What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2022-02-24 compared with 2021-02-26 · 196 added, 220 removed, 544 unchanged (43% of the section changed)

9 unchanged sentences

Risks Related to Our Business and Industry

The ongoing COVID-19 pandemic could materially and adversely affect our business, results of operations and financial condition.

The COVID-19 pandemic has resulted in authorities implementing numerous measures to contain the virus, including travel bans and restrictions, quarantines, shelter-in-place orders, and business limitations and shutdowns.

We are unable to accurately predict the full impact that COVID-19 will have on our results from operations, financial condition, liquidity and cash flows due to numerous uncertainties, including the duration and severity of the pandemic and containment measures.

Our compliance with these measures has impacted our day-to-day operations and could disrupt our business and operations, as well as that of our customers, partners, suppliers and others with whom we work, for an indefinite period of time.

To support the health and well-being of our employees, customers, partners and communities, a vast majority of our employees began working remotely as of late March 2020, and they continue to do so.

In addition, many of our customers and prospective customers are working remotely.

The disruptions to our operations caused by the COVID-19 pandemic may result in inefficiencies, delays and additional costs in our sales and marketing, professional service and research and development efforts, which cannot be predicted or quantified at this time.

To the extent that disruptions occur, we may not be able to fully mitigate any such inefficiencies, delays and additional costs through remote or other alternative work arrangements.

In addition, given the economic uncertainty created by COVID-19, we have and may continue to see delays in our sales cycle, failures of customers to renew at all or to renew the anticipated scope their subscriptions with us, requests from customers for payment term deferrals as well as pricing or bundling concessions, which, if significant, could materially and adversely affect our business, results of operations and financial condition.

Although such events did not have a material adverse impact on our customer renewals for fiscal year 2020, our annualized recurring revenue (ARR) related to contracts in place at the end of the fiscal year 2020 was lower than initially anticipated at the beginning of fiscal year 2020 as a result of the pull back on customer spending, in light of the economic uncertainty caused by the COVID-19 pandemic.

Negative conditions in the general economy both in the United States and abroad, including conditions resulting from the COVID-19 pandemic, changes in gross domestic product growth, financial and credit market fluctuations, energy costs, international trade relations and other geopolitical issues, the availability and cost of credit and the global housing and mortgage markets could cause a decrease in consumer discretionary spending and business investment and diminish growth expectations in the U.S.

economy and abroad.

More generally, the COVID-19 pandemic raises the possibility of an extended global economic downturn and has caused volatility in financial markets, which could materially and adversely affect demand for our products and professional services and could materially and adversely impact our results and financial condition even after the pandemic is contained and the various pandemic-related orders are lifted.

For example, we may be unable to collect receivables from those customers significantly impacted by COVID-19, which may be more pronounced in industry verticals more directly impacted by the COVID-19 pandemic.

Also, a decrease in subscriptions and/or renewals in a given period could negatively affect our ARR as well as our revenues in future periods, particularly if experienced on a sustained basis, because a substantial proportion of our software subscriptions yield revenue recognized over time.

The pandemic may also have the effect of heightening many of the other risks described in this “Risk Factors” section, including risks associated with our guidance, our customers, our potential customers, our market opportunity, renewals and sales cycle, among others.

We will continue to evaluate the nature and extent of the impact of the COVID-19 pandemic on our business.

Although we expect that current cash and cash equivalent balances, including the proceeds of our convertible senior notes offering in May 2020, together with cash flows that are generated from operations and availability under our new revolving credit facility, will be sufficient to meet our domestic and international working capital needs and other capital and liquidity requirements for at least the next 12 months, if our access to capital is restricted or our borrowing costs increase, our operations and financial condition could be adversely impacted.

The full extent of the COVID-19 pandemic’s impact on our operations and financial performance depends on future developments that are uncertain and unpredictable, including the ultimate duration, spread and reemergence of the pandemic, its impact on capital and financial markets, the timing of economic recovery and any new information that may emerge concerning the severity of the virus, its spread to or reemergence in other geographic regions as well as the actions taken to contain it, among others.

Any of these impacts could have a material adverse impact on our business, results of operations and financial condition and ability to execute and capitalize on our strategies.

Due to the current uncertainty regarding the severity and duration of the COVID-19 pandemic, we cannot predict whether our response to date or the actions we may take in the future will be effective in mitigating the effects of COVID-19 pandemic on our business, results of operations or financial condition.

Accordingly, we are unable at this time to predict the impact of the COVID-19 pandemic on our operations, liquidity, and financial results, and, depending on the magnitude and duration of the COVID-19 pandemic, such impact may be material.

Our quarterly operating results may vary from period to period, which could result in our failure to meet expectations with respect to operating results and cause the trading price of our stock to decline.

Our operating results, including the levels of our revenue, ARR, renewal rates, cash flow, deferred revenue and gross margins, have historically varied from period to period, and we expect that they will continue to do so as a result of a number of factors, many of which are outside of our control, including:

• quarantine, travel limitation, or business disruptions in regions affecting our operations, stemming from actual, imminent or perceived outbreak of contagious disease, including the COVID-19 pandemic;

Our operating results, including the levels of our revenue, ARR, cash flow, deferred revenue and gross margins, have historically varied from period to period, and we expect that they will continue to do so as a result of a number of factors, many of which are outside of our control, including:

• business disruptions in regions affecting our operations, stemming from actual, imminent or perceived outbreak or reemergence of contagious disease, including the COVID-19 pandemic;

• the level of demand for our products and professional services;

3 unchanged sentences

• the ability to successfully grow our sales of our cloud-based solutions;

• the level of perceived threats to organizations’ cyber security;

• the level of perceived threats to organizations’ cybersecurity;

• network outages, security breaches, technical difficulties or interruptions with our products;

3 unchanged sentences

• the introduction or adoption of new technologies that compete with our offerings;

• decisions by potential customers to purchase cyber security products or professional services from other vendors;

• decisions by potential customers to purchase cybersecurity products or professional services from other vendors;

• the amount and timing of operating costs and capital expenditures related to the operations and expansion of our business;

• price competition;

• our ability to successfully manage and integrate any acquired businesses, including Divvy Cloud Corporation (DivvyCloud), and including without limitation the amount and timing of expenses and potential future charges for impairment of goodwill from acquired companies;

• our ability to successfully manage and integrate any acquired businesses, including, IntSights Cyber Intelligence Ltd.

(IntSights), and including without limitation the amount and timing of expenses and potential future charges for impairment of goodwill from acquired companies;

• our ability to increase, retain and incentivize the channel partners that market and sell our products and professional services;

• our continued international expansion and associated exposure to changes in foreign currency exchange rates, including any fluctuations caused by uncertainties relating to United Kingdom's exit from the European Union, commonly referred to as “Brexit”;

• our continued international expansion and associated exposure to changes in foreign currency exchange rates;

• the amount and timing of operating expenses related to the maintenance and expansion of our business, operations and infrastructure;

• the announcement or adoption of new regulations and policy mandates or changes to existing regulations and policy mandates;

• the announcement or adoption of new regulations and policy mandates or changes to existing regulations and policy mandates that impact our business;

• the cost or results of existing or unforeseen litigation and intellectual property infringement;

• the strength of regional, national and global economies;

• the impact of natural disasters or manmade problems such as terrorism or war;

• future accounting pronouncements or changes in our accounting policies.

• the impact of climate change, natural disasters or manmade problems such as terrorism or war;

• future accounting pronouncements or changes in our accounting policies or practices.

Fluctuations in our quarterly operating results, key metrics, non-GAAP metrics and the price of our common stock may be particularly pronounced in the current economic environment due to the uncertainty caused by and the unprecedented nature of the current COVID-19 pandemic.

7 unchanged sentences

If our assumptions regarding these uncertainties, which we use to plan our business, are incorrect or change in reaction to changes in our markets, or if we do not address these risks successfully, our operating and financial results could differ materially from our expectations, our business could suffer and the trading price of our common stock may decline.

If we are unable to sustain our revenue growth rate, we may not achieve or maintain profitability in the future.

From the year ended December 31, 2016 to the year ended December 31, 2020, our revenue grew from $157.4 million to $411.5 million.

Although we have experienced rapid growth historically and currently have high renewal rates, we may not continue to grow as rapidly in the future and our renewal rates may decline.

Any success that we may experience in the future will depend, in large part, on our ability to, among other things:

If we do not effectively manage our future growth, our business and results of operations will be adversely affected.

From the year ended December 31, 2017 to the year ended December 31, 2021, our revenue grew from $200.9 million to $535.4 million and our headcount grew from 1,079 to 2,353 employees.

Although we have experienced rapid growth historically, we may not sustain our current growth rates and our investments to support our growth may not be successful.

The growth and expansion of our business will require us to invest significant financial and operational resources and will continue to place significant demands on our management team.

Our future success will depend in part on our ability to manage our growth effectively, which will require us to, among other things:

• maintain and expand our customer base;

4 unchanged sentences

• continue to successfully expand our business domestically and internationally;

• continue to effectively grow and improve the productivity of our sales teams;

• continue to improve our key business applications, processes and IT infrastructure to support our business needs and appropriately documenting such systems and processes;

• continue to effectively attract, integrate and retain a large number of new employees, particularly members of our sales and marketing and research and development teams;

• enhance our information and communication systems to ensure that our employees and offices around the world are well coordinated and can effectively communicate with each other and our growing base of customers and partners;

• improve our financial, management, and compliance systems and controls;

• successfully compete with other companies.

If we are unable to maintain consistent revenue or revenue growth, our stock price could be volatile, and it may be difficult to achieve and maintain profitability.

You should not rely on our revenue for any prior quarterly or annual periods as any indication of our future revenue or revenue growth.

If we fail to achieve these objectives effectively, our ability to manage our expected growth may be impaired and we may be unable to maintain the quality of our offerings, consistent revenue or revenue growth, our stock price could be volatile, and it may be difficult to achieve and maintain profitability.

You should not rely on our prior quarterly or annual periods performance as any indication of our future growth.

We have not been profitable historically and may not achieve or maintain profitability in the future.

13 unchanged sentences

If our revenue growth does not meet our expectations in future periods, our financial performance may be harmed, and we may not achieve or maintain profitability in the future.

The ongoing COVID-19 pandemic could materially and adversely affect our business, results of operations and financial condition, and we could be subject to risks from further health pandemics or epidemics, as well as uncertainty regarding returning to work and re-openings.

Our business could be adversely affected by the effects of health pandemics or epidemics, including the ongoing COVID-19 pandemic, which continues to have a negative impact on the local, regional, national and global scale.

We are unable to accurately predict the full impact that the COVID-19 pandemic will have on our results from operations, financial condition, liquidity and cash flows due to numerous uncertainties, including the duration and severity of the pandemic, the emergence of any new variants, the results of vaccination efforts, vaccine mandate requirements, and containment measures.

The implementation of measures to help contain the virus has impacted our day-to-day operations and could disrupt our business and operations, as well as that of our customers, partners, suppliers and others with whom we work, for an indefinite period of time.

To support the health and well-being of our employees, customers, partners and communities, a vast majority of our employees began working remotely as of late March 2020, but we have begun to selectively reopen certain offices in a phased approach and to hold in-person or hybrid meetings, on a voluntary basis, taking into consideration government restrictions and employee safety.

In addition, many of our customers and prospective customers are working remotely.

The disruptions to our operations caused by the COVID-19 pandemic may negatively impact employee retention and result in inefficiencies, delays and additional costs in our sales and marketing, professional service and research and development efforts, which cannot be predicted or quantified at this time.

To the extent that disruptions occur, we may not be able to fully mitigate any such inefficiencies, delays and additional costs through remote or other alternative work arrangements.

Negative conditions in the general economy both in the United States and abroad resulting from health pandemics or epidemics, such as the COVID-19 pandemic, could cause a decrease in consumer discretionary spending and business investment and diminish growth expectations in the U.S.

economy and abroad.

More generally, the COVID-19 pandemic continues to present the possibility of an extended global economic downturn and has caused volatility in financial markets, which could materially and adversely affect demand for our products and professional services and could materially and adversely impact our results and financial condition even after the pandemic is contained.

The pandemic may also have the effect of heightening many of the other risks described in this “Risk Factors” section, including risks associated with our guidance, our customers, our

potential customers, our market opportunity, renewals and sales cycle, among others.

We will continue to evaluate the nature and extent of the impact of the COVID-19 pandemic on our business.

Although we expect that current cash and cash equivalent balances, including the proceeds of our convertible senior notes offering in March 2021, together with cash flows that are generated from operations and availability under our revolving credit facility, will be sufficient to meet our domestic and international working capital needs and other capital and liquidity requirements for at least the next 12 months, if our access to capital is restricted or our borrowing costs increase, our operations and financial condition could be adversely impacted.

The full extent of the COVID-19 pandemic’s impact on our operations and financial performance depends on future developments that are uncertain and unpredictable, including the ultimate duration, spread and reemergence of the pandemic, including any new variants, its impact on capital and financial markets, the timing of economic recovery and any new information that may emerge concerning the severity of the virus, its spread to or reemergence in other geographic regions as well as the actions taken to contain it, including the distribution and acceptance of vaccines, among others.

Any of these impacts could have a material adverse impact on our business, results of operations and financial condition and ability to execute and capitalize on our strategies.

Our business and growth depend substantially on customers renewing their subscriptions with us.

16 unchanged sentences

Therefore, when we develop or acquire new or enhanced offerings, their introduction must achieve high levels of market acceptance in order to justify the amount of our investment in developing and bringing them to market.

For example, if our recent product expansions and offerings, such as our Cloud Security offerings, do not garner widespread market adoption and implementation, our financial results and competitive position could suffer.

For example, if our recent product expansions and offerings, such as our Cloud Security and Threat Intelligence offerings, do not garner widespread market adoption and implementation, our financial results and competitive position could suffer.

Further, we may make changes to our offerings that our customers do not like, find useful or agree with.

16 unchanged sentences

Our primary competitors in Vulnerability Risk Management include Qualys and Tenable;

in Incident Detection and Response (SIEM) include Splunk, Micro Focus, LogRhythm and Microsoft (Sentinel);

in Incident Detection and Response include Splunk, Micro Focus, LogRhythm and Microsoft (Sentinel);

in Application Security include Micro Focus and IBM;

in Security Orchestration and Automation Response include Phantom (Splunk) and Demisto (Palo Alto Networks);

in Cloud Security include Prisma (Palo Alto Networks) and CloudGuard (Check Point Software Technologies) and finally, while the competition in our professional services business is diverse, our competitors include FireEye's Mandiant, SecureWorks and NCC Group.

in Security Orchestration and Automation Response include Splunk and Palo Alto Networks;

in Cloud Security include Palo Alto Networks and Check Point Software Technologies;

in Threat Intelligence include Recorded Future and Digital Shadows and finally, while the competition in our professional services business is diverse, our competitors include Mandiant, SecureWorks and NCC Group.

Some of our actual and potential competitors have advantages over us, such as longer operating histories, significantly greater financial, technical, marketing or other resources, stronger brand and business user recognition, larger and more mature intellectual property portfolios and broader global distribution and presence.

13 unchanged sentences

If our competitors are more successful than we are in developing new product and service offerings or in attracting and retaining customers, our business, financial condition and results of operations could be adversely affected.

If we fail to manage our operations infrastructure, our customers may experience service outages and/or delays.

If we are unable to successfully hire, train, and retain qualified personnel our business may suffer.

We continue to be substantially dependent on our sales force to obtain new customers and increase sales with existing customers.

Our ability to successfully pursue our growth strategy will also depend on our ability to attract, motivate and retain our personnel, especially those in sales, marketing and research and development.

In addition, in recent years, recruiting, hiring and retaining employees with expertise in the cybersecurity industry has become increasingly difficult as the demand for cybersecurity professionals has increased as a result of the recent cybersecurity attacks on global corporations and governments.

We face intense competition for these employees from numerous technology, software and other companies, especially in certain geographic areas in which we operate, and we cannot ensure that we will be able to attract, motivate and/or retain sufficient qualified employees in the future particularly in tight labor markets.

If we are unable to attract new employees and retain our current employees, we may not be able to adequately develop and maintain new products or professional services or market our existing products or professional services at the same levels as our competitors and we may, therefore, lose customers and market share.

Our failure to attract and retain personnel, especially those in sales and marketing and research and development positions for which we have historically had a high turnover rate, could have an adverse effect on our ability to execute our business objectives and, as a result, our ability to compete could decrease, our operating results could suffer and our revenue could decrease.

Even if we are able to identify and recruit a sufficient number of new hires, these new hires will require significant training before they achieve full productivity and they may not become productive as quickly as we would like or at all.

We believe that our corporate culture has been a critical component to our success.

We have invested substantial time and resources in building our team.

As we grow and mature as a public company, we may find it difficult to maintain our corporate culture.

Any failure to preserve our culture could negatively affect our future success, including our ability to attract, motivate and retain personnel and effectively focus on and pursue our business strategy.

Our sales cycle may be unpredictable.

The timing of sales of our offerings is difficult to forecast because of the length and unpredictability of our sales cycle, particularly with large enterprises and with respect to certain of our products.

We sell our products primarily to IT departments that are managing a growing set of user and compliance demands, which has increased the complexity of customer requirements to be met and confirmed during the sales cycle and prolonged our sales cycle.

Further, the length of time that potential customers devote to their testing and evaluation, contract negotiation and budgeting processes varies significantly, depending on the size of the organization and nature of the product or service under consideration.

In addition, we might devote substantial time and effort to a particular unsuccessful sales effort, and as a result, we could lose other sales opportunities or incur expenses that are not offset by an increase in revenue, which could harm our business.

If we fail to continue to effectively scale and manage our operations infrastructure, our customers may experience service outages and/or delays.

Our future growth is dependent upon our ability to continue to meet the expanding needs of our customers and to attract new customers.

4 unchanged sentences

If our operations infrastructure fails to keep pace with increased sales, customers may experience delays as we seek to obtain additional capacity, which could adversely affect our reputation and our revenue.

To date, we have derived a majority of our revenue from customers using our vulnerability management offerings.

To date, we have derived a significant amount of our revenue from customers using our vulnerability management offerings.

If we are unable to renew or increase sales of our vulnerability management offerings, or if we are unable to increase sales of our other offerings, our business and operating results could be adversely affected.

Although we continue to introduce and acquire new products and professional services, we derive and expect to continue to derive a majority of our revenue from customers using certain of our vulnerability management offerings (VM), InsightVM, Nexpose and Metasploit.

Greater than half of our revenue was attributable to InsightVM, Nexpose and Metasploit in each of our last three fiscal years.

Although we continue to introduce and acquire new products and professional services, we derive and expect to continue to derive a significant amount of our revenue from customers using certain of our vulnerability management offerings (VM), InsightVM, Nexpose and Metasploit.

Approximately half of our revenue was attributable to InsightVM, Nexpose and Metasploit for the year ended December 31, 2021.

As a result, our operating results could suffer due to:

7 unchanged sentences

Our inability to renew or increase sales of our vulnerability management offerings, including cloud-based subscriptions, content subscriptions, managed services and content and maintenance and support subscriptions, or a decline in prices of our vulnerability management offerings would harm our business and operating results more seriously than if we derived significant revenues from a variety of offerings.

In addition, we have introduced several non-VM subscription products, including InsightIDR, InsightAppSec, InsightConnect and DivvyCloud.

These products are relatively new, and it is uncertain whether they will gain the market acceptance we expect.

In addition, while we have introduced several non-VM subscription products, including InsightAppSec, InsightConnect, InsightCloudSec and Threat Intelligence, these products are relatively new, and it is uncertain whether they will gain the market acceptance we expect.

Any factor adversely affecting sales of our non-VM products or professional services, including release cycles, market acceptance, competition, performance and reliability, reputation and economic and market conditions, could adversely affect our business and operating results.

If we are unable to successfully hire, train, manage and retain qualified personnel, especially those in sales and marketing and research and development, our business may suffer.

We continue to be substantially dependent on our sales force to obtain new customers and increase sales with existing customers.

We believe that our corporate culture has been a critical component to our success.

We have invested substantial time and resources in building our team.

As we grow and mature as a public company, we may find it difficult to maintain our corporate culture.

A component of our growth strategy is dependent on our continued international expansion, which adds complexity to our operations.

We market and sell our products and professional services throughout the world and have personnel in many parts of the world.

For the years months ended December 31, 2020, 2019 and 2018, operations located outside of North America generated 17%, 16% and 15%, respectively, of our revenue.

For the years ended December 31, 2021, 2020 and 2019, operations located outside of North America generated 19%, 17% and 16%, respectively, of our revenue.

Our growth strategy is dependent, in part, on our continued international expansion.

We expect to conduct a significant amount of our business with organizations that are located outside the United States, particularly in Europe and Asia.

We cannot assure you that our expansion efforts into international markets will be successful in creating further demand for our products and professional services or in effectively selling our products and professional

services in the international markets that we enter.

Our current international operations and future initiatives will involve a variety of risks, including:

2 unchanged sentences

• trade and foreign exchange restrictions;

• economic or political instability or uncertainty in foreign markets and around the world, such as related to Brexit;

• economic or political instability or uncertainty in foreign markets and around the world;

• foreign currency exchange rate fluctuations;

11 unchanged sentences

• costs associated with language localization of our products;

• increased exposure to natural disasters, acts of war, terrorism, epidemics, or pandemics and other health crises, including the ongoing COVID-19 pandemic;

• increased exposure to climate change, natural disasters, acts of war, terrorism, epidemics, or pandemics and other health crises, including the ongoing COVID-19 pandemic;

• costs of compliance with multiple and possibly overlapping tax structures.

6 unchanged sentences

If we are unable to successfully manage the challenges of international expansion and operations, our business and operating results could be adversely affected.

We are also monitoring developments related to Brexit.

Brexit could lead to economic and legal uncertainty, including significant volatility in global stock markets and currency exchange rates, and differing laws and regulations as the United Kingdom determines which European Union laws to replace or replicate.

In particular, although the United Kingdom enacted a Data Protection Act in May 2018 that is consistent with the EU General Data Protection Regulation, uncertainty remains regarding how data transfers to the United Kingdom will be regulated.

Any of these effects of Brexit, among others, could adversely affect our operations in the United Kingdom and our financial results.

We recognize a significant percentage of our revenue ratably over the term of our agreements with customers, and as a result, downturns or upturns in sales may not be immediately reflected in our operating results.

We recognize a significant percentage of our revenue ratably over the various terms of our agreements with customers.

result, a substantial portion of the revenue that we report in each period will be derived from the recognition of deferred revenue relating to agreements entered into during previous periods.

As a result, a substantial portion of the revenue that we report in each period will be derived from the recognition of deferred revenue relating to agreements entered into during previous periods.

Consequently, a decline in new sales or renewals in any one period may not be immediately reflected in our revenue results for that period.

12 unchanged sentences

Any failure by our customers to appropriately implement our products or any failure of our products to effectively integrate and operate within our customers’ IT infrastructures could result in customer dissatisfaction, impact the perceived reliability of our products, result in negative press coverage, negatively affect our reputation and harm our financial results.

Acquisitions could disrupt our business and harm our financial condition and operating results.

Our success in acquiring and integrating other businesses, products or technologies could impact our financial position.

In order to remain competitive, we have in the past and may in the future seek to acquire additional businesses, products or technologies.

1 unchanged sentence

Achieving the anticipated benefits of past or future acquisitions will depend in part upon whether we can integrate acquired operations, products and technology in a timely and cost-effective manner and successfully market and sell these as new product offerings, or as new features within our existing offerings.

For example, on May 1, 2020 we acquired Divvy Cloud Corporation (DivvyCloud), a cloud security posture management platform, and on January 28, 2021 we acquired Alcide.IO Ltd.

(Alcide), a Kubernetes cloud workload protection platform.

Some of our acquisitions could improve the capabilities of our existing offerings or platform, as opposed to becoming a new offering.

The acquisitions of DivvyCloud and Alcide are intended to extend the cloud security capabilities of our Insight Platform, helping security and DevOps teams understand and manage governance, risk and security in their growing cloud environments, which may encounter difficulties or unforeseen expenditures.

The integration of Alcide and any other acquisition may prove to be difficult due to the necessity of coordinating geographically separate organizations and integrating personnel with disparate business backgrounds and accustomed to different corporate cultures and business operations and internal systems.

We may need to implement or improve controls, procedures, and policies at a business that prior to the acquisition may have lacked sufficiently effective controls, procedures and policies.

For example, on July 16, 2021, we acquired IntSights, a provider of contextualized external threat intelligence and proactive threat remediation which were intended to extend the cloud security capabilities of our Insight Platform.

The integration of IntSights and any other acquisition may prove to be difficult due to the necessity of coordinating geographically separate organizations and integrating personnel with disparate business backgrounds and accustomed to different corporate cultures and business operations and internal systems.

We may need to implement or improve controls, procedures, and policies at a business that prior to the acquisition may have lacked sufficiently

effective controls, procedures and policies.

The acquisition and integration processes are complex, expensive and time consuming, and may cause an interruption of, or loss of momentum in, product development, sales activities and operations of both companies.

16 unchanged sentences

There are no comparable recent events that provide guidance as to the probable effect of the COVID-19 pandemic, and, as a result, the ultimate impact of the COVID-19 outbreak is highly uncertain and subject to change.

We are relying on the reports and models of economic and medical experts in making assumptions relating to the duration of this crisis and predictions as to timing and pace of any future economic recovery.

If these models are incorrect or incomplete, or if we fail to accurately predict the full impact that the COVID-19 pandemic will have on all aspects of our business, the guidance and other forward-looking statements provided may also be incorrect or incomplete.

If we fail to accurately predict the full impact that the COVID-19 pandemic will have on all aspects of our business, the guidance and other forward-looking statements provided may also be incorrect or incomplete.

Furthermore, if we make downward revisions of our previously announced guidance, or if our publicly announced guidance of future operating results fails to meet expectations of securities analysts, investors or other interested parties, the price of our common stock would decline.

36 unchanged sentences

In addition, any errors or defects in or failures of this third-party software could result in errors or defects in our products or cause our products to fail, which could harm our business and be costly to correct.

Many of these providers attempt to impose limitations on their liability for such errors, defects or failures, and if enforceable, we may have additional liability to our customers or third-party providers that could harm our reputation and increase our operating costs.

Many of these providers attempt to impose limitations on their liability for such errors, defects or failures, and if enforceable, we may have additional liability to

our customers or third-party providers that could harm our reputation and increase our operating costs.

We will need to maintain our relationships with third-party software and data providers, and to obtain software and data from such providers that do not contain errors or defects.

Any failure to do so could adversely impact our ability to deliver effective solutions to our customers and could harm our operating results.

Our products contain third-party open source software components, and our failure to comply with the terms of the underlying open source software licenses could restrict our ability to sell our products.

Our products contain software licensed to us by third parties under so-called “open source” licenses, including the GNU General Public License, the GNU Lesser General Public License, the BSD License, the Apache License and others.

From time to time, there have been claims against companies that distribute or use open source software in their products and services, asserting that such open source software infringes the claimants’ intellectual property rights.

We could be subject to suits by

parties claiming that what we believe to be licensed open source software infringes their intellectual property rights.

Use and distribution of open source software may entail greater risks than use of third-party commercial software, as open source licensors generally do not provide warranties or other contractual protections regarding infringement claims or the quality of the code.

In addition, certain open source licenses require that source code for software programs that are subject to the license be made available to the public and that any modifications or derivative works to such open source software continue to be licensed under the same terms.

Although we monitor our use of open source software in an effort both to comply with the terms of the applicable open source licenses and to avoid subjecting our products to conditions we do not intend, the terms of many open source licenses have not been interpreted by U.S.

courts, and there is a risk that these licenses could be construed in a way that could impose unanticipated conditions or restrictions on our ability to commercialize our products.

The terms of certain open source licenses require us to release the source code of our applications and to make our applications available under those open source licenses if we combine or distribute our applications with open source software in a certain manner.

In the event that portions of our applications are determined to be subject to an open source license, we could be required to publicly release the affected portions of our source code, re-engineer all, or a portion of, those applications or otherwise be limited in the licensing of our applications.

Disclosing our proprietary source code could allow our competitors to create similar products with lower development effort and time and ultimately, could result in a loss of sales for us.

Disclosing the source code of our proprietary software could also make it easier for cyber attackers and other third parties to discover vulnerabilities in or to defeat the protections of our products, which could result in our products failing to provide our customers with the security they expect.

Any of these events could have a material adverse effect on our business, operating results and financial condition.

Our technology alliance partnerships expose us to a range of business risks and uncertainties that could have a material adverse impact on our business and financial results.

12 unchanged sentences

Governments and industry organizations, such as the PCI Council, may also adopt new laws, regulations or requirements, or make changes to existing laws or regulations, that could impact the demand for, or value of, our products.

If we are unable to adapt our products to changing legal and regulatory standards or other requirements in a timely manner, or if our products fail to assist with, or expedite, our customers’ cyber security defense and compliance efforts, our customers may lose confidence in our products and could switch to products offered by our competitors or threaten or bring legal actions against us.

If we are unable to adapt our products to changing legal and regulatory standards or other requirements in a timely manner, or if our products fail to assist with, or expedite, our customers’ cybersecurity defense and compliance efforts, our customers may lose confidence in our products and could switch to products offered by our competitors or threaten or bring legal actions against us.

In addition, if laws, regulations or standards related to data security, vulnerability management and other IT security and compliance requirements are relaxed or the penalties for non-compliance are changed in a manner that makes them less onerous, our customers may view government and industry regulatory compliance as less critical to their businesses, and our customers may be less willing to purchase our products.

5 unchanged sentences

Government demand and payment for our products and professional services may also be impacted by public sector budgetary cycles and funding authorizations, with funding reductions or delays adversely affecting public sector demand for our offerings.

Government entities also have heightened sensitivity surrounding the purchase of cyber security solutions due to the critical importance of their IT infrastructures, the nature of the information contained within those infrastructures and the fact that they are highly-visible targets for cyber attacks.

Government entities also have heightened sensitivity surrounding the purchase of cybersecurity solutions due to the critical importance of their IT infrastructures, the nature of the information contained within those infrastructures and the fact that they are highly-visible targets for cyber attacks.

Accordingly, increasing sales of our products and professional services to government entities may be more challenging than selling to commercial organizations.

Further, in the course of providing our products and professional services to government entities, our employees and those of our channel partners may be exposed to sensitive government information.

Any failure by us or our channel partners to safeguard and maintain the confidentiality of such information could subject us to liability and reputational harm, which could materially and adversely affect our results of operations and financial performance.

Any failure by

us or our channel partners to safeguard and maintain the confidentiality of such information could subject us to liability and reputational harm, which could materially and adversely affect our results of operations and financial performance.

We are exposed to fluctuations in currency exchange rates, which could negatively affect our financial condition and results of operations.

8 unchanged sentences

dollar could increase the cost in local currency of our products and services to customers outside the United States, which could adversely affect our business, results of operations, financial condition and cash flows.

W e implemented a hedging program during the third quarter of 2020 and have entered into forward contracts designated as cash flow hedges in order to mitigate our exposure to foreign currency fluctuations resulting from certain operating expenses denominated in certain foreign currencies.

W e implemented a hedging program during 2020 and have entered into forward contracts designated as cash flow hedges in order to mitigate our exposure to foreign currency fluctuations resulting from certain operating expenses denominated in certain foreign currencies.

These forward contracts and other hedging strategies such as options and foreign exchange swaps related to transaction exposures that we may implement to mitigate this risk in the future may not eliminate our exposure to foreign exchange fluctuations.

Changes in financial accounting standards may adversely impact our reported results of operations.

A change in accounting standards or practices could adversely affect our operating results and may even affect our reporting of transactions completed before the change is effective.

New accounting pronouncements and varying interpretations of accounting pronouncements have occurred and may occur in the future.

Changes to existing rules or the questioning of current practices may adversely affect our operating results.

We may require additional capital to support business growth, and this capital might not be available on acceptable terms, if at all.

We intend to continue to make investments to support our business growth and may require additional funds to respond to business challenges, including the need to develop new features or enhance our products, improve our operating infrastructure or acquire complementary businesses and technologies.

Accordingly, we may need to engage in equity or debt financings to secure additional funds.

If we raise additional funds through future issuances of equity or convertible debt securities, our existing stockholders could suffer significant dilution, and any new equity securities we issue could have rights, preferences and privileges superior to those of holders of our common stock.

Any debt financing that we may secure in the future could involve restrictive covenants relating to our capital raising activities and other financial and operational matters, which may make it more difficult for us to obtain additional capital and to pursue business opportunities, including potential acquisitions.

We may not be able to obtain additional financing on terms favorable to us, if at all.

For example, while the potential impact and duration of the COVID-19 pandemic on the global economy and our business in particular may be difficult to assess or predict, the pandemic has resulted in, and may continue to result in significant disruption of global financial markets, reducing our ability to access capital, which could in the future negatively affect our liquidity.

Although we expect that current cash and cash equivalent balances, including the proceeds from the issuance our 2.25% convertible senior notes due 2025 (2025 Notes) and cash flows that are generated from operations will be sufficient to meet our domestic and international working capital needs and other capital and liquidity requirements for at least the next 12 months, if we are unable to obtain adequate financing or

financing on terms satisfactory to us if and when we require it, our ability to continue to support our business growth and to respond to business challenges could be significantly impaired, and our business may be adversely affected.

Risks Related to Intellectual Property, Litigation and Government Regulation

19 unchanged sentences

Such litigation could result in substantial costs and diversion of resources and could result in impairment or loss of portions of our intellectual property.

Furthermore, our efforts to enforce our intellectual property rights may be met with defenses, counterclaims and countersuits attacking the validity and enforceability of our intellectual property rights.

Furthermore, our efforts to enforce our intellectual property rights may be met with defenses, counterclaims and countersuits attacking the validity and enforceability of our intellectual property

Our failure to secure, protect and enforce our intellectual property rights could negatively affect our brand and adversely impact our business, operating results and financial condition.

7 unchanged sentences

As the numbers of products and competitors in our market increase and overlaps occur, claims of infringement, misappropriation and other violations of intellectual property rights may increase.

Any claim of infringement, misappropriation or other violation of intellectual property rights by a third party, even those without merit, could cause us to incur substantial costs defending against the claim and could

distract our management from our business.

The patent portfolios of our most significant competitors are larger than ours.

11 unchanged sentences

Any of the foregoing events could seriously harm our business, financial condition and results of operations.

We could be subject to suits by parties claiming that what we believe to be licensed open source software infringes their intellectual property rights.

been interpreted by U.S.

courts, and there is a risk that these licenses could be construed in a way that could impose unanticipated conditions or restrictions on our ability to commercialize our products.

Disclosing our proprietary source code could allow our competitors to create similar products with lower development effort and time and ultimately, could result in a loss of sales for us.

Likewise, some open source projects have known security and other vulnerabilities and architecture instabilities, or are otherwise subject to security attacks due to their wide availability, and are provided on an “as-is” basis.

Any of these events could have a material adverse effect on our business, operating results and financial condition.

We are subject to governmental export and import controls that could impair our ability to compete in international markets and/or subject us to liability if we are not in compliance with applicable laws.

4 unchanged sentences

Exports of these products must be made in compliance with these laws and regulations.

Although we take precautions to prevent our products from being provided in violation of these laws, our products could be provided inadvertently in violation of such laws, despite the precautions we take.

Compliance with these laws and regulations is complex, and if we were to fail to comply with these laws and regulations, we and certain of our employees could be subject to substantial civil and criminal penalties, including fines for our company and responsible employees or managers, and, in extreme cases, incarceration of responsible employees and managers and the possible loss of export privileges.

7 unchanged sentences

Compliance with applicable laws and regulations regarding the export and import of our products, including with respect to new products or changes in existing products, may create delays in the introduction of our products in international markets, prevent our customers with international operations from deploying our products globally or, in some cases, could prevent the export or import of our products to certain countries, governments, entities or persons altogether.

Further, U.S.

export control laws and economic sanctions prohibit the shipment of certain products and services to U.S.

embargoed or sanctioned countries, governments or persons.

Although we take precautions to prevent our products from being provided to those subject to U.S.

sanctions, such measures may be circumvented and we have in the past identified limited instances of non-compliance with these rules.

After these instances were disclosed to U.S.

authorities, those authorities decided

to not bring enforcement actions against or impose penalties on us.

Our ability to use net operating losses to offset future taxable income may be subject to certain limitations.

3 unchanged sentences

Section 382 of the Internal Revenue Code imposes limitations on a company’s ability to use NOLs if a company experiences a more-than-50-percentage point ownership change over a three-year testing period.

Based upon our analysis as of December 31, 2019, we determined that although a limitation on our historical NOLs exists, we do not expect this limitation to impair our ability to use our NOLs prior to expiration.

Base d upon our historical analysis, we determined that although a limitation on our historical NOLs exists, we do not expect this limitation to impair our ability to use our NOLs prior to expiration.

However, if changes in our ownership occur in the future, our ability to use our NOLs may be further limited.

14 unchanged sentences

Real or perceived failures, errors or defects in our solutions could adversely affect our brand and reputation, which could have an adverse effect on our business and results of operations.

If our products or professional services fail to detect vulnerabilities in our customers’ cyber security infrastructure, or if our products or professional services fail to identify and respond to new and increasingly complex methods of cyber attacks, our business and reputation may suffer.

If our products or professional services fail to detect vulnerabilities in our customers’ cybersecurity infrastructure, or if our products or professional services fail to identify and respond to new and increasingly complex methods of cyber attacks, our business and reputation may suffer.

There is no guarantee that our products or professional services will detect all vulnerabilities and threats, especially in light of the rapidly changing security landscape to which we must respond, including the constantly evolving techniques used by attackers to access or sabotage data.

7 unchanged sentences

However, to the extent that the information from these third parties is inaccurate or malicious, the potential for false indications of security vulnerabilities and susceptibility to attack increases.

These false positives, while typical in the industry, may impair the perceived reliability of our offerings and may therefore adversely impact market acceptance of our products and professional services and could result in negative publicity, loss of

customers and sales and increased costs to remedy any problem.

Further, to the extent that our community of third parties is reduced in size or participants become less active, we may lose valuable insight into the dynamic threat landscape and our ability to quickly respond to new exploits, attacks and vulnerabilities may be reduced.

7 unchanged sentences

A material liability claim or other occurrence that harms our reputation or decreases market acceptance of our products may harm our business and operating results.

Limitation of liability provisions in our standard terms and conditions and our other agreements may not adequately or effectively protect us from any claims related to errors or defects in our solutions, including as a result of federal, state or local laws or ordinances or unfavorable judicial decisions in the United States or other countries.

Limitation of liability provisions in our standard terms and conditions and our other

agreements may not adequately or effectively protect us from any claims related to errors or defects in our solutions, including as a result of federal, state or local laws or ordinances or unfavorable judicial decisions in the United States or other countries.

Our brand, reputation and ability to attract, retain and serve our customers are dependent in part upon the reliable performance of our products and network infrastructure.

13 unchanged sentences

Any disruptions or other performance problems with our products could harm our reputation and business and may damage our customers’ businesses.

Interruptions in our service delivery might reduce our revenue, cause us to issue credits to customers, subject us to potential liability and cause customers to not renew their purchases or our products.

Interruptions in our service delivery might reduce our revenue, cause us to issue credits to customers, due to our inability to meet stated service level commitments, subject us to potential liability and cause customers to not renew their purchases or our products.

If we or our third party service providers experience a security breach or unauthorized parties otherwise obtain access to our customers’ data, our reputation may be harmed, demand for our solutions may be reduced and we may incur significant liabilities.

We sell cyber security and data analytics products.

We sell cybersecurity and data analytics products.

As a result, we have been and will be a target of cyber attacks designed to impede the performance of our products, penetrate our network security or the security of our cloud platform or our internal systems, or that of our customers, misappropriate proprietary information and/or cause interruptions to our services.

1 unchanged sentence

In addition, with so many of our employees now working remotely due to the global COVID-19 pandemic, we may face an increased risk of attempted security breaches and incidents.

Also, as more of our customers move to working remotely for extended periods of time during the global COVID-19 pandemic we expect there will be an increased amount of personal, confidential and proprietary information that is stored in our solutions, which increases the exposure and risk of cyberattacks and other malicious internet-based activity.

Also, since many of our customers continue working remotely, we expect there will continue to be an increased amount of personal, confidential and proprietary information that is stored in our solutions, which increases the exposure and risk of cyberattacks and other malicious internet-based activity.

While we have taken steps to protect such information that we have access to, including information we may obtain through our customer support services or customer usage of our offerings, our security measures or those of our third-party service providers could be breached or otherwise fail to prevent unauthorized access to or disclosure, modification, misuse, loss or destruction of such information.

Computer malware, viruses, social engineering (phishing attacks), and increasingly sophisticated network attacks have become more prevalent in our industry, particularly against cloud services.

Computer malware, ransomware, cyber viruses, social engineering (phishing attacks), denial of service or other attacks, employee theft or misuse and increasingly sophisticated network attacks have become more prevalent in our industry, particularly against cloud services.

Such attacks may also include exploitation of vulnerabilities in third party or open source software code that may be incorporated into our own or our customers’ or supplier’s systems, such as the vulnerability in the Java logging library known as “log4j” identified in late 2021 that affected many in our industry.

Further, if our systems or those of our third-party service providers are breached as a result of third-party action, employee error or misconduct, attackers could learn critical information about how our products operate to help protect our customers’ IT infrastructures from cyber risk, thereby making our customers more vulnerable to cyber attacks.

2 unchanged sentences

We make use of third-party technology and systems for a variety of reasons, including, without limitation, encryption and authentication technology, employee email, content delivery to customers, back-office support, credit card processing, human resources services, customer relationship management, enterprise risk planning and other functions.

Although we have developed systems and processes that are designed to protect customer information and prevent data loss and other security breaches and incidents, and to reduce the impact of a security breach or incident at a third-party vendor, such measures cannot provide absolute security.

Although we have developed systems and processes that are designed to protect customer information and prevent data and financial loss and other security breaches and incidents, and to reduce the impact of a security breach or incident at a third-party vendor, such measures cannot provide absolute security.

There can be no assurance that any security measures that we or our third-party service providers have implemented will be effective against current or future security threats.

While we maintain measures designed to protect the integrity, confidentiality and security of our data, our security measures or those of our third-party service providers could fail and result in unauthorized access to or disclosure, modification, misuse, loss or destruction of such data.

Any security breach or other security incident, or the perception that one has occurred, could result in a loss of customer confidence in the security of our offerings and damage to our brand, reduce the demand for our offerings, disrupt normal business operations, require us to spend material resources to investigate or correct the breach and to prevent future security breaches and incidents, expose us to legal liabilities, including litigation, regulatory enforcement, and indemnity obligations, and adversely affect our revenues and operating results.

While we maintain measures designed to protect the integrity, confidentiality and security of our data, our security measures could fail and those of our third-party service providers have failed and could fail, any of which could result in unauthorized access to or disclosure, modification, misuse, loss or destruction of such data or financial loss.

Since our business is focused on providing reliable security solutions to our customers, a security breach or other security incident, or the perception that one has occurred, could result in a loss of customer confidence in the security of our offerings and damage to our brand, reduce the demand for our offerings, disrupt normal business operations, require us to spend material resources to investigate or correct the breach and to prevent future security breaches and incidents, expose us to legal liabilities, including litigation, regulatory enforcement, and indemnity obligations, and adversely affect our revenues and operating results.

These risks may increase as we continue to grow the number and scale of our cloud services, and process, store, and transmit increasing amounts of data.

1 unchanged sentence

The successful assertion of one or more large claims against us that exceed available insurance coverage, or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, could have a material adverse effect on our business, including our financial condition, operating results, and reputation.

If Metasploit were to be used by attackers to exploit vulnerabilities in the cyber security infrastructures of third parties, our reputation and business could be harmed.

Although Metasploit is a penetration testing tool that is intended to allow organizations to test the effectiveness of their cyber security programs, Metasploit has in the past and may in the future be used to exploit vulnerabilities in the cyber security infrastructures of third parties.

If Metasploit were to be used by attackers to exploit vulnerabilities in the cybersecurity infrastructures of third parties, our reputation and business could be harmed.

Although Metasploit is a penetration testing tool that is intended to allow organizations to test the effectiveness of their cybersecurity programs, Metasploit has in the past and may in the future be used to exploit vulnerabilities in the cybersecurity infrastructures of third parties.

While we have incorporated certain features into Metasploit to deter misuse, there is no guarantee that these controls will not be circumvented or that Metasploit will only be used defensively or for research purposes.

2 unchanged sentences

If any of the foregoing were to occur, we could suffer negative publicity and loss of customers and sales, as well as possible legal claims.

Because our products collect and store user and related information, domestic and international privacy and cyber security concerns, and other laws and regulations, could result in additional costs and liabilities to us or inhibit sales of our products.

We, and our customers, are subject to a number of domestic and international laws and regulations that apply to online services and the internet generally.

These laws, rules and regulations address a range of issues including data privacy and cyber security, and restrictions or technological requirements regarding the collection, use, storage, protection, retention or transfer of data.

The regulatory framework for online services, data privacy and cyber security issues worldwide can vary substantially from jurisdiction to jurisdiction, is rapidly evolving and is likely to remain uncertain for the foreseeable future.

Many federal, state and foreign government bodies and agencies have adopted or are considering adopting laws, rules and regulations regarding the

collection, use, storage and disclosure of information, web browsing and geolocation data collection, data analytics, cyber security and breach notification procedures.

Interpretation of these laws, rules and regulations and their application to our products and professional services in the United States and foreign jurisdictions is ongoing and cannot be fully determined at this time.

In the United States, these include rules and regulations promulgated under the authority of the Federal Trade Commission, the Electronic Communications Privacy Act, Computer Fraud and Abuse Act, the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the Gramm Leach Bliley Act and state breach notification laws, as well as regulator enforcement positions and expectations reflected in federal and state regulatory actions, settlements, consent decrees and guidance documents.

In June 2018, California enacted the California Consumer Privacy Act (CCPA), which took effect on January 1, 2020.

The CCPA requires a broad range of companies that do business in California to honor the requests of California residents to access and require deletion of their personal information, opt out of certain personal information sharing and receive detailed information about how their personal information is used and shared.

The CCPA provides for civil penalties of up to $7,500 for violations, and a private right of action for data breaches that allows private plaintiffs to seek the greater of actual damages or statutory damages of up to $750 per affected consumer per data breach.

These statutory remedies are expected to prompt an increase in data breach litigation and the cost to resolve it.

The CCPA has prompted a number of proposals for new federal and state privacy legislation in the United States that, if passed, could increase our potential liability, increase our compliance costs and adversely affect our business.

Internationally, virtually every jurisdiction in which we operate has established its own data security and privacy legal frameworks with which we, and/or our customers, must comply, including the European Union's General Data Protection Regulation, (EU) 2016/679 (GDPR), laws implemented by European Union (EU) member states which contain derogations from, or exemptions or authorizations for the purposes of, the GDPR, or which are otherwise intended to supplement the GDPR and, following the withdrawal of the United Kingdom (UK) from the EU on January 31, 2020 and the expiry of the transitional arrangements agreed to between the UK and EU on December 31, 2020, the so-called ‘UK GDPR’ (i.e., the GDPR as it continues to form part of UK law by virtue of section 3 of the European Union (Withdrawal) Act 2018, as amended (including by the various Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations) (European Data Protection Laws).

Because our products collect and store user and related information, domestic and international privacy and cybersecurity concerns, and other laws and regulations, could have a material adverse effect on our business.

We, and our customers, are subject to a number of stringent and changing obligations in domestic and international laws, regulations, guidance, industry standards, external and internal policies and contracts and other obligations that address a range of issues including data privacy and cybersecurity, and restrictions or technological requirements regarding the collection, use, storage, protection, retention or transfer of data.

The regulatory framework for online services, data privacy and cybersecurity issues worldwide can vary substantially from jurisdiction to jurisdiction, is rapidly evolving and is likely to remain uncertain for the foreseeable future.

This creates some uncertainty as to the effective legal frameworks and our obligations may be subject to differing applications and interpretations, which may be inconsistent or in conflict among jurisdictions.

Preparation for and compliance with these obligations requires us to devote significant resources (including, without limitation, financial and time-related resources).

These obligations may necessitate changes to our business including our information technologies, systems and practices and to those of any third parties that process personal data on our behalf.

Although we strive to comply with all applicable data privacy and security obligations, we may at times fail (or be perceived to have failed) to do so.

Moreover, despite our efforts, our personnel or third parties upon whom we rely may fail to comply with such obligations.

If we (or third parties upon whom we rely) fail, or are perceived to have failed, to address and comply with data privacy and security obligations, we could face significant consequences.

These consequences may include but are not limited to:

government enforcement actions (e.g., investigations, fines, penalties, audits, inspections and similar consequences);

litigation (including class-related claims);

additional reporting requirements and oversight;

bans on processing personal data;

orders to destroy and not to use personal data;

and imprisonment of company officials.

Any of these events could have a material adverse effect on our reputation and our business, and financial condition, including but not limited to:

loss of customers;

interruptions or

stoppages in our business or operations;

inability to process personal data;

inability to operate in specific jurisdictions;

limitations in our ability to develop our products and professional services;

management's time and other resource expenditures;

adverse publicity;

and revisions to our operations.

In the United States, federal, state and local governments have enacted numerous data privacy and security laws (including data breach notification laws, personal data privacy laws and consumer protection laws).

For example, the California Consumer Privacy Act of 2018 (CCPA), imposes obligations on businesses to which it applies.

These obligations include but are not limited to providing specific disclosures in privacy notices and affording California residents certain rights related to their personal data.

The CCPA allows for statutory fines for non-compliance (up to $7,500 per violation).

Other states have similarly enacted data privacy laws.

If we become subject to new data privacy or security laws, at the state level, the risk of enforcement action against us could increase because we may become subject to additional obligations, and the number of individuals or entities that can initiate actions against us may increase (including individuals, via a private right of action, and state actors).

The UK’s decision to leave the EU and ongoing developments in the UK have created uncertainty with regard to data protection regulation in the UK.

Going forward, there may be an increasing scope for divergence in the application, interpretation and enforcement of data protection laws as between the UK and EU.

The European Data Protection Laws present significantly greater risks, compliance burdens and costs for companies with users and operations in the EU and UK.

6 unchanged sentences

We could be adversely affected if legislation or regulations are expanded to require changes in our business practices or if governing jurisdictions interpret or implement their legislation or regulations in ways that negatively affect our business, results of operations or financial condition.

European Data Protection Laws generally prohibit the transfer of personal data from the European Economic Area (EEA), the UK and Switzerland (Europe), to the United States and most other countries unless the parties to the transfer have implemented specific safeguards to protect the transferred personal data.

One of the primary safeguards used for transfers of personal data from Europe to the United States was the Privacy Shield framework which is administered by the U.S.

Department of Commerce.

To facilitate the transfer of both customer and employee personal data from Europe to the United States, we self-certified under the EU-US Privacy Shield framework on December 20, 2016.

However, this framework was recently invalidated by a decision of the EU’s highest court in July 2020 and authorities in the UK and Switzerland have similarly invalidated use of the Privacy Shield as a vehicle for lawful data transfers from those countries to the United States.

The same decision also cast doubt on the ability to use one of the primary alternatives to the Privacy Shield, namely, the European Commission’s Standard Contractual Clauses (SCCs), to lawfully transfer personal data from Europe to the United States and most other countries.

In addition, certain jurisdictions have enacted data localization laws and cross-border personal data transfer laws.

For example, European Data Protection Laws generally prohibit the transfer of personal data from the European Economic Area (EEA) and, the UK and Switzerland (collectively, Europe), to most other non-European countries unless the parties to the transfer have implemented specific safeguards to protect the transferred personal data.

In particular, government regulators in Europe have found that the United States does nor provide an adequate level of data privacy and security protection and although there are legal mechanisms to allow for the transfer of personal data from Europe to the United States, uncertainty remains about compliance and such mechanisms may not be available or applicable with respect to our personal data processing activities.

For example, the “Standard Contractual Clauses” (SCCs) that are designed to be a valid mechanism by which parties can transfer personal data out of Europe to jurisdictions that are not found to provide an adequate level of protection, must be assessed on a case-by-case basis taking into account the legal regime applicable in the destination country.

Specifically, the parties to the cross-border personal data transfer must evaluate the importing jurisdiction’s laws and implement supplemental security measures as necessary to protect the at-issue personal data.

It is likely that there will continue to be some uncertainty regarding the mechanisms by which parties transfer personal data out of Europe to jurisdictions such as the United States.

At present, there are few if any viable alternatives to the SCCs.

As such, our processing of personal data from Europe may not comply with European Data Protection Law.

This may increase our exposure to the GDPR’s and UK GDPR’s heightened sanctions for violations of its cross-border data transfer restrictions, including injunctions against transferring personal data subject to the GDPR.

If we cannot implement and maintain a valid mechanism for cross-border personal data transfers, we may face increased exposure to regulatory actions, substantial fines and injunctions against processing (including prohibitions on transferring personal data out of the EU and UK).

This may also reduce demand for our services from companies subject to European Data Protection Laws.

Loss of our ability to import personal data from Europe may also require us to increase our data processing capabilities in the EEA at significant expense.

Although by virtue of the UK GDPR, the GDPR applies in the UK in substantially unvaried form, going forward there will be increasing scope for divergence in application, interpretation and enforcement of the data protection law as between the UK and the EEA.

Furthermore, it is unclear whether transfers of personal data from the EEA to the UK will be permitted to take place

on the basis of a future adequacy decision of the European Commission, or whether a ‘transfer mechanism,’ such as the SCCs, will be required.

For the meantime, under the post-Brexit Trade and Cooperation Agreement between, on the one hand, the EU and the European Atomic Energy Community and, on the other, the UK, it has been agreed that transfers of personal data to the UK from EU member states will not be treated as “restricted transfers” to a non-EEA country for a period of up to four months from January 1, 2021, plus a potential further two months extension (the adequacy assessment period).

This will also apply to transfers to the UK from EEA member states, assuming those states accede to the relevant provision of the Trade and Cooperation Agreement.

This adequacy assessment period may end sooner, for example, in the event that the European Commission adopts an adequacy decision in respect of the UK.

If the European Commission does not adopt an ‘adequacy decision’ in respect of the UK prior to the expiry of the extended adequacy assessment period, from that point onwards the UK will be an ‘inadequate third country’ under the GDPR and transfers of data from the EEA to the UK will require a ‘transfer mechanism,’ such as the SCCs.

Additionally, other countries outside of Europe have enacted or are considering enacting similar cross-border data transfer restrictions and laws requiring local data residency, which could increase the cost and complexity of delivering our services and operating our business.

In addition to government regulation, privacy advocates and industry groups may propose new and different self-regulatory standards that either legally or contractually apply to us.

Because the interpretation and application of privacy and data protection laws are still uncertain, it is possible that these laws may be interpreted and applied in a manner that is inconsistent with our existing practices or the features of our products.

We may also be subject to claims of liability or responsibility for the actions of third parties with whom we interact or upon whom we rely in relation to various services, including but not limited to vendors and business partners.

If so, in addition to the possibility of fines, lawsuits and other claims, we could be required to fundamentally change our business activities and practices or modify our products, which could have an adverse effect on our business.

Any inability to adequately address privacy concerns, even if unfounded, or comply with applicable privacy or data protection laws, regulations and policies, could result in additional cost and liability to us, damage our reputation, inhibit sales and adversely affect our business.

Loss of our ability to import personal data from the EU and UK may also require us to increase our data processing capabilities in the EEA at significant expense.

The costs of compliance with, and other burdens imposed by, the laws, rules, regulations and policies that are applicable to the businesses of our customers may limit the use and adoption of, and reduce the overall demand for, our software.

Privacy or cyber security concerns, whether valid or not valid, may inhibit market adoption of our products particularly in certain industries and foreign countries.

Privacy or cybersecurity concerns, whether valid or not valid, may inhibit market adoption of our products particularly in certain industries and foreign countries.

Further, there are active legislative discussions regarding the implementation of laws or regulations that could restrict the manner in which security research is conducted and that could restrict or possibly bar the conduct of penetration testing and the use of exploits, which are an essential component of our Metasploit product and our business strategy more generally.

Our failure to comply with existing laws, rules or regulations, changes to existing laws or their interpretation, or the imposition of new laws, rules or regulations, could result in additional costs and may necessitate changes to our business practices and divergent operating models, which may have a material and adverse impact on our business, results of operations, and financial condition.

divergent operating models, which may have a material and adverse impact on our business, results of operations, and financial condition.

Organizations may be reluctant to purchase our cloud-based offerings due to the actual or perceived vulnerability of cloud solutions.

Some organizations have been reluctant to use cloud solutions for cyber security, such as our InsightVM, InsightIDR, InsightAppSec, InsightConnect and DivvyCloud, because they have concerns regarding the risks associated with the reliability or security of the technology delivery model associated with this solution.

Some organizations have been reluctant to use cloud solutions for cybersecurity, such as our InsightVM, InsightIDR, InsightAppSec, InsightConnect, InsightCloudSec and Threat Intelligence, because they have concerns regarding the risks associated with the reliability or security of the technology delivery model associated with this solution.

If we or other cloud service providers experience security incidents, breaches of customer data, disruptions in service delivery or other problems, the market for cloud solutions as a whole may be negatively impacted, which could harm our business.

18 unchanged sentences

• general economic, regulatory and market conditions.

Recently, the stock markets, and in particular the market on which our common stock is listed, have experienced extreme price and volume fluctuations that have affected and continue to affect the market prices of equity securities of many companies due to, among other factors, the actions of market participants or other actions outside of our control, including general market volatility caused by the COVID-19 pandemic.

Recently, the stock markets, and in particular the market on which our common stock is listed, have experienced price and volume fluctuations that have affected and continue to affect the market prices of equity securities of many companies due to, among other factors, the actions of market participants or other actions outside of our control, including general market volatility caused by the COVID-19 pandemic.

These fluctuations have often been unrelated or disproportionate to the operating performance of those companies.

21 unchanged sentences

We may not have sufficient cash flow from our business to pay our substantial debt when due.

As of December 31, 2020, we had $230.0 million aggregate principal amount of indebtedness under the convertible senior notes due in 2023 (the 2023 Notes) and an additional $230.0 million aggregate principal amount of indebtedness under the

convertible senior notes due in 2025 (the 2025 Notes) (collectively, the Notes).

In May 2020, we issued $230.0 million aggregate principal amount of 2025 Notes and in March 2021, we issued $600.0 million aggregate principal amount of 2027 Notes (collectively, the Notes).

In addition, we may also incur indebtedness under our senior secured credit facility.

16 unchanged sentences

In addition, our senior secured credit facility contains, and any future additional indebtedness that we may incur may contain, financial and other restrictive covenants that limit our ability to operate our business, raise capital, pay dividends and/or make payments under our other indebtedness.

If we fail to comply with these covenants or to make payments under our indebtedness when due, then we would be in default under that indebtedness, which could, in turn, result in that and our other indebtedness becoming immediately payable in full.

If we fail to comply with these covenants or to make payments under our indebtedness

when due, then we would be in default under that indebtedness, which could, in turn, result in that and our other indebtedness becoming immediately payable in full.

Any such event of default under our senior secured credit facility would give the lenders the right to terminate their commitments to provide additional loans under our senior secured credit facility and to declare any and all borrowings outstanding, together with accrued and unpaid interest and fees, to be immediately due and payable.

5 unchanged sentences

If one or more holders elect to convert their Notes, unless we elect to satisfy our conversion obligation by delivering solely shares of our common stock (other than paying cash in lieu of delivering any fractional share), we would be required to settle a portion or all of our conversion obligation in cash, which could adversely affect our liquidity.

As disclosed in Note 11 to our consolidated financial statements, the conditional conversion feature of the 2023 Notes was triggered as of December 31, 2020, and the 2023 Notes are convertible at the option of the holders, in whole or in part, between January 1, 2021 and March 31, 2021.

Whether the 2023 Notes will be convertible following such fiscal quarter will depend on the continued satisfaction of this condition or another conversion condition in the future.

As disclosed in Note 10, Debt , to our consolidated financial statements, the conditional conversion features of the 2025 Notes were triggered as of December 31, 2021, and the 2025 Notes are convertible at the option of the holders, in whole or in part, between January 1, 2022 and March 31, 2022.

Whether the 2025 Notes will be convertible following the fiscal quarter ending March 31, 2022, will depend on the continued satisfaction of this condition or another conversion condition in the future.

As of December 31, 2021, the 2027 Notes are not convertible at the option of the holder.

In addition, even if holders of Notes do not elect to convert their Notes, we could be required under applicable accounting rules to reclassify all or a portion of the outstanding principal of the Notes as a current rather than long-term liability, which would result in a material reduction of our net working capital.

The accounting method for convertible debt securities that may be settled in cash, such as the Notes, could have a material effect on our reported financial results.

Under Accounting Standards Codification 470-20, Debt with Conversion and Other Options (ASC 470-20), an entity must separately account for the liability and equity components of the convertible debt instruments (such as the Notes) that may be settled entirely or partially in cash upon conversion in a manner that reflects the issuer’s economic interest cost.

The effect of ASC 470-20 on the accounting for the Notes is that the equity component is required to be included in the additional paid-in capital section of stockholders’ equity on our consolidated balance sheet at the issuance date and the value of the equity component would be treated as debt discount for purposes of accounting for the debt component of the Notes.

As a result, we will be required to record non-cash interest expense through the amortization of the excess of the face amount over the carrying amount of the expected life of the Notes.

We will report larger net losses (or lower net income) in our financial results because ASC 470-20 requires interest to include both the amortization of the debt discount and the instrument’s cash coupon interest rate, which could adversely affect our reported or future financial results, the trading price of our common stock and the trading price of the Notes.

In addition, under certain circumstances, convertible debt instruments (such as the Notes) that may be settled entirely or partly in cash may be accounted for utilizing the treasury stock method, the effect of which is that the shares issuable upon conversion of such Notes are not included in the calculation of diluted earnings per share except to the extent that the conversion value of such Notes exceeds their principal amount.

Under the treasury stock method, for diluted earnings per share purposes, the transaction is accounted for as if the number of shares of common stock that would be necessary to settle such excess, if we elected to settle such excess in shares, are included in the denominator for purposes of calculating diluted earnings per share.

We cannot be sure that the accounting standards in the future will continue to permit the use of the treasury stock method.

For example, in August 2020, the FASB issued ASU 2020-06, Debt—Debt with Conversion and Other Options (Subtopic 470-20) and Derivatives and Hedging—Contracts in Entity’s Own Equity (Subtopic 815-40):

Accounting for Convertible Instruments and Contracts in an Entity’s Own Equity which changes the accounting for the convertible debt instruments described above.

The standard eliminates beneficial conversion feature and cash conversion models resulting in more convertible instruments being accounted for as a single unit;

and simplifies classification of debt on the balance sheet and earnings per share calculation.

The standard is effective for us in the first quarter of fiscal 2022 and can be adopted on a full or modified retrospective basis.

We plan to adopt this standard in the first quarter of 2021 under the modified retrospective basis.

Adopting this guidance will reduce non-cash interest expense, and thereby increase net income, in our consolidated financial statements.

Additionally, the treasury stock method for calculating earnings per share will no longer be allowed for convertible debt instruments whose principal amount may be settled using shares.

Rather, the if-converted method will be required.

Application of the “if converted” method may reduce our reported diluted earnings per share.

We cannot be sure whether other changes may be made to the current accounting standards related to the Notes, or otherwise, that could have an adverse impact on our financial statements.

The phaseout of LIBOR, or the replacement of LIBOR with a different reference rate, may adversely affect interest rates.

On July 27, 2017, the Financial Conduct Authority (the authority that regulates LIBOR) announced that it would phase out LIBOR by the end of 2021.

It is unclear whether new methods of calculating LIBOR will be established such that it continues to exist after 2021, or if alternative rates or benchmarks will be adopted.

Changes in the method of calculating LIBOR, or the replacement of LIBOR with an alternative rate or benchmark, may adversely affect interest rates and result in higher borrowing costs.

This could materially and adversely affect our results of operations, cash flows and liquidity.

We cannot predict the effect of the potential changes to LIBOR or the establishment and use of alternative rates or benchmarks.

We may need to renegotiate our senior secured credit facility or incur other indebtedness, and changes in the method of calculating LIBOR, or the use of an alternative rate or benchmark, may negatively impact the terms of such indebtedness.

If changes are made to the method of calculating LIBOR or LIBOR ceases to exist, we may need to amend certain contracts, including our senior secured credit facility, and we cannot predict what alternative rate or benchmark would be negotiated.

This may result in an increase to our interest expense.

The capped call transactions may affect the value of the Notes and our common stock.

3 unchanged sentences

In connection with establishing their initial hedge of the capped call transactions, the counterparties or their respective affiliates entered into various derivative transactions with respect to our common stock concurrently with or shortly after the pricings of the Notes, including with certain investors in the Notes.

date of the capped call transactions, which are scheduled to occur during the applicable observation period relating to any conversion of the 2023 Notes on or after February 1, 2023, or relating to any conversion of the 2025 Notes on or after November 1, 2024, in each case that is not in connection with a redemption).

The counterparties and/or or their respective affiliates may modify or unwind their hedge positions by entering into or unwinding various derivatives with respect to our common stock and/or purchasing or selling our common stock or other securities of ours in secondary market transactions prior to the maturity of the Notes (and are likely to do so on each exercise date of the capped call transactions, which are scheduled to occur during the applicable observation period relating to any conversion of the 2025 Notes on or after November 1, 2024 or relating to any conversion of the 2027 Notes on or after December 15, 2026, in each case that is not in connection with a redemption).

We cannot make any prediction as to the direction or magnitude of any potential effect that the transactions described above may have on the prices of the Notes or the shares of our common stock.

10 unchanged sentences

If a fundamental change occurs prior to the maturity date of the Notes, holders of the Notes, will have the right, at their option, to require us to repurchase all or a portion of their Notes.

In addition, if a “make-whole fundamental change” (as defined in the indentures) occurs prior the maturity date, we will in some cases be required to increase the conversion rate of the Notes for a holder that elects to convert its Notes in connection with such make-whole fundamental change.

In addition, if a “make-whole fundamental change” (as defined in the

indentures) occurs prior the maturity date, we will in some cases be required to increase the conversion rate of the Notes for a holder that elects to convert its Notes in connection with such make-whole fundamental change.

Furthermore, the indentures governing the Notes prohibit us from engaging in certain mergers or acquisitions unless, among other things, the surviving entity assumes our obligations under the Notes.

2 unchanged sentences

The conversion of some or all of the Notes will dilute the ownership interests of existing stockholders to the extent we deliver shares of our common stock upon conversion of any of the Notes.

Whether the Notes will be convertible following such fiscal quarter will depend on the continued satisfaction of this condition or another conversion condition in the future.

Whether the 2025 Notes will be convertible following the fiscal quarter from January 1, 2022 and March 31, 2022 will depend on the continued satisfaction of the applicable conversion condition or another conversion condition in the future.

As of December 31, 2021, the 2027 Notes are not convertible at the option of the holder.

9 unchanged sentences

Enforcement actions and sanctions could harm our business, reputation, results of operations and financial condition.

Our business is subject to the risks of pandemics, earthquakes, fire, power outages, floods and other catastrophic events, and to interruption by manmade problems such as terrorism.

A significant public health crisis, epidemic or pandemic (including the ongoing COVID-19 pandemic), or a natural disaster, such as an earthquake, fire or a flood, or a significant power outage could have a material adverse impact on our business, operating results and financial condition.

In addition, public health crises or natural disasters could affect our channel partners’

ability to perform services for us on a timely basis.

Our business is subject to the risks of climate change, pandemics, earthquakes, fire, power outages, floods and other catastrophic events, and to interruption by manmade problems such as terrorism.

A significant public health crisis, epidemic or pandemic (including the ongoing COVID-19 pandemic), or climate change, or a natural disaster, such as an earthquake, fire or a flood, or a significant power outage could have a material adverse impact on our business, operating results and financial condition.

In addition, public health crises, climate change, or natural disasters could affect our channel partners’ ability to perform services for us on a timely basis.

In the event we or our channel partners are hindered by any of the events discussed above, our ability to provide our products or professional services to customers could be delayed.

In addition, our facilities and those of our third-party data centers and hosting providers are vulnerable to damage or interruption from human error, intentional bad acts, pandemics, earthquakes, hurricanes, floods, fires, war, terrorist attacks, power losses, hardware failures, systems failures, telecommunications failures and similar events.

The occurrence of a public health crisis, natural disaster, power failure or an act of terrorism, vandalism or other misconduct, a decision by a third party to close a facility on which we rely without adequate notice, or other unanticipated problems could result in lengthy interruptions in provision or delivery of our products, potentially leaving our customers vulnerable to cyber attacks.

The occurrence of a public health crisis, climate change, natural disaster, power failure or an act of terrorism, vandalism or other misconduct, a decision by a third party to close a facility on which we rely without adequate notice, or other unanticipated problems could result in lengthy interruptions in provision or delivery of our products, potentially leaving our customers vulnerable to cyber attacks.

The occurrence of any of the foregoing events could damage our systems and hardware or could cause them to fail completely, and our insurance may not cover such events or may be insufficient to compensate us for the potentially significant losses, including the potential harm to the future growth of our business, that may result from interruptions in our service as a result of system failures.

12 unchanged sentences

Failure to remediate any material weakness in our internal control over financial reporting, or to maintain other effective control systems required of public companies, could also restrict our future access to the capital markets.

Changes in financial accounting standards may adversely impact our reported results of operations.

A change in accounting standards or practices could adversely affect our operating results and may even affect our reporting of transactions completed before the change is effective.

New accounting pronouncements and varying interpretations of accounting pronouncements have occurred and may occur in the future.

Changes to existing rules or the questioning of current practices may adversely affect our operating results.

We may require additional capital to support business growth, and this capital might not be available on acceptable terms, if at all.

Accordingly, we may need to engage in equity or debt financings to secure additional funds.

We may not be able to obtain additional financing on terms favorable to us, if at all.

Although we expect that current cash and cash equivalent balances and cash flows that are generated from operations will be sufficient to meet our domestic and international working capital needs and other capital and liquidity requirements for at least the next 12 months, if we are unable to obtain adequate financing or financing on terms satisfactory to us if and when we require it, our ability to continue to support our business growth and to respond to business challenges could be significantly impaired, and our business may be adversely affected.

Anti-takeover provisions in our charter documents and under Delaware law could make an acquisition of us more difficult, limit attempts by our stockholders to replace or remove our current management and limit the market price of our common stock.

5 unchanged sentences

• establish that our board of directors is divided into three classes, with directors in each class elected prior to our 2021 annual meeting serving three-year staggered terms;

amended and restated certificate of incorporation regarding the election and removal of directors and the ability of stockholders to take action by written consent or call a special meeting;

• prior to June 30, 2022 require the approval of holders of two-thirds of the shares entitled to vote at an election of directors to adopt, amend or repeal our amended and restated bylaws or amend or repeal the provisions of our amended and restated certificate of incorporation regarding the election and removal of directors and the ability of stockholders to take action by written consent or call a special meeting;

• prohibit cumulative voting in the election of directors;

9 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors