What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2021-02-26 compared with 2020-02-28 · 366 added, 304 removed, 398 unchanged (63% of the section changed)

4 unchanged sentences

Additional risks and uncertainties that we are unaware of, or that we currently believe are not material, may also become important factors that adversely affect our business.

Furthermore, the ongoing COVID-19 pandemic (including federal, state and local governmental responses, broad economic impacts and market disruptions) has heightened risks discussed in the risk factors described below.

If any of the following risks or others not specified below materialize, our business, financial condition and results of operations could be materially adversely affected.

2 unchanged sentences

Risks Related to Our Business and Industry

The ongoing COVID-19 pandemic could materially and adversely affect our business, results of operations and financial condition.

The COVID-19 pandemic has resulted in authorities implementing numerous measures to contain the virus, including travel bans and restrictions, quarantines, shelter-in-place orders, and business limitations and shutdowns.

We are unable to accurately predict the full impact that COVID-19 will have on our results from operations, financial condition, liquidity and cash flows due to numerous uncertainties, including the duration and severity of the pandemic and containment measures.

Our compliance with these measures has impacted our day-to-day operations and could disrupt our business and operations, as well as that of our customers, partners, suppliers and others with whom we work, for an indefinite period of time.

To support the health and well-being of our employees, customers, partners and communities, a vast majority of our employees began working remotely as of late March 2020, and they continue to do so.

In addition, many of our customers and prospective customers are working remotely.

The disruptions to our operations caused by the COVID-19 pandemic may result in inefficiencies, delays and additional costs in our sales and marketing, professional service and research and development efforts, which cannot be predicted or quantified at this time.

To the extent that disruptions occur, we may not be able to fully mitigate any such inefficiencies, delays and additional costs through remote or other alternative work arrangements.

In addition, given the economic uncertainty created by COVID-19, we have and may continue to see delays in our sales cycle, failures of customers to renew at all or to renew the anticipated scope their subscriptions with us, requests from customers for payment term deferrals as well as pricing or bundling concessions, which, if significant, could materially and adversely affect our business, results of operations and financial condition.

Although such events did not have a material adverse impact on our customer renewals for fiscal year 2020, our annualized recurring revenue (ARR) related to contracts in place at the end of the fiscal year 2020 was lower than initially anticipated at the beginning of fiscal year 2020 as a result of the pull back on customer spending, in light of the economic uncertainty caused by the COVID-19 pandemic.

Negative conditions in the general economy both in the United States and abroad, including conditions resulting from the COVID-19 pandemic, changes in gross domestic product growth, financial and credit market fluctuations, energy costs, international trade relations and other geopolitical issues, the availability and cost of credit and the global housing and mortgage markets could cause a decrease in consumer discretionary spending and business investment and diminish growth expectations in the U.S.

economy and abroad.

More generally, the COVID-19 pandemic raises the possibility of an extended global economic downturn and has caused volatility in financial markets, which could materially and adversely affect demand for our products and professional services and could materially and adversely impact our results and financial condition even after the pandemic is contained and the various pandemic-related orders are lifted.

For example, we may be unable to collect receivables from those customers significantly impacted by COVID-19, which may be more pronounced in industry verticals more directly impacted by the COVID-19 pandemic.

Also, a decrease in subscriptions and/or renewals in a given period could negatively affect our ARR as well as our revenues in future periods, particularly if experienced on a sustained basis, because a substantial proportion of our software subscriptions yield revenue recognized over time.

The pandemic may also have the effect of heightening many of the other risks described in this “Risk Factors” section, including risks associated with our guidance, our customers, our potential customers, our market opportunity, renewals and sales cycle, among others.

We will continue to evaluate the nature and extent of the impact of the COVID-19 pandemic on our business.

Although we expect that current cash and cash equivalent balances, including the proceeds of our convertible senior notes offering in May 2020, together with cash flows that are generated from operations and availability under our new revolving credit facility, will be sufficient to meet our domestic and international working capital needs and other capital and liquidity requirements for at least the next 12 months, if our access to capital is restricted or our borrowing costs increase, our operations and financial condition could be adversely impacted.

The full extent of the COVID-19 pandemic’s impact on our operations and financial performance depends on future developments that are uncertain and unpredictable, including the ultimate duration, spread and reemergence of the pandemic, its impact on capital and financial markets, the timing of economic recovery and any new information that may emerge concerning the severity of the virus, its spread to or reemergence in other geographic regions as well as the actions taken to contain it, among others.

Any of these impacts could have a material adverse impact on our business, results of operations and financial condition and ability to execute and capitalize on our strategies.

Due to the current uncertainty regarding the severity and duration of the COVID-19 pandemic, we cannot predict whether our response to date or the actions we may take in the future will be effective in mitigating the effects of COVID-19 pandemic on our business, results of operations or financial condition.

Accordingly, we are unable at this time to predict the impact of the COVID-19 pandemic on our operations, liquidity, and financial results, and, depending on the magnitude and duration of the COVID-19 pandemic, such impact may be material.

Our quarterly operating results may vary from period to period, which could result in our failure to meet expectations with respect to operating results and cause the trading price of our stock to decline.

Our operating results, including the levels of our revenue, ARR, renewal rates, cash flow, deferred revenue and gross margins, have historically varied from period to period, and we expect that they will continue to do so as a result of a number of factors, many of which are outside of our control, including:

• quarantine, travel limitation, or business disruptions in regions affecting our operations, stemming from actual, imminent or perceived outbreak of contagious disease, including the COVID-19 pandemic;

• the level of demand for our products and professional services;

• customer renewal rates and ability to attract new customers;

• the extent to which customers purchase additional products or professional services;

• the mix of our products, as well as professional services, sold during a period;

• the ability to successfully grow our sales of our cloud-based solutions;

• the level of perceived threats to organizations’ cyber security;

• network outages, security breaches, technical difficulties or interruptions with our products;

• changes in the growth rate of the markets in which we compete;

• sales of our products and professional services due to seasonality and customer demand;

• the timing and success of new product or service introductions by us or our competitors or any other changes in the competitive landscape of our industry, including consolidation among our competitors;

• the introduction or adoption of new technologies that compete with our offerings;

• decisions by potential customers to purchase cyber security products or professional services from other vendors;

• the amount and timing of operating costs and capital expenditures related to the operations and expansion of our business;

• price competition;

• our ability to successfully manage and integrate any acquired businesses, including Divvy Cloud Corporation (DivvyCloud), and including without limitation the amount and timing of expenses and potential future charges for impairment of goodwill from acquired companies;

• our ability to increase, retain and incentivize the channel partners that market and sell our products and professional services;

• our continued international expansion and associated exposure to changes in foreign currency exchange rates, including any fluctuations caused by uncertainties relating to United Kingdom's exit from the European Union, commonly referred to as “Brexit”;

• the amount and timing of operating expenses related to the maintenance and expansion of our business, operations and infrastructure;

• the announcement or adoption of new regulations and policy mandates or changes to existing regulations and policy mandates;

• the cost or results of existing or unforeseen litigation and intellectual property infringement;

• the strength of regional, national and global economies;

• the impact of natural disasters or manmade problems such as terrorism or war;

• future accounting pronouncements or changes in our accounting policies.

Fluctuations in our quarterly operating results, key metrics, non-GAAP metrics and the price of our common stock may be particularly pronounced in the current economic environment due to the uncertainty caused by and the unprecedented nature of the current COVID-19 pandemic.

Each factor above or discussed elsewhere herein or the cumulative effect of some of these factors may result in fluctuations in our operating results.

This variability and unpredictability could result in our failure to meet expectations with respect to operating results, or those of securities analysts or investors, for a particular period.

If we fail to meet or exceed expectations for our operating results for these or any other reasons, the market price of our stock could fall and we could face costly lawsuits, including securities class action suits.

We are a rapidly growing company, which makes it difficult to evaluate our future operating and financial results and may increase the risk that we will not be successful.

13 unchanged sentences

• continue to successfully expand our business domestically and internationally;

• continue to effectively improve the productivity of our sales teams;

• continue to effectively grow and improve the productivity of our sales teams;

• successfully compete with other companies.

7 unchanged sentences

In particular, we expect to continue to expend financial and other resources on:

Tab l e of Contents

• research and development related to our offerings, including investments in our research and development team;

7 unchanged sentences

If our revenue growth does not meet our expectations in future periods, our financial performance may be harmed, and we may not achieve or maintain profitability in the future.

If our products or professional services fail to detect vulnerabilities or identify and respond to cyber security incidents, or if our products contain undetected errors or defects, our brand and reputation could be harmed, which could have an adverse effect on our business and results of operations.

If our products or professional services fail to detect vulnerabilities in our customers’ cyber security infrastructure, or if our products or professional services fail to identify and respond to new and increasingly complex methods of cyber attacks, our business and reputation may suffer.

There is no guarantee that our products or professional services will detect all vulnerabilities, especially in light of the rapidly changing security landscape to which we must respond.

Additionally, our products may falsely detect vulnerabilities or threats that do not actually exist.

For example, our Metasploit offering relies on information provided by an active community of security researchers who contribute new exploits, attacks and vulnerabilities.

If the information from these third parties is inaccurate, the potential for false indications of security vulnerabilities increases.

These false positives, while typical in the industry, may impair the perceived reliability of our offerings and may therefore adversely impact market acceptance of our products and professional services and could result in negative publicity, loss of customers and sales and increased costs to remedy any problem.

Our products may also contain undetected errors or defects.

Errors or defects may be more likely when a product is first introduced or as new versions are released, or when we introduce an acquired company's products.

We have experienced these errors or defects in the past in connection with new products, acquired products and product upgrades and we expect that these errors or defects will be found from time to time in the future in new, acquired or enhanced products after commercial release.

Defects may cause our products to be vulnerable to attacks, cause them to fail to detect vulnerabilities, or temporarily interrupt customers’ networking traffic.

Any errors, defects, disruptions in service or other performance problems with our products may damage our customers’ businesses and could hurt our reputation.

If our products or professional services fail to detect vulnerabilities for any reason, we may incur significant costs, the attention of our key personnel could be diverted, our customers may delay or withhold payment to us or elect not to renew or other significant customer relations problems may arise.

We may also be subject to liability claims for damages related to errors or defects in our products.

A material liability claim or other occurrence that harms our reputation or decreases market acceptance of our products may harm our business and operating results.

Many federal, state and foreign governments have enacted laws requiring companies to notify individuals of data security breaches involving their personal data.

These mandatory disclosures regarding a security breach often lead to widespread negative publicity, and any association of us with such publicity may cause our customers to lose confidence in the effectiveness of our data security solutions.

An actual or perceived security breach or theft of the sensitive data of one of our customers, regardless of whether the breach is attributable to the failure of our products or professional services, could adversely affect the market’s perception of our offerings and subject us to legal claims.

Our brand, reputation and ability to attract, retain and serve our customers are dependent in part upon the reliable performance of our products and network infrastructure.

We have experienced, and may in the future experience, disruptions, outages and other performance problems due to a variety of factors, including infrastructure changes, human or software errors, capacity

Tab l e of Contents

constraints and fraud or security attacks.

In some instances, we may not be able to identify the cause or causes of these performance problems within an acceptable period of time.

We utilize third-party data centers located in North America, in addition to operating and maintaining certain elements of our own network infrastructure.

We also utilize other cloud providers, such as Amazon Web Services, for our Insight Platform infrastructure.

Some elements of our complex infrastructure are operated by third parties that we do not control and that could require significant time to replace.

We expect this dependence on third parties to continue.

More specifically, certain of our products, in particular our cloud-based products, are hosted on cloud providers such as Amazon Web Services, which provides us with computing and storage capacity.

Interruptions in our systems or the third-party systems on which we rely, whether due to system failures, computer viruses, physical or electronic break-ins, or other factors, could affect the security or availability of our products, network infrastructure and website.

Prolonged delays or unforeseen difficulties in connection with adding capacity or upgrading our network architecture when required may cause our service quality to suffer.

Problems with the reliability or security of our systems could harm our reputation.

Damage to our reputation and the cost of remedying these problems could negatively affect our business, financial condition, and operating results.

Additionally, our existing data center facilities and third-party hosting providers have no obligations to renew their agreements with us on commercially reasonable terms or at all, and certain of the agreements governing these relationships may be terminated by either party at any time.

If we are unable to maintain or renew our agreements with these providers on commercially reasonable terms or if in the future we add additional data center facilities or third-party hosting providers, we may experience additional costs or downtime or delays as we transition our operations.

Any disruptions or other performance problems with our products could harm our reputation and business and may damage our customers’ businesses.

Interruptions in our service delivery might reduce our revenue, cause us to issue credits to customers, subject us to potential liability and cause customers to not renew their purchases or our products.

If we fail to manage our operations infrastructure, our customers may experience service outages and/or delays.

Our future growth is dependent upon our ability to continue to meet the expanding needs of our customers and to attract new customers.

As existing customers gain more experience with our products, they may broaden their reliance on our products, which will require that we expand our operations infrastructure.

We also seek to maintain excess capacity in our operations infrastructure to facilitate the rapid provision of new customer deployments.

In addition, we need to properly manage our technological operations infrastructure in order to support changes in hardware and software parameters and the evolution of our products, all of which require significant lead time.

If we do not accurately predict our infrastructure requirements, our existing customers may experience service outages that may subject us to financial penalties, financial liabilities and customer losses.

If our operations infrastructure fails to keep pace with increased sales, customers may experience delays as we seek to obtain additional capacity, which could adversely affect our reputation and our revenue.

Our business and operations are experiencing rapid growth, and if we do not appropriately manage our future growth, or are unable to scale our systems and processes, our operating results may be negatively affected.

We are a rapidly growing company.

To manage future growth effectively, we will need to continue to improve and expand our internal information technology systems, financial infrastructure, and operating and administrative systems and controls, which we may not be able to do efficiently, in a timely manner or at all.

Any future growth would add complexity to our organization and require effective coordination across our organization.

Failure to manage any future growth effectively could result in increased costs, harm our results of operations and lead to customers or investors losing confidence in our internal systems and processes, which could harm our results of operations and stock price.

Our business and growth depend substantially on customers renewing their subscriptions with us.

3 unchanged sentences

Our customers have no obligation to renew their subscriptions with us and we may not be able to accurately predict customer renewal rates.

Our customers’ renewal rates may decline or fluctuate as a result of a number of factors, including their satisfaction or dissatisfaction with our new or current product offerings, our pricing, the effects of economic conditions, competitive offerings, our customers' perception of their exposure, or alterations or reductions in their spending levels.

Our customers’ renewal rates may decline or fluctuate as a result of a number of factors, including their satisfaction or dissatisfaction with our new or current product offerings, our pricing, the effects of economic conditions, including due to the global economic uncertainty and financial market conditions caused by the COVID-19 pandemic, competitive offerings, our customers' perception of their exposure, or alterations or reductions in their spending levels.

If our customers do not renew their agreements with us or renew on terms less favorable to us, our revenues and results of operations may be adversely impacted.

Tab l e of Contents

Our future growth is also affected by our ability to sell additional offerings to our existing customers, which depends on a number of factors, including customers’ satisfaction with our products and services and general economic conditions.

If our efforts to cross-sell and upsell to our customers are unsuccessful, the rate at which our business grows might decline.

The market for S ec urity Operations is new and unproven and may not grow.

We believe our future success will depend in large part on the growth, if any, in the market for Security Operations (SecOps).

This market is nascent, and as such, it is difficult to predict important market trends, including the potential growth, if any.

To date, the majority of enterprise spend on cyber security has been on threat protection products, such as network, endpoint and web security that are designed to stop threats from penetrating corporate networks.

Organizations that use these security products may believe that their existing security solutions sufficiently protect access to their sensitive business data.

Therefore, they may continue allocating their cyber security budgets to these products and may not adopt our products and professional services in addition to, or in lieu of, such traditional products.

Further, sophisticated cyber attackers are skilled at adapting to new technologies and developing new methods of gaining access to organizations’ sensitive business data, and changes in the nature of advanced cyber threats could result in a shift in IT budgets away from products and professional services such as ours.

In addition, while recent high visibility attacks on prominent enterprises and governments have increased market awareness of the problem of cyber attacks, if cyber attacks were to decline, or enterprises or governments perceived that the general level of cyber attacks have declined, our ability to attract new customers and expand our sale to existing customers could be materially and adversely affected.

If products and professional services such as ours are not viewed by organizations as necessary, or if customers do not recognize the benefit of our offerings as a critical layer of an effective cyber security strategy, our revenue may not grow as quickly as expected, or may decline, and the trading price of our stock could suffer.

It is therefore difficult to predict how large the market will be for our solutions.

In addition, it is difficult to predict customer adoption and renewal rates, customer demand for our products and professional services, the size and growth rate of the market for SecOps, the entry of competitive products or the success of existing competitive products.

Any expansion in our market depends on a number of factors, including the cost, performance and perceived value associated with our offerings and those of our competitors.

If these offerings do not achieve widespread adoption or there is a reduction in demand for solutions in our market caused by a lack of customer acceptance, technological challenges, competing technologies and products, decreases in corporate spending, weakening economic conditions, or otherwise, it could result in reduced customer orders, early terminations, reduced renewal rates or decreased revenue, any of which would adversely affect our business operations and financial results.

You should consider our business and prospects in light of the risks and difficulties we face in this new and unproven market.

If our new and existing product offerings and product enhancements do not achieve sufficient market acceptance, our financial results and competitive position will suffer.

Our business substantially depends on, and we expect our business to continue to substantially depend on, sales of our Insight Platform solutions.

As such, market acceptance of our Insight Platform is critical to our continued success.

Demand for Insight Platform solutions are affected by a number of factors beyond our control, including continued market acceptance of cloud-based offerings, the timing of development and release of new products by our competitors, technological change, and growth or contraction in our market and the economy in general.

If we are unable to continue to meet customer demands or to achieve more widespread market acceptance of our Insight Platform solutions, our business operations, financial results and growth prospects will be materially and adversely affected .

We spend substantial amounts of time and money to research and develop or acquire new offerings and enhanced versions of our existing offerings to incorporate additional features, improve functionality or other enhancements in order to meet our customers’ rapidly evolving demands.

In addition, we continue to invest in solutions that can be deployed on top of our platform to target specific use cases and to cultivate our community.

When we develop a new or enhanced version of an existing offering, we typically incur expenses and expend resources upfront to market, promote and sell the new offering.

Therefore, when we develop or acquire new or enhanced offerings, their introduction must achieve high levels of market acceptance in order to justify the amount of our investment in developing and bringing them to market.

For example, if our recent product expansions and offerings, such as our Cloud Security offerings, do not garner widespread market adoption and implementation, our financial results and competitive position could suffer.

Further, we may make changes to our offerings that our customers do not like, find useful or agree with.

We may also discontinue certain features, begin to charge for certain features that are currently free or increase fees for any of our features or usage of our offerings.

Our new and existing offerings or product enhancements and changes to our existing offerings could fail to attain sufficient market acceptance for many reasons, including:

• our failure to predict market demand accurately in terms of product functionality and to supply offerings that meet this demand in a timely fashion, including changes in demand as a result of the COVID-19 pandemic;

• real or perceived defect, errors or failures;

• negative publicity about their performance or effectiveness;

• delays in releasing to the market our new offerings or enhancements to our existing offerings;

• introduction or anticipated introduction of competing products by our competitors;

• inability to scale and perform to meet customer demands;

• poor business conditions for our customers, causing them to delay IT purchases, including as a result of the COVID-19 pandemic;

• reluctance of customers to purchase cloud-based offerings.

If our new or existing offerings or enhancements and changes do not achieve adequate acceptance in the market, our competitive position will be impaired, and our revenue, business and financial results will be negatively impacted.

The adverse effect on our financial results may be particularly acute because of the significant research, development, marketing, sales and other expenses we will have incurred in connection with the new offerings or enhancements.

We face intense competition in our market.

3 unchanged sentences

Our primary competitors in Vulnerability Risk Management include Qualys and Tenable;

in Incident Detection and Response (SIEM) include Splunk, Micro Focus and LogRhythm;

in Incident Detection and Response (SIEM) include Splunk, Micro Focus, LogRhythm and Microsoft (Sentinel);

in Application Security include Micro Focus and IBM;

in Security Orchestration and Automation Response include Phantom (Splunk) and Demisto (Palo Alto Networks);

and finally, while the competition in our professional services business is diverse, our competitors include FireEye's Mandiant, SecureWorks and NCC Group.

in Cloud Security include Prisma (Palo Alto Networks) and CloudGuard (Check Point Software Technologies) and finally, while the competition in our professional services business is diverse, our competitors include FireEye's Mandiant, SecureWorks and NCC Group.

Some of our actual and potential competitors have advantages over us, such as longer operating histories, significantly greater financial, technical, marketing or other resources, stronger brand and business user recognition, larger and more mature intellectual property portfolios and broader global distribution and presence.

8 unchanged sentences

These larger competitors are also often in a better position to withstand any significant reduction in spending by customers, and will therefore not be as susceptible to economic downturns.

Tab l e of Contents

Furthermore, our current and potential competitors may establish cooperative relationships among themselves or with third parties that may further enhance their resources and product and services offerings in the markets we address.

3 unchanged sentences

If our competitors are more successful than we are in developing new product and service offerings or in attracting and retaining customers, our business, financial condition and results of operations could be adversely affected.

Our sales cycle may be unpredictable.

The timing of sales of our offerings is difficult to forecast because of the length and unpredictability of our sales cycle, particularly with large enterprises and with respect to certain of our products.

We sell our products primarily to IT departments that are managing a growing set of user and compliance demands, which has increased the complexity of customer requirements to be met and confirmed during the sales cycle and prolonged our sales cycle.

Further, the length of time that potential customers devote to their testing and evaluation, contract negotiation and budgeting processes varies significantly, depending on the size of the organization and nature of the product or service under consideration.

In addition, we might devote substantial time and effort to a particular unsuccessful sales effort, and as a result, we could lose other sales opportunities or incur expenses that are not offset by an increase in revenue, which could harm our business.

Our operating results, including the levels of our revenue, annualized recurring revenue, renewal rates, cash flow, deferred revenue and gross margins, have historically varied from period to period, and we expect that they will continue to do so as a result of a number of factors, many of which are outside of our control, including: