractual requirements relating to data privacy and data security, we may face increased legal liability, customer contract terminations, and reduced demand for our data security solutions.

2026 Form 10-K 46

Finally, we publish privacy policies, marketing materials, white papers and other statements, such as statements related to compliance with certain certifications or self-regulatory principles, as well as other documentation concerning data privacy, security, and AI.

Regulators in the United States are increasingly scrutinizing these statements, and if these policies, materials, statements, or documentations are found to be deficient, lacking in transparency, deceptive, unfair, or misrepresentative of our practices, we may be subject to investigation, regulatory enforcement actions, costly legal claims by affected individuals or our customers, or other adverse consequences.

2025 Form 10-K 44

Obligations related to data privacy and data security (and consumers’ data privacy expectations) are quickly changing, becoming increasingly stringent, and creating uncertainty.

17 unchanged sentences

Some of these claims allow for the recovery of statutory damages on a per violation basis, and, if viable, carry the potential for monumental statutory damages, depending on the volume of data and the number of violations.

As a result of being a public company, we are obligated to develop and maintain proper and effective internal control over financial reporting, and any failure to maintain the adequacy of these internal controls may adversely affect investor confidence in our company and, as a result, the value of our Class A common stock.

We are required, pursuant to Section 404 of the Sarbanes-Oxley Act of 2002, as amended ("Sarbanes-Oxley Act"), to furnish a report by management on, among other things, the effectiveness of our internal control over financial reporting for the fiscal year ending January 31, 2026.

This assessment will need to include disclosure of any material weaknesses identified by our management in our internal control over financial reporting.

In addition, our independent registered public accounting firm will be required to attest to the effectiveness of our internal control over financial reporting in our first annual report required to be filed with the SEC following the date we are no longer an “emerging growth company.” We have recently commenced the costly and challenging process of compiling the system and processing documentation necessary to perform the evaluation needed to comply with Section 404 of the Sarbanes-Oxley Act ("Section 404"), but we may not be able to complete our evaluation, testing, and any required remediation in a timely fashion once initiated.

Our compliance with Section 404 will require that we incur substantial expenses and expend significant management efforts.

Although we currently have an internal audit group, we will need to hire additional accounting and financial staff with appropriate public company experience and compile the system and process documentation necessary to perform the evaluation needed to comply with Section 404.

As a result of being a public company, we are obligated to develop and maintain proper and effective internal controls over financial reporting, and any failure to maintain the adequacy of these internal controls may adversely affect investor confidence in our company and, as a result, the value of our Class A common stock.

This assessment is required to include disclosure of any material weaknesses identified by our management in our internal control over financial reporting.

In addition, our independent registered public accounting firm is required to attest to the effectiveness of our internal control over financial reporting.

The process of compiling the system and process documentation necessary to perform the evaluation required under Section 404 of the Sarbanes-Oxley Act ("Section 404") is costly and challenging.

Our compliance with Section 404 requires that we incur substantial expenses and expend significant management efforts.

Although we currently have an internal audit group, we have in the past, and may in the future, need to hire additional accounting and financial staff with appropriate public company experience.

During the evaluation and testing process of our internal controls, if we identify one or more material weaknesses in our internal control over financial reporting, we will be unable to certify that our internal control over financial reporting is effective.

6 unchanged sentences

We have been and may continue in the future to be subject to intellectual property disputes.

In regard to future litigation, our success depends, in part, on our ability to develop and commercialize our data security solutions without infringing, misappropriating, or otherwise violating the intellectual property rights of third parties.

However, we may not be aware that our data security solutions are infringing, misappropriating, or otherwise violating third-party intellectual property rights, and such third parties may bring claims against us, our business partners, and our customers alleging such infringement, misappropriation, or violation.

In regard to future litigation, our success depends, in part, on our ability to develop and commercialize our solutions without infringing, misappropriating, or otherwise violating the intellectual property rights of third parties.

However, we may not be aware that our solutions are infringing, misappropriating, or otherwise violating third-party intellectual property rights, and such third parties may bring claims against us, our business partners, and our customers alleging such infringement, misappropriation, or violation.

Companies in the software industry are often required to defend against litigation claims based on allegations of infringement, misappropriation, or other violations of intellectual property rights.

9 unchanged sentences

Any intellectual property litigation to which we might become a party, or for which we are required to provide indemnification, may require us to do one or more of the following:

• cease selling or using data security solutions that incorporate the intellectual property rights that we allegedly infringe, misappropriate, or violate;

• cease selling or using solutions that incorporate the intellectual property rights that we allegedly infringe, misappropriate, or violate;

• make substantial payments for legal fees, settlement payments, or other costs or damages;

• obtain a license, which may not be available on reasonable terms or at all, to sell or use the relevant technology;

• redesign the allegedly infringing data security solutions to avoid infringement, misappropriation, or violation, which could be costly, time-consuming, or impossible.

• redesign the allegedly infringing solutions to avoid infringement, misappropriation, or violation, which could be costly, time-consuming, or impossible.

Even if the claims do not result in litigation or are resolved in our favor, these claims, and the time and resources necessary to resolve them, could divert the resources of our management and harm our business and results of operations.

5 unchanged sentences

Many of our employees were previously employed at current or potential competitors.

Although we have processes to ensure that our employees do not use proprietary information or disclose confidential information from their prior employer in their work for us or otherwise violate their contractual post-employment obligations such as customer and employee non-solicits, we or our employees may still in the future become subject to claims alleging such violations.

Litigation may be necessary to defend against these claims.

Although we have processes to ensure that our employees do not use proprietary information or disclose confidential information from their prior employer in their work for us or otherwise violate their contractual post-employment obligations such as customer and employee non-solicits, we or our employees have in the past been, and may in the future, be subject to claims alleging such violations.

Litigation has been, and may in the future be, necessary to defend against these claims and we have not always been successful in defending these claims.

If we fail in defending such claims, in addition to paying monetary damages, we may lose valuable intellectual property rights or personnel.

1 unchanged sentence

Even if we are successful in defending against these claims, litigation efforts are costly, time-consuming, and a significant distraction to management.

2026 Form 10-K 48

Our company values have contributed to our success.

2 unchanged sentences

Our core company values are:

2025 Form 10-K 46

• Relentlessness .

8 unchanged sentences

We have rapidly increased our workforce across all departments, and we expect to continue to hire across our business.

Our anticipated headcount growth, combined with our transition from a privately held to a publicly traded company, may result in changes to certain employees’ adherence to our core company values.

Our anticipated headcount growth may result in changes to certain employees’ adherence to our core company values.

If we do not continue to maintain our adherence to our company values as we grow, including through any future acquisitions or other strategic transactions, we may experience increased turnover in a portion of our current employee base and may not continue to be successful in hiring future employees.

3 unchanged sentences

Our current and future international business and operations involve a variety of risks, including:

• slower than anticipated availability and adoption of cloud-based data security solutions by international organizations;

• slower than anticipated availability and adoption of cloud-based solutions by international organizations;

• changes in a specific country’s or region’s political or economic conditions;

• the need to adapt and localize our data security solutions for specific countries;

• the need to adapt and localize our solutions for specific countries;

• greater difficulty collecting accounts receivable and longer payment cycles;

10 unchanged sentences

• limited or insufficient intellectual property protection or difficulties obtaining, maintaining, protecting, or enforcing our intellectual property rights, including our trademarks and patents, in the United States or other foreign jurisdictions;

• political instability, economic sanctions, terrorist activities, or international conflicts, including the conflict in Israel and the surrounding area and the ongoing conflict between Russia and Ukraine, which have in the past and may in the future impact the operations of our business or the businesses of our customers;

• political instability, economic sanctions, terrorist activities, or international conflicts, including the conflict in Israel and Middle East and the ongoing conflict between Russia and Ukraine, which have in the past and may in the future impact the operations of our business or the businesses of our customers;

• inflationary pressures, such as those the global market is currently experiencing, which may increase costs for certain services;

• health epidemics or pandemics;

2026 Form 10-K 49

• exposure to liabilities under anti-corruption and similar laws, including FCPA, U.S.

1 unchanged sentence

• adverse tax burdens and foreign exchange controls that could make it difficult to repatriate earnings and cash.

2025 Form 10-K 47

The occurrence of any one of these risks could harm our international business and, consequently, our results of operations.

4 unchanged sentences

Changes in tax laws or regulations, or changes in interpretations of existing laws and regulations, could materially affect our financial condition and results of operations.

For example, the Tax Cuts and Jobs Act (the "Tax Act"), the Coronavirus Aid, Relief, and Economic Security Act, and the Inflation Reduction Act made many significant changes to the U.S.

Effective January 1, 2022, the Tax Act eliminated the option to deduct research and development expenses for tax purposes in the year incurred and instead requires taxpayers to capitalize and subsequently amortize such expenses over five years for research activities conducted in the United States and over 15 years for research activities conducted outside the United States.

Although there have been legislative proposals to repeal or defer the capitalization requirement to later years, there can be no assurance that the provision will be repealed or otherwise modified.

Legislation commonly referred to as the One Big Beautiful Bill Act (the “OBBBA”), as well as the Tax Cuts and Jobs Act (the "Tax Act"), the Coronavirus Aid, Relief, and Economic Security Act, and the Inflation Reduction Act made many significant changes to the U.S.

For example, for tax years beginning after December 31, 2024, the OBBBA restores the deductibility of domestic research and development expenses in the year incurred, which expenses had been required under the Tax Act to be capitalized and subsequently amortized over five years.

The OBBBA did not change the tax treatment of expenses incurred in research and development activities conducted outside the United States, which expenses continue to be required to be capitalized and amortized over 15 years.

The Tax Act also includes certain U.S.

2 unchanged sentences

taxable income foreign subsidiary earnings in excess of an allowable return on the foreign subsidiary’s tangible assets.

The OBBBA modified the GILTI provisions to refer to net CFC tested income (“NCTI”), eliminate the allowable return on the foreign subsidiary’s tangible assets for taxable years beginning after December 31, 2025, and increase but make permanent the effective tax rate on NCTI.

We currently have no foreign subsidiaries with material earnings.

4 unchanged sentences

however, the potential impact of the BEAT rules on us in the future is not certain.

In addition, our tax obligations and effective tax rate in the jurisdictions in which we conduct business could increase, including as a result of the base erosion and profit shifting ("BEPS") project that is being led by the Organization for Economic Co-operation and Development ("OECD"), and other initiatives led by the OECD or the European Commission.

In addition, our tax obligations (including the cost of compliance) and effective tax rate in the jurisdictions in which we conduct business could increase, including as a result of the base erosion and profit shifting ("BEPS") project that is being led by the Organization for Economic Co-operation and Development ("OECD"), and other initiatives led by the OECD or the European Commission.

For example, the OECD is leading work on proposals commonly referred to as “BEPS 2.0,” which have made (and are expected to continue to make) important changes to the international tax system.

These proposals are based on two “pillars,” involving the reallocation of taxing rights in respect of certain profits of multinational enterprises above a fixed profit margin to the jurisdictions within which they carry on business (subject to certain revenue threshold rules, which we do not currently meet but may meet in the future), referred to as “Pillar One,” and imposing a minimum effective tax rate on certain multinational enterprises, referred to as “Pillar Two.” A number of countries in which we conduct business have enacted, or are in the process of enacting, core elements of the Pillar Two rules.

Based on our current understanding of the minimum revenue thresholds contained in the Pillar Two proposal, we currently expect to fall within the scope of its rules in the short term.

The OECD has issued administrative guidance providing transition and safe harbor rules in relation to the implementation of the Pillar Two proposal.

We are monitoring developments and evaluating the potential impacts of these new rules, including on our effective tax rates, and considering our eligibility to qualify for these safe harbor rules.

These proposals are based on two “pillars,” involving, among other measures, the imposition of a minimum effective tax rate on certain multinational enterprises, referred to as “Pillar Two.” A number of countries in which we conduct business have enacted, or are in the process of enacting, core elements of the Pillar Two rules (with further provisions expected to be enacted in the future).

Based on our current understanding of the minimum revenue thresholds contained in the Pillar Two proposal, we will fall within the scope of its rules in our fiscal year ending January 31, 2027.

The OECD has issued (and is expected to continue to issue further) administrative guidance providing transition and safe harbor rules in relation to the implementation of the Pillar Two proposal.

For example, on January 5, 2026, the OECD published details of a proposed “side-by-side” arrangement providing for, among other things, additional safe harbors for multinational groups headquartered in certain qualifying jurisdictions.

We are monitoring developments and evaluating the potential impacts of Pillar Two rules, including on our effective tax rates, and considering our eligibility to qualify for these safe harbor rules (including under the proposed “side-by-side” arrangement).

As another example, several countries have proposed or enacted taxes applicable to digital services, which could apply to our business.

5 unchanged sentences

We sell subscriptions and services primarily through a distribution channel, but if we were to begin selling more (or, in respect of certain jurisdictions, any) subscriptions and services directly to end user or non-business customers, we may be adversely impacted because an increasing number of U.S.

states and foreign jurisdictions are considering or have adopted laws that impose tax collection obligations on out-of-state companies or on companies with no taxable presence within such jurisdictions other than economic nexus.

State, local, or foreign governments may interpret existing laws, or have adopted or may adopt new laws, requiring us to calculate, collect and remit taxes on sales in their jurisdictions.

states and foreign jurisdictions have adopted laws that impose tax collection obligations on out-of-state companies or on companies with no taxable presence within such jurisdictions other than economic nexus.

State, local, or foreign governments may interpret existing laws, or adopt new laws, requiring us to calculate, collect and remit taxes on sales in their jurisdictions.

A successful assertion by one or more taxing jurisdictions requiring us to collect taxes in jurisdictions in which we do not currently do so or to collect additional taxes in jurisdictions in which we currently collect taxes, could result in substantial tax liabilities, including taxes on past sales, as well as penalties and interest, and additional administrative expenses, which could harm our business.

1 unchanged sentence

Our ability to use our net operating losses to offset future taxable income may be subject to certain limitations.

As of January 31, 2025, we had net operating loss ("NOL"), carryforwards for federal and state income tax purposes of $1,346.1 million and $626.2 million, respectively, which may be available to offset taxable income in the future, and portions of which expire in various years beginning in 2037 for federal purposes and 2028 for state purposes if not utilized.

Under current law, U.S.

federal NOLs incurred in taxable years beginning after December 31, 2017 may be carried forward indefinitely, but such federal NOLs are permitted to be used in any taxable year to offset only up to 80% of taxable income in such year.

A lack of future taxable income would adversely affect our ability to utilize certain of these NOLs before they expire.

As of January 31, 2026, we had net operating loss ("NOL") carryforwards for federal and state income tax purposes of $1.97 billion and $870.7 million, respectively, which may be available to offset taxable income in the future, and portions of which expire in various years beginning in 2037 for federal purposes and 2027 for state purposes if not utilized.

federal NOLs incurred in taxable years beginning after December 31, 2017 may be carried forward indefinitely, but such federal NOL carryforwards are permitted to be used in any taxable year to offset only up to 80% of taxable income in such year.

A lack of future taxable income would adversely affect our ability to utilize certain of these NOL carryforwards before they expire.

In addition, under Section 382 of the Internal Revenue Code of 1986, as amended (the "Code"), a corporation that undergoes an “ownership change” (as defined under Section 382 of the Code and applicable Treasury Regulations;

generally a greater than 50 percentage point change (by value) in its equity ownership by certain stockholders over a three-year period) is subject to limitations on its ability to utilize its pre-change NOLs to offset future taxable income.

We have experienced ownership changes under Section 382 of the Code in the past and we may experience additional ownership changes in the future which could affect our ability to utilize our NOLs to offset our income.

Similar provisions of state tax law may also apply.

19 unchanged sentences

We base our estimates on historical experience and on various other assumptions that we believe to be reasonable under the circumstances, as provided in the section titled “Management’s Discussion and Analysis of Financial Condition and Results of Operations—Critical Accounting Policies and Estimates.” The results of these estimates form the basis for making judgments about the carrying values of assets, liabilities and equity, and the amount of revenue and expenses that are not readily apparent from other sources.

Significant estimates and judgments involve our common stock valuations prior to the completion of the IPO, the volatility used to determine the grant date fair value of the performance option grant for our CEO, the identification of the number of performance obligations in our RSC subscription offerings, and our material rights associated with our Refresh Rights and Subscription Credits.

Our results of operations may be adversely affected if our assumptions change or if actual circumstances differ from those in our assumptions, which could cause our results of operations to fall below the expectations of securities analysts and investors, resulting in a decline in the market price of our Class A common stock.

Our leverage could adversely affect our financial condition, our ability to raise additional capital to fund our operations, our ability to operate our business, and our ability to react to changes in the economy or our industry, as well as divert our cash flow from operations for debt payments and prevent us from meeting our debt obligations.

We entered into the Amended Credit Facility in August 2023 with Goldman Sachs BDC, Inc., as administrative agent, and the other lenders party thereto, consisting of a $289.5 million term loan and $40.5 million of committed delayed draw term loans.

The term loans mature in August 2028, and the interest payments associated with the term loans are due quarterly.

The Amended Credit Facility refinanced and replaced the term loan facility we previously entered into in June 2022 with Goldman Sachs BDC, Inc., as administrative agent, and the other lenders party thereto.

We issued $1.15 billion of the Notes in June 2025 pursuant to the Indenture.

We previously entered into the Amended Credit Facility in August 2023 with Goldman Sachs BDC, Inc., as administrative agent, and the other lenders party thereto, consisting of a $289.5 million term loan and $40.5 million of committed delayed draw term loans.

In June 2025, we used a portion of the net proceeds from the issuance of the Notes to repay all outstanding balance of $327.9 million under the Amended Credit Facility, and also terminated the Amended Credit Facility.

Our leverage could have an adverse effect on our business and financial condition, including:

7 unchanged sentences

• limiting our flexibility in planning for, or reacting to, changes in our business or market conditions and placing us at a competitive disadvantage compared to our competitors who may be better positioned to take advantage of opportunities that our existing indebtedness prevents us from exploiting.

A substantial majority of our existing indebtedness consists of indebtedness under our Amended Credit Facility with Goldman Sachs BDC, Inc., as administrative agent, and the other lenders party thereto, which matures in August 2028.

We may not be able to further refinance the existing indebtedness because of the amount of our debt, debt incurrence restrictions under our debt agreements, or adverse conditions in credit markets generally.

We now have, and may continue to have, debt obligations.

A substantial majority of our existing indebtedness consists of indebtedness under the Notes, which matures in June 2030.

We may not be able to further refinance the existing indebtedness because of the amount of our debt or adverse conditions in credit markets generally.

Our inability to generate sufficient cash flow to satisfy our obligations, or to refinance our indebtedness on commercially reasonable terms or at all, would result in an adverse effect on our business, financial condition, and results of operations.

Furthermore, we may incur significant additional indebtedness in the future.

Although the financing documents that govern substantially all of our indebtedness contain restrictions on the incurrence of additional indebtedness and entering into certain types of other transactions, these restrictions are subject to a number of qualifications and exceptions.

Additional indebtedness incurred in compliance with these restrictions could be substantial.

Additional indebtedness incurred in the future could be substantial.

To the extent we incur additional indebtedness, the significant leverage risks described above would be exacerbated.

The terms of the financing documents governing our term loan and credit facilities restrict our current and future operations, particularly our ability to respond to changes or to take certain actions.

The financing documents governing our credit facilities impose significant operating and financial restrictions on us and may limit our ability to engage in acts that may be in our long-term best interests, including restrictions on our ability to:

• incur or guarantee additional indebtedness;

• pay dividends and make other distributions on, or redeem or repurchase, capital stock;

• make certain investments;

• incur certain liens;

• enter into transactions with affiliates;

• merge or consolidate;

• enter into agreements that restrict the ability of subsidiaries to make certain intercompany dividends, distributions, payments, or transfers;

• transfer or sell assets, including our intellectual property.

As a result of the restrictions described above, we will be limited as to how we conduct our business, and we may be unable to raise additional debt or equity financing to compete effectively or to take advantage of new business opportunities.

The terms of any future indebtedness we may incur could include more restrictive covenants.

We cannot assure you that we will be able to maintain compliance with these covenants in the future and, if we fail to do so, that we will be able to obtain waivers from the lenders or amend the covenants.

Our failure to comply with the restrictive covenants described above as well as other terms of our indebtedness or the terms of any future indebtedness we may incur from time to time could result in an event of default, which, if not cured or waived, could result in our being required to repay these borrowings before their due date.

If we are forced to refinance these borrowings on less favorable terms or are unable to refinance these borrowings, our business, financial condition, and results of operations could be adversely affected.

2025 Form 10-K 51

Risks Related to Ownership of Our Common Stock

1 unchanged sentence

Our Class B common stock has 20 votes per share, whereas our Class A common stock has one vote per share.

As a result, as of January 31, 2025, holders of our Class B common stock, including our executive officers and directors and their affiliates, together hold approximately 95% of the voting power of our outstanding capital stock, and our directors, executive officers, and principal stockholders beneficially own approximately 45% of our outstanding classes of common stock as a whole, but control approximately 90% of the voting power of our outstanding common stock.

As a result, as of January 31, 2026, holders of our Class B common stock, including our executive officers and directors and their affiliates, together hold approximately 85% of the voting power of our outstanding capital stock, and our directors, executive officers, and affiliated stockholders beneficially own approximately 23% of our outstanding classes of common stock as a whole, but control approximately 83% of the voting power of our outstanding common stock.

As a result, our executive officers, directors, and other affiliates have significant influence over our management and affairs and over all matters requiring stockholder approval, including election of directors and significant corporate transactions, such as a merger or other sale of the company or our assets, for the foreseeable future.

10 unchanged sentences

As a result, the trading price, volume, and liquidity of our Class A common stock could be adversely affected.

2026 Form 10-K 53

Our stock price may be volatile, and the value of our Class A common stock may decline.

3 unchanged sentences

• changes in our revenue mix;

• changes in the pricing of our data security solutions;

• changes in the pricing of our solutions;

• changes in our projected operating and financial results;

• changes in laws or regulations applicable to our data security solutions;

• announcements by us or our competitors of significant business developments, acquisitions, or new data security solutions;

• changes in laws or regulations applicable to our solutions;

• announcements by us or our competitors of significant business developments, acquisitions, or new solutions;

• significant data breaches, disruptions to, or other incidents involving our data security solutions;

5 unchanged sentences

• changes in demand for cybersecurity offerings;

2025 Form 10-K 52

• rumors and market speculation involving us or other companies in our industry;

• investor sentiment regarding AI-related business models, our competitors, and our industry in general;

• overall performance of the equity markets;

13 unchanged sentences

Further, certain holders of our common stock have rights, subject to some conditions, to require us to file registration statements covering the sale of their shares or to include their shares in registration statements that we may file for ourselves or other stockholders.

Our issuance of additional capital stock in connection with financings, acquisitions, investments, our equity incentive plans, or otherwise will dilute all other stockholders.

2026 Form 10-K 54

The capped call transactions may affect the market price of the Notes and our Class A common stock.

In connection with the pricing of the Notes and the exercise in full by the initial purchasers of their option to purchase additional Notes, we entered into capped call transactions with certain affiliates of certain initial purchasers and other financial institutions (the “option counterparties”).

The capped call transactions cover, subject to anti-dilution adjustments substantially similar to those applicable to the Notes, the number of shares of our Class A common stock initially underlying the Notes.

The capped call transactions are expected generally to reduce the potential dilution to our Class A common stock upon any conversion of the Notes and/or offset any cash payments we are required to make in excess of the principal amount of converted Notes, as the case may be, with such reduction and/or offset subject to a cap.

In connection with establishing their initial hedges of the capped call transactions, the option counterparties or their respective affiliates entered into various derivative transactions with respect to our Class A common stock and/or purchased shares of our Class A common stock concurrently with or shortly after the pricing of the Notes, including with, or from, as the case may be, certain investors in the Notes.

This activity could increase (or reduce the size of any decrease in) the market price of our Class A common stock.

In addition, the option counterparties or their respective affiliates may modify their hedge positions by entering into or unwinding various derivatives with respect to our Class A common stock and/or purchasing or selling our Class A common stock or other securities of ours in secondary market transactions following the pricing of the Notes and prior to the maturity of the Notes (and are likely to do so following any conversion, repurchase upon a fundamental change or redemption of the Notes, or, to the extent we exercise the relevant election under the capped call transactions, following any other repurchase of the Notes).

This activity could also cause or avoid an increase or a decrease in the market price of our Class A common stock or the Notes.

We are subject to counterparty risk with respect to the capped call transactions.

The option counterparties are financial institutions, and we will be subject to the risk that any or all of them might default under the capped call transactions.

Our exposure to the credit risk of the option counterparties will not be secured by any collateral.

Global economic conditions have from time to time resulted in the actual or perceived failure or financial difficulties of many financial institutions and could adversely affect the option counterparties’ performance under the capped call transactions.

If an option counterparty becomes subject to insolvency proceedings, we will become an unsecured creditor in those proceedings with a claim equal to our exposure at that time under the capped call transactions with such option counterparty.

Our exposure will depend on many factors but, generally, an increase in our exposure will be correlated to an increase in the market price and in the volatility of our Class A common stock.

In addition, upon a default by an option counterparty, we may suffer more dilution, than we currently anticipate with respect to our Class A common stock.

We can provide no assurance as to the financial stability or viability of the option counterparties.

Our issuance of additional capital stock in connection with financings, acquisitions, investments, our equity incentive plans, or otherwise, or the conversion or exercise of certain of our securities will dilute all other stockholders.

We expect to issue additional capital stock in the future that will result in dilution to all other stockholders.

2 unchanged sentences

As part of our business strategy, we may acquire or make investments in companies, products, or technologies and issue equity securities to pay for any such acquisition or investment.

In addition, the conversion of some or all of the Notes may dilute the ownership interests of our stockholders.

Upon conversion of the Notes, we have the option to pay or deliver, as the case may be, cash, shares of our Class A common stock, or a combination of cash and shares of our Class A common stock.

If we elect to settle our conversion obligation in shares of our Class A common stock or a combination of cash and shares of our common stock with respect to conversions of the Notes, any sales in the public market of our Class A common stock issuable upon such conversion could adversely affect prevailing market prices of our Class A common stock.

Any such issuances of additional capital stock may cause stockholders to experience significant dilution of their ownership interests and the per share value of our Class A common stock to decline.

2 unchanged sentences

Any determination to pay dividends in the future will be at the discretion of our board of directors.

In addition, our Amended Credit Facility contains restrictions on our ability to pay cash dividends on our Class A Common Stock.

Additionally, our ability to pay dividends may be further restricted by agreements we may enter into in the future.

1 unchanged sentence

2026 Form 10-K 55

We are an “emerging growth company,” and we cannot be certain if the reduced reporting and disclosure requirements applicable to emerging growth companies will make our Class A common stock less attractive to investors.

We are an “emerging growth company,” as defined in the JOBS Act, and we may take advantage of certain exemptions from various reporting requirements that are applicable to other public companies that are not “emerging growth companies,” including the auditor attestation requirements of Section 404, reduced disclosure obligations regarding executive compensation in our periodic reports and proxy statements, and exemptions from the requirements of holding a nonbinding advisory vote on executive compensation and stockholder approval of any golden parachute payments not previously approved.

Pursuant to Section 107 of the JOBS Act, as an emerging growth company, we have elected to use the extended transition period for complying with new or revised accounting standards until those standards would otherwise apply to private companies.

As a result, our consolidated financial statements may not be comparable to the financial statements of issuers who are required to comply with the effective dates for new or revised accounting standards that are applicable to public companies, which may make our Class A common stock less attractive to investors.

In addition, if we cease to be an emerging growth company, we will no longer be able to use the extended transition period for complying with new or revised accounting standards.

We will remain an emerging growth company until the first to occur of:

(1) the last day of the year following the fifth anniversary of our IPO;

(2) the last day of the first year in which our annual gross revenue is $1.235 billion or more;

(3) the date on which we have, during the previous rolling three-year period, issued more than $1.0 billion in non-convertible debt securities;

and (4) the date we qualify as a “large accelerated filer,” with at least $700 million of equity securities held by non-affiliates.

We cannot predict if investors will find our Class A common stock less attractive if we choose to rely on these exemptions.

For example, if we do not adopt a new or revised accounting standard, our future results of operations may not be as comparable to the results of operations of certain other companies in our industry that adopted such standards.

If some investors find our Class A common stock less attractive as a result, there may be a less active trading market for our Class A common stock, and our stock price may be more volatile.

We incur significant costs as a result of operating as a public company, and our management is required to devote substantial time to compliance with our public company responsibilities and corporate governance practices.

As a public company, we incur significant legal, accounting, and other expenses that we did not incur as a private company, which we expect to further increase after we are no longer an “emerging growth company.” The Sarbanes-Oxley Act, the Dodd-Frank Wall Street Reform and Consumer Protection Act, the listing requirements of the New York Stock Exchange, and other applicable securities rules and regulations impose various requirements on public companies.

As a public company, we incur significant legal, accounting, and other expenses that we did not incur as a private company.

We expect such expenses to further increase now that we are a large accelerated filer.

The Sarbanes-Oxley Act, the Dodd-Frank Wall Street Reform and Consumer Protection Act, the listing requirements of the New York Stock Exchange, and other applicable securities rules and regulations impose various requirements on public companies.

Our management and other personnel devote a substantial amount of time to compliance with these requirements.

1 unchanged sentence

We cannot predict or estimate the amount of additional costs we will incur as a public company or the specific timing of such costs.

Anti-takeover provisions in our charter documents and under Delaware law could make an acquisition of our company more difficult, limit attempts by our stockholders to replace or remove our current management, and limit the market price of our Class A common stock.

Anti-takeover provisions in our charter documents, the Indenture, and under Delaware law could make an acquisition of our company more difficult, limit attempts by our stockholders to replace or remove our current management, and limit the market price of our Class A common stock.

Provisions in our amended and restated certificate of incorporation and amended and restated bylaws may have the effect of preventing a change of control or changes in our management.

7 unchanged sentences

• provide that our directors may be removed for cause only upon the vote of at least 66 2/3% of our outstanding shares of voting stock;

2025 Form 10-K 54

• provide that vacancies on our board of directors may be filled only by the affirmative vote of a majority of directors then in office, even though less than a quorum, or by a sole remaining director;

3 unchanged sentences

Any of the foregoing provisions could limit the price that investors might be willing to pay in the future for shares of our Class A common stock, and they could deter potential acquirers of our company, thereby reducing the likelihood that holders of our Class A common stock would receive a premium for their shares of our Class A common stock in an acquisition.

In addition, certain provisions in the Indenture may make it more difficult or expensive for a third party to acquire us.

For example, the Indenture will require us, except as described therein, to repurchase the Notes for cash upon the occurrence of a fundamental change and, in certain circumstances, to increase the conversion rate for a holder that converts its Note in connection with a make-whole fundamental change (as defined in the Indenture).

A takeover of us may trigger the requirement that we repurchase the Notes and/or increase the conversion rate, which could make it costlier for a potential acquirer to engage in such takeover.

Such additional costs may have the effect of delaying or preventing a takeover of us that would otherwise be beneficial to investors.

2026 Form 10-K 56

Our amended and restated certificate of incorporation designates the Court of Chancery of the State of Delaware and the federal district courts of the United States of America as the exclusive forums for certain disputes between us and our stockholders, which restricts our stockholders’ ability to choose the judicial forum for disputes with us or our directors, officers, or employees.

6 unchanged sentences

and (vi) any action or proceeding asserting a claim against us or any of our current or former directors, officers, or other employees that is governed by the internal affairs doctrine, in all cases to the fullest extent permitted by law and subject to the court’s having personal jurisdiction over the indispensable parties named as defendants.

This provision does not apply to suits brought to enforce a duty or liability created by the Securities Exchange Act of 1934, as amended (the "Exchange Act"), or any other claim for which the federal courts have exclusive jurisdiction.

This provision does not apply to suits brought to enforce a duty or liability created by the Exchange Act, or any other claim for which the federal courts have exclusive jurisdiction.

In addition, to prevent having to litigate claims in multiple jurisdictions and the threat of inconsistent or contrary rulings by different courts, among other considerations, our amended and restated certificate of incorporation provides that, unless we consent in writing to the selection of an alternative forum, to the fullest extent permitted by law, the federal district courts of the United States of America are the exclusive forum for resolving any complaint asserting a cause of action arising under the Securities Act, including all causes of action asserted against any defendant named in such complaint.

3 unchanged sentences

Investors also cannot waive compliance with the federal securities laws and the rules and regulations thereunder.

2025 Form 10-K 55

These choice of forum provisions may limit a stockholder’s ability to bring a claim in a judicial forum that it finds favorable for disputes with us or our directors, officers, or other employees.

9 unchanged sentences

If one or more of these analysts cease coverage of us or fail to publish reports on us regularly, demand for our Class A common stock could decrease, which might cause our stock price to decline and could decrease the trading volume of our Class A common stock.

2026 Form 10-K 57

General Risk Factors

9 unchanged sentences

Additionally, we rely on third-party cloud providers and enterprise applications, technology systems, and our website for our development, marketing, operational support, hosted services, and sales activities.

In the event of a catastrophic event, we may be unable to continue our operations and may endure system interruptions, reputational harm, delays in our product development, lengthy interruptions in our data security solutions, and breaches of data security, all of which could have an adverse effect on our results of operations.

In the event of a catastrophic event, we may be unable to continue our operations and may endure system interruptions, reputational harm, delays in our product development, lengthy interruptions in our solutions, and breaches of data security, all of which could have an adverse effect on our results of operations.

If we are unable to develop adequate plans to ensure that our business functions continue to operate during and after a disaster and to execute successfully on those plans in the event of a disaster or emergency, our business would be harmed.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors