What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2022-05-05 compared with 2021-11-04 · 237 added, 231 removed, 548 unchanged (46% of the section changed)

4 unchanged sentences

Additional risks and uncertainties that we are unaware of, or that we currently believe are not material, may also become important factors that adversely affect our business.

Furthermore, the COVID-19 pandemic (including federal, state and local governmental responses, broad economic impacts and market disruptions) has heightened risks discussed in the risk factors described below.

Furthermore, the COVID-19 pandemic (including governmental responses, broad economic impacts and market disruptions) has heightened risks discussed in the risk factors described below.

If any of the following risks or others not specified below materialize, our business, financial condition and results of operations could be materially adversely affected.

2 unchanged sentences

Our business is subject to numerous risks and uncertainties which include, but are not limited to, the following:

• The ongoing COVID-19 pandemic could materially and adversely affect our business, results of operations and financial condition.

• Our quarterly operating results may vary from period to period, which could result in our failure to meet expectations with respect to operating results and cause the trading price of our stock to decline.

• We are a rapidly growing company, which makes it difficult to evaluate our future operating and financial results and may increase the risk that we will not be successful.

• If we are unable to sustain our revenue growth rate, we may not achieve or maintain profitability in the future.

• If we are do not effectively manage our future growth rate, our business and results of operations may be adversely affected.

• The ongoing COVID-19 pandemic could materially and adversely affect our business, results of operations and financial condition, and we could be subject to risks from further health pandemics or epidemics, as well as uncertainty regarding returning to work and re-openings.

• Real or perceived failures, errors or defect in our solutions could adversely affect our brand and reputation, which could have an adverse effect on our business and results of operations.

4 unchanged sentences

• We face intense competition in our market.

• If we fail to manage our operations infrastructure, our customers may experience service outages and/or delays.

• If we are unable to hire, train, manage and retain qualified personnel, including our senior management and other key employees, our business may suffer.

• If we are unable to successfully hire, train, and retain qualified personnel our business may suffer.

• If we fail to continue to effectively scale and manage our operations infrastructure, our customers may experience service outages and/or delays.

• A component of our growth strategy is dependent on our continued international expansion, which adds complexity to our operations.

• Because our products collect and store user and related information, domestic and international privacy and cyber security concerns, and other laws and regulations, could result in additional costs and liabilities to us or inhibit sales of our products.

• Because our products collect and store user and related information, domestic and international privacy and cybersecurity concerns, and other laws and regulations, could have a material adverse effect on our business.

• If our customers are unable to implement our products successfully, customer perceptions of our offerings may be impaired or our reputation and brand may suffer.

4 unchanged sentences

• We use third-party software and data that may be difficult to replace or that may cause errors or failures of our solutions, which could lead to lost customers or harm to our reputation and our operating results.

• Organizations may be reluctant to purchase our cloud-based offerings due to the actual or perceived vulnerability of cloud solutions.

• We may require additional capital to support business growth, and this capital might not be available on acceptable terms, if at all.

• Assertions by third parties of infringement or other violations by us of their intellectual property rights, whether or not correct, could result in significant costs and harm our business and operating results.

• Organizations may be reluctant to purchase our cloud-based offerings due to the actual or perceived vulnerability of cloud solutions.

• We have a significant amount of debt that may decrease our business flexibility, access to capital, and/or increase our borrowing costs, and we may still incur additional debt in the future, which may adversely affect our operations and financial results.

We may not have sufficient cash flow from our business to pay our substantial debt when due.

• We may require additional capital to support business growth, and this capital might not be available on acceptable terms, if at all.

The summary risk factors described above should be read together with the text of the full risk factors below and our unaudited consolidated financial statements and the related notes, as well as in other documents that we file with the U.S.

3 unchanged sentences

Risks Related to Our Business and Industry

The ongoing COVID-19 pandemic could materially and adversely affect our business, results of operations and financial condition.

We are unable to accurately predict the full impact that the COVID-19 pandemic will have on our results from operations, financial condition, liquidity and cash flows due to numerous uncertainties, including the duration and severity of the pandemic and containment measures.

The implementation of measures to help contain the virus has impacted our day-to-day operations and could disrupt our business and operations, as well as that of our customers, partners, suppliers and others with whom we work, for an indefinite period of time.

To support the health and well-being of our employees, customers, partners and communities, a vast majority of our employees began working remotely as of late March 2020, and they continue to do so.

In addition, many of our customers and prospective customers are working remotely.

The disruptions to our operations caused by the COVID-19 pandemic may result in inefficiencies, delays and additional costs in our sales and marketing, professional service and research and development efforts, which cannot be predicted or quantified at this time.

To the extent that disruptions occur, we may not be able to fully mitigate any such inefficiencies, delays and additional costs through remote or other alternative work arrangements.

In addition, given the economic uncertainty created by COVID-19, we have and may continue to see delays in our sales cycle, failures of customers to renew at all or to renew the anticipated scope their subscriptions with us, requests from customers for payment term deferrals as well as pricing or bundling concessions, which, if significant, could materially and adversely affect our business, results of operations and financial condition.

Negative conditions in the general economy both in the United States and abroad, including conditions resulting from the COVID-19 pandemic, changes in gross domestic product growth, financial and credit market fluctuations, energy costs, international trade relations and other geopolitical issues, the availability and cost of credit and the global housing and mortgage markets could cause a decrease in consumer discretionary spending and business investment and diminish growth expectations in the U.S.

economy and abroad.

More generally, the COVID-19 pandemic continues to present the possibility of an extended

global economic downturn and has caused volatility in financial markets, which could materially and adversely affect demand for our products and professional services and could materially and adversely impact our results and financial condition even after the pandemic is contained.

For example, we may be unable to collect receivables from those customers significantly impacted by COVID-19, which may be more pronounced in industry verticals more directly impacted by the COVID-19 pandemic.

Also, a decrease in subscriptions and/or renewals in a given period could negatively affect our ARR as well as our revenues in future periods, particularly if experienced on a sustained basis, because a substantial proportion of our software subscriptions yield revenue recognized over time.

The pandemic may also have the effect of heightening many of the other risks described in this “Risk Factors” section, including risks associated with our guidance, our customers, our potential customers, our market opportunity, renewals and sales cycle, among others.

We will continue to evaluate the nature and extent of the impact of the COVID-19 pandemic on our business.

Although we expect that current cash and cash equivalent balances, including the proceeds of our convertible senior notes offering in March 2021, together with cash flows that are generated from operations and availability under our revolving credit facility, will be sufficient to meet our domestic and international working capital needs and other capital and liquidity requirements for at least the next 12 months, if our access to capital is restricted or our borrowing costs increase, our operations and financial condition could be adversely impacted.

The full extent of the COVID-19 pandemic’s impact on our operations and financial performance depends on future developments that are uncertain and unpredictable, including the ultimate duration, spread and reemergence of the pandemic, its impact on capital and financial markets, the timing of economic recovery and any new information that may emerge concerning the severity of the virus, its spread to or reemergence in other geographic regions as well as the actions taken to contain it, including the distribution and acceptance of vaccines, among others.

Any of these impacts could have a material adverse impact on our business, results of operations and financial condition and ability to execute and capitalize on our strategies.

Due to the current uncertainty regarding the severity and duration of the COVID-19 pandemic, we cannot predict whether our response to date or the actions we may take in the future will be effective in mitigating the effects of COVID-19 pandemic on our business, results of operations or financial condition.

Accordingly, we are unable at this time to predict the impact of the COVID-19 pandemic on our operations, liquidity, and financial results, and, depending on the magnitude and duration of the COVID-19 pandemic, such impact may be material.

Our quarterly operating results may vary from period to period, which could result in our failure to meet expectations with respect to operating results and cause the trading price of our stock to decline.

Our operating results, including the levels of our revenue, ARR, cash flow, deferred revenue and gross margins, have historically varied from period to period, and we expect that they will continue to do so as a result of a number of factors, many of which are outside of our control, including:

• business disruptions in regions affecting our operations, stemming from actual, imminent or perceived outbreak or reemergence of contagious disease, including the COVID-19 pandemic;

• the level of demand for our products and professional services;

3 unchanged sentences

• the ability to successfully grow our sales of our cloud-based solutions;

• the level of perceived threats to organizations’ cyber security;

• the level of perceived threats to organizations’ cybersecurity;

• network outages, security breaches, technical difficulties or interruptions with our products;

3 unchanged sentences

• the introduction or adoption of new technologies that compete with our offerings;

• decisions by potential customers to purchase cyber security products or professional services from other vendors;

• decisions by potential customers to purchase cybersecurity products or professional services from other vendors;

• the amount and timing of operating costs and capital expenditures related to the operations and expansion of our business;

• price competition;

• our ability to successfully manage and integrate any acquired businesses, including, Alcide.IO Ltd.

(Alcide) and IntSights Cyber Intelligence Ltd.

• our ability to successfully manage and integrate any acquired businesses, including, IntSights Cyber Intelligence Ltd.

(“IntSights”), and including without limitation the amount and timing of expenses and potential future charges for impairment of goodwill from acquired companies;

• business disruptions in regions affecting our operations, stemming from actual, imminent or perceived outbreak or reemergence of contagious disease, including the COVID-19 pandemic;

• our ability to increase, retain and incentivize the channel partners that market and sell our products and professional services;

• our continued international expansion and associated exposure to changes in foreign currency exchange rates, including any fluctuations caused by uncertainties relating to United Kingdom's exit from the European Union, commonly referred to as “Brexit”;

• our continued international expansion and associated exposure to changes in foreign currency exchange rates;

• the amount and timing of operating expenses related to the maintenance and expansion of our business, operations and infrastructure;

• the announcement or adoption of new regulations and policy mandates or changes to existing regulations and policy mandates;

• the announcement or adoption of new regulations and policy mandates or changes to existing regulations and policy mandates that impact our business;

• the cost or results of existing or unforeseen litigation and intellectual property infringement;

• the strength of regional, national and global economies;

• the impact of natural disasters or manmade problems such as terrorism or war;

• future accounting pronouncements or changes in our accounting policies.

Fluctuations in our quarterly operating results, key metrics, non-GAAP metrics and the price of our common stock may be particularly pronounced in the current economic environment due to the uncertainty caused by and the unprecedented nature of the current COVID-19 pandemic.

• the impact of climate change, natural disasters or manmade problems, including terrorism or war (such as the armed conflict between Russia and Ukraine);

• future accounting pronouncements or changes in our accounting policies or practices.

Each factor above or discussed elsewhere herein or the cumulative effect of some of these factors may result in fluctuations in our operating results.

6 unchanged sentences

If our assumptions regarding these uncertainties, which we use to plan our business, are incorrect or change in reaction to changes in our markets, or if we do not address these risks successfully, our operating and financial results could differ materially from our expectations, our business could suffer and the trading price of our common stock may decline.

If we are unable to sustain our revenue growth rate, we may not achieve or maintain profitability in the future.

From the year ended December 31, 2016 to the year ended December 31, 2020, our revenue grew from $157.4 million to $411.5 million.

Although we have experienced rapid growth historically and currently have high renewal rates, we may not continue to grow as rapidly in the future and our renewal rates may decline.

Any success that we may experience in the future will depend, in large part, on our ability to, among other things:

If we do not effectively manage our future growth, our business and results of operations will be adversely affected.

From the year ended December 31, 2017 to the year ended December 31, 2021, our revenue grew from $200.9 million to $535.4 million and our headcount grew from 1,079 to 2,353 employees.

Although we have experienced rapid growth historically, we may not sustain our current growth rates and our investments to support our growth may not be successful.

The growth and expansion of our business will require us to invest significant financial and operational resources and will continue to place significant demands on our management team.

Our future success will depend in part on our ability to manage our growth effectively, which will require us to, among other things:

• maintain and expand our customer base;

4 unchanged sentences

• continue to successfully expand our business domestically and internationally;

• continue to effectively grow and improve the productivity of our sales teams;

• continue to improve our key business applications, processes and IT infrastructure to support our business needs and appropriately documenting such systems and processes;

• continue to effectively attract, integrate and retain a large number of new employees, particularly members of our sales and marketing and research and development teams;

• enhance our information and communication systems to ensure that our employees and offices around the world are well coordinated and can effectively communicate with each other and our growing base of customers and partners;

• improve our financial, management, and compliance systems and controls;

• successfully compete with other companies.

If we are unable to maintain consistent revenue or revenue growth, our stock price could be volatile, and it may be difficult to achieve and maintain profitability.

You should not rely on our revenue for any prior quarterly or annual periods as any indication of our future revenue or revenue growth.

If we fail to achieve these objectives effectively, our ability to manage our expected growth may be impaired and we may be unable to maintain the quality of our offerings, consistent revenue or revenue growth, our stock price could be volatile, and it may be difficult to achieve and maintain profitability.

You should not rely on our prior quarterly or annual periods performance as any indication of our future growth.

We have not been profitable historically and may not achieve or maintain profitability in the future.

We have posted a net loss in each year since inception, including net losses of $146.3 million, $98.8 million and $53.8 million in the years ended December 31, 2021, 2020 and 2019, respectively.

As of September 30, 2021, we had an accumulated deficit of $691.4 million.

As of March 31, 2022, we had an accumulated deficit of $781.0 million.

While we have experienced significant revenue growth in recent periods, we may not obtain a high enough volume of sales of our products and professional services to sustain or increase our growth or achieve or maintain profitability in the future.

10 unchanged sentences

If our revenue growth does not meet our expectations in future periods, our financial performance may be harmed, and we may not achieve or maintain profitability in the future.

The ongoing COVID-19 pandemic could materially and adversely affect our business, results of operations and financial condition, and we could be subject to risks from further health pandemics or epidemics, as well as uncertainty regarding returning to work and re-openings.

Our business could be adversely affected by the effects of health pandemics or epidemics, including the ongoing COVID-19 pandemic, which continues to have a negative impact on the local, regional, national and global scale.

To support the health and well-being of our employees, customers, partners and communities, a vast majority of our employees began working remotely as of late March 2020, but as of March 31, 2022, we reopened our offices in a phased approach and continue to hold in-person or hybrid meetings, on a voluntary basis, taking into consideration government restrictions and employee safety.

In addition, many of our customers and prospective customers are working remotely.

The disruptions to our operations caused by the COVID-19 pandemic may negatively impact employee retention and result in

inefficiencies, delays and additional costs in our sales and marketing, professional service and research and development efforts, which cannot be predicted or quantified at this time.

To the extent that disruptions occur, we may not be able to fully mitigate any such inefficiencies, delays and additional costs through remote or other alternative work arrangements.

Negative conditions in the general economy both in the United States and abroad resulting from health pandemics or epidemics, such as the COVID-19 pandemic, could cause a decrease in consumer discretionary spending and business investment and diminish growth expectations in the U.S.

economy and abroad.

More generally, the COVID-19 pandemic continues to present the possibility of an extended global economic downturn and has caused volatility in financial markets, which could materially and adversely affect demand for our products and professional services and could materially and adversely impact our results and financial condition even after the pandemic is contained.

We will continue to evaluate the nature and extent of the impact of the COVID-19 pandemic on our business.

The full extent of the COVID-19 pandemic’s impact on our operations and financial performance depends on future developments that are uncertain and unpredictable, including the ultimate duration, spread and reemergence of the pandemic, including any new variants, its impact on capital and financial markets, the timing of economic recovery and any new information that may emerge concerning the severity of the virus, its spread to or reemergence in other geographic regions as well as the actions taken to contain it, including the distribution and acceptance of vaccines, among others.

Any of these impacts could have a material adverse impact on our business, results of operations and financial condition and ability to execute and capitalize on our strategies.

Our business and growth depend substantially on customers renewing their subscriptions with us.

14 unchanged sentences

In addition, we continue to invest in solutions that can be deployed on top of our platform to target specific use cases and to cultivate our community.

When we develop a new or enhanced version of an

existing offering, we typically incur expenses and expend resources upfront to market, promote and sell the new offering.

When we develop a new or enhanced version of an existing offering, we typically incur expenses and expend resources upfront to market, promote and sell the new offering.

Therefore, when we develop or acquire new or enhanced offerings, their introduction must achieve high levels of market acceptance in order to justify the amount of our investment in developing and bringing them to market.

For example, if our recent product expansions and offerings, such as our Cloud Security offerings, do not garner widespread market adoption and implementation, our financial results and competitive position could suffer.

For example, if our recent product expansions and offerings, such as our Cloud Security and Threat Intelligence offerings, do not garner widespread market adoption and implementation, our financial results and competitive position could suffer.

Further, we may make changes to our offerings that our customers do not like, find useful or agree with.

16 unchanged sentences

Our primary competitors in Vulnerability Risk Management include Qualys and Tenable;

in Incident Detection and Response (SIEM) include Splunk, Micro Focus, LogRhythm and Microsoft (Sentinel);

in Incident Detection and Response include Splunk, Micro Focus, LogRhythm and Microsoft (Sentinel);

in Application Security include Micro Focus and IBM;

in Security Orchestration and Automation Response include Phantom (Splunk) and Demisto (Palo Alto Networks);

in Cloud Security include Prisma (Palo Alto Networks) and CloudGuard (Check Point Software Technologies);

in Threat Intelligence include Recorded Future and Digital Shadows and finally, while the competition in our professional services business is diverse, our competitors include FireEye's Mandiant, SecureWorks and NCC Group.

in Security Orchestration and Automation Response include Splunk and Palo Alto Networks;

in Cloud Security include Palo Alto Networks and Check Point Software Technologies;

Some of our actual and potential competitors have advantages over us, such as longer operating histories, significantly greater financial, technical, marketing or other resources, stronger brand and business user recognition, larger and more mature intellectual property portfolios and broader global distribution and presence.

In addition, our industry is evolving rapidly and is becoming increasingly competitive.

Larger and more established companies may focus on security operations and could directly compete with us.

Larger and more established companies may focus on security operations and could

directly compete with us.

Smaller companies could also launch new products and services that we do not offer and that could gain market acceptance quickly.

6 unchanged sentences

Furthermore, our current and potential competitors may establish cooperative relationships among themselves or with third parties that may further enhance their resources and product and services offerings in the markets we address.

current or potential competitors may be acquired by third parties with greater available resources.

In addition, current or potential competitors may be acquired by third parties with greater available resources.

As a result of such relationships and acquisitions, our current or potential competitors might be able to adapt more quickly to new technologies and customer needs, devote greater resources to the promotion or sale of their products and services, initiate or withstand substantial price competition, take advantage of other opportunities more readily or develop and expand their product and service offerings more quickly than we do.

1 unchanged sentence

If our competitors are more successful than we are in developing new product and service offerings or in attracting and retaining customers, our business, financial condition and results of operations could be adversely affected.

If we fail to manage our operations infrastructure, our customers may experience service outages and/or delays.

If we are unable to successfully hire, train, and retain qualified personnel our business may suffer.

We continue to be substantially dependent on our sales force to obtain new customers and increase sales with existing customers.

Our ability to successfully pursue our growth strategy will also depend on our ability to attract, motivate and retain our personnel, especially those in sales, marketing and research and development.

In addition, in recent years, recruiting, hiring and retaining employees with expertise in the cybersecurity industry has become increasingly difficult as the demand for cybersecurity professionals has increased as a result of the recent cybersecurity attacks on global corporations and governments.

We face intense competition for these employees from numerous technology, software and other companies, especially in certain geographic areas in which we operate, and we cannot ensure that we will be able to attract, motivate and/or retain sufficient qualified employees in the future particularly in tight labor markets.

If we are unable to attract new employees and retain our current employees, we may not be able to adequately develop and maintain new products or professional services or market our existing products or professional services at the same levels as our competitors and we may, therefore, lose customers and market share.

Our failure to attract and retain personnel, especially those in sales and marketing and research and development positions for which we have historically had a high turnover rate, could have an adverse effect on our ability to execute our business objectives and, as a result, our ability to compete could decrease, our operating results could suffer and our revenue could decrease.

Even if we are able to identify and recruit a sufficient number of new hires, these new hires will require significant training before they achieve full productivity and they may not become productive as quickly as we would like or at all.

We believe that our corporate culture has been a critical component to our success.

We have invested substantial time and resources in building our team.

As we grow and mature as a public company, we may find it difficult to maintain our corporate culture.

Any failure to preserve our culture could negatively affect our future success, including our ability to attract, motivate and retain personnel and effectively focus on and pursue our business strategy.

Our sales cycle may be unpredictable.

The timing of sales of our offerings is difficult to forecast because of the length and unpredictability of our sales cycle, particularly with large enterprises and with respect to certain of our products.

We sell our products primarily to IT departments that are managing a growing set of user and compliance demands, which has increased the complexity of customer requirements to be met and confirmed during the sales cycle and prolonged our sales cycle.

Further, the length of time that potential customers devote to their testing and evaluation, contract negotiation and budgeting processes varies significantly, depending on the size of the organization and nature of the product or service under consideration.

In addition, we might devote substantial time and effort to a particular unsuccessful sales effort, and as a result, we could lose other sales opportunities or incur expenses that are not offset by an increase in revenue, which could harm our business.

If we fail to continue to effectively scale and manage our operations infrastructure, our customers may experience service outages and/or delays.

Our future growth is dependent upon our ability to continue to meet the expanding needs of our customers and to attract new customers.

7 unchanged sentences

Although we continue to introduce and acquire new products and professional services, we derive and expect to continue to derive a significant amount of our revenue from customers using certain of our vulnerability management offerings (“VM”), InsightVM, Nexpose and Metasploit.

Greater than half of our revenue was attributable to InsightVM, Nexpose and Metasploit in each of our last three fiscal years.

Approximately half of our revenue was attributable to InsightVM, Nexpose and Metasploit for the year ended December 31, 2021.

As a result, our operating results could suffer due to:

7 unchanged sentences

Our inability to renew or increase sales of our vulnerability management offerings, including cloud-based subscriptions, content subscriptions, managed services and content and maintenance and support subscriptions, or a decline in prices of our vulnerability management offerings would harm our business and operating results more seriously than if we derived significant revenues from a variety of offerings.

In addition, we have introduced several non-VM subscription products, including InsightAppSec, InsightConnect and InsightCloudSec (formerly known as DivvyCloud).

These products are relatively new, and it is uncertain whether they will gain the market acceptance we expect.

In addition, while we have introduced several non-VM subscription products, including InsightAppSec, InsightConnect, InsightCloudSec and Threat Intelligence, these products are relatively new, and it is uncertain whether they will gain the market acceptance we expect.

Any factor adversely affecting sales of our non-VM products or professional services, including release cycles, market acceptance, competition, performance and reliability, reputation and economic and market conditions, could adversely affect our business and operating results.

If we are unable to successfully hire, train, manage and retain qualified personnel, especially those in sales and marketing and research and development, our business may suffer.

We continue to be substantially dependent on our sales force to obtain new customers and increase sales with existing customers.

competitors and we may, therefore, lose customers and market share.

We believe that our corporate culture has been a critical component to our success.

We have invested substantial time and resources in building our team.

As we grow and mature as a public company, we may find it difficult to maintain our corporate culture.

A component of our growth strategy is dependent on our continued international expansion, which adds complexity to our operations.

We market and sell our products and professional services throughout the world and have personnel in many parts of the world.

For the nine months ended September 30, 2021 and 2020, operations located outside of North America generated 18% and 17%, respectively, of our revenue.

For the three months ended March 31, 2022 and 2021, operations located outside of North America generated 21% and 18%, respectively, of our revenue.

Our growth strategy is dependent, in part, on our continued international expansion.

5 unchanged sentences

• trade and foreign exchange restrictions;

• economic or political instability or uncertainty in foreign markets and around the world, such as related to Brexit;

• economic or political instability or uncertainty in foreign markets and around the world;

• foreign currency exchange rate fluctuations;

11 unchanged sentences

• costs associated with language localization of our products;

• increased exposure to natural disasters, acts of war, terrorism, epidemics, or pandemics and other health crises, including the ongoing COVID-19 pandemic;

• increased exposure to climate change, natural disasters, acts of war (including the armed conflict between Russia and Ukraine), terrorism, epidemics, or pandemics and other health crises, including the ongoing COVID-19 pandemic;

• costs of compliance with multiple and possibly overlapping tax structures.

Our business, including the sales of our products and professional services by us and our channel partners, may be subject to foreign governmental regulations, which vary substantially from country to country and change from time to time.

or the failure by our channel partners, to comply with these regulations could adversely affect our business.

Our failure, or the failure by our channel partners, to comply with these regulations could adversely affect our business.

Further, in many foreign countries it is common for others to engage in business practices that are prohibited by our internal policies and procedures or U.S.

2 unchanged sentences

Violations of laws or key control policies by our employees, contractors, channel partners or agents could result in delays in revenue recognition, financial reporting misstatements, fines, penalties or the prohibition of the importation or exportation of our products and could have a material adverse effect on our business and results of operations.

Further, in late February 2022, Russian military forces launched a significant military action against Ukraine.

While our business and operations have not been significantly impacted, it is not possible to predict the broader or longer-term consequences of this crisis.

Consequences of the crisis could include further sanctions, embargoes, regional instability, geopolitical shifts and adverse effects on macroeconomic conditions, security conditions, currency exchange rates and financial markets.

There can be no assurance that the armed conflict between Russia and the Ukraine, including any resulting sanctions, export controls or other restrictive actions, will not have a material adverse impact on our future operations and results.

If we are unable to successfully manage the challenges of international expansion and operations, our business and operating results could be adversely affected.

We are also monitoring developments related to Brexit.

Brexit could lead to economic and legal uncertainty, including significant volatility in global stock markets and currency exchange rates, and differing laws and regulations as the United Kingdom determines which European Union laws to replace or replicate.

In particular, although the United Kingdom enacted a Data Protection Act in May 2018 that is consistent with the EU General Data Protection Regulation, uncertainty remains regarding how data transfers to the United Kingdom will be regulated.

Any of these effects of Brexit, among others, could adversely affect our operations in the United Kingdom and our financial results.

We recognize a significant percentage of our revenue ratably over the term of our agreements with customers, and as a result, downturns or upturns in sales may not be immediately reflected in our operating results.

6 unchanged sentences

We also intend to increase our investment in research and development, sales and marketing, and general and administrative functions and other areas to grow our business.

We are likely to recognize the costs associated with these increased investments earlier than some of the anticipated benefits and the return on these investments may be lower, or may develop more slowly, than we expect, which could adversely affect our operating results.

We are likely to recognize the costs associated with these increased investments

earlier than some of the anticipated benefits and the return on these investments may be lower, or may develop more slowly, than we expect, which could adversely affect our operating results.

We may be unable to rapidly and efficiently adjust our cost structure in response to significant revenue declines, which could adversely affect our operating results.

6 unchanged sentences

Any failure by our customers to appropriately implement our products or any failure of our products to effectively integrate and operate within our customers’ IT infrastructures could result in customer dissatisfaction, impact the perceived reliability of our products, result in negative press coverage, negatively affect our reputation and harm our financial results.

Acquisitions could disrupt our business and harm our financial condition and operating results.

Our success in acquiring and integrating other businesses, products or technologies could impact our financial position.

In order to remain competitive, we have in the past and may in the future seek to acquire additional businesses, products or technologies.

1 unchanged sentence

Achieving the anticipated benefits of past or future acquisitions will depend in part upon whether we can integrate acquired operations, products and technology in a timely and cost-effective manner and successfully market and sell these as new product offerings, or as new features within our existing offerings.

For example, on January 28, 2021 we acquired Alcide.IO Ltd.

(Alcide), a Kubernetes cloud workload protection platform and on July 16, 2021, we acquired IntSights, a provider of

contextualized external threat intelligence and proactive threat remediation which were intended to extend the cloud security capabilities of our Insight Platform.

The integration of Alcide and IntSights and any other acquisition may prove to be difficult due to the necessity of coordinating geographically separate organizations and integrating personnel with disparate business backgrounds and accustomed to different corporate cultures and business operations and internal systems.

For example, on July 16, 2021, we acquired IntSights, a provider of contextualized external threat intelligence and proactive threat remediation which were intended to extend the cloud security capabilities of our Insight Platform.

The integration of IntSights and any other acquisition may prove to be difficult due to the necessity of coordinating geographically separate organizations and integrating personnel with disparate business backgrounds and accustomed to different corporate cultures and business operations and internal systems.

We may need to implement or improve controls, procedures, and policies at a business that prior to the acquisition may have lacked sufficiently effective controls, procedures and policies.

11 unchanged sentences

This guidance, which inherently consists of forward-looking statements, is also qualified by, and subject to, assumptions, estimates and expectations as of the date given.

Forward-looking statements are subject to a number of risks, uncertainties, assumptions and other factors that could cause actual results and the timing of certain events to differ materially from future results expressed or implied by the forward-looking statements including the risks described in this Risk Factors section and in the Risk Factors section of any future SEC filings we make.

the Risk Factors section of any future SEC filings we make.

It can be expected that some or all of the assumptions, estimates and expectations of any guidance we furnished will not materialize or will vary significantly from actual results.

3 unchanged sentences

There are no comparable recent events that provide guidance as to the probable effect of the COVID-19 pandemic, and, as a result, the ultimate impact of the COVID-19 outbreak is highly uncertain and subject to change.

We are relying on the reports and models of economic and medical experts in making assumptions relating to the duration of this crisis and predictions as to timing and pace of any future economic recovery.

If these models are incorrect or incomplete, or if we fail to accurately predict the full impact that the COVID-19 pandemic will have on all aspects of our business, the guidance and other forward-looking statements provided may also be incorrect or incomplete.

If we fail to accurately predict the full impact that the COVID-19 pandemic will have on all aspects of our business, the guidance and other forward-looking statements provided may also be incorrect or incomplete.

Furthermore, if we make downward revisions of our previously announced guidance, or if our publicly announced guidance of future operating results fails to meet expectations of securities analysts, investors or other interested parties, the price of our common stock would decline.

4 unchanged sentences

Our agreements with our channel partners are non-exclusive and do not prohibit them from working with our competitors or offering competing solutions, and some of our channel partners may have more established relationships with our competitors.

If our channel partners choose to place greater emphasis on products of their own or those offered by our competitors or do not effectively market and sell our products and

professional services, our ability to grow our business and sell our products and professional services, particularly in key international markets, may be adversely affected.

If our channel partners choose to place greater emphasis on products of their own or those offered by our competitors or do not effectively market and sell our products and professional services, our ability to grow our business and sell our products and professional services, particularly in key international markets, may be adversely affected.

In addition, our failure to recruit additional channel partners, or any reduction or delay in their sales of our products and professional services or conflicts between channel sales and our direct sales and marketing activities may harm our results of operations.

27 unchanged sentences

In the future, this software or data may not be available to us on commercially reasonable terms, or at all.

Any loss of the right to use any of this software or data could result in delays in the provisioning of our offerings until

equivalent technology or data is either developed by us, or, if available, is identified, obtained and integrated, which could harm our business.

Any loss of the right to use any of this software or data could result in delays in the provisioning of our offerings until equivalent technology or data is either developed by us, or, if available, is identified, obtained and integrated, which could harm our business.

In addition, any errors or defects in or failures of this third-party software could result in errors or defects in our products or cause our products to fail, which could harm our business and be costly to correct.

2 unchanged sentences

Any failure to do so could adversely impact our ability to deliver effective solutions to our customers and could harm our operating results.

Our products contain third-party open source software components, and our failure to comply with the terms of the underlying open source software licenses could restrict our ability to sell our products.

Our products contain software licensed to us by third parties under so-called “open source” licenses, including the GNU General Public License, the GNU Lesser General Public License, the BSD License, the Apache License and others.

From time to time, there have been claims against companies that distribute or use open source software in their products and services, asserting that such open source software infringes the claimants’ intellectual property rights.

We could be subject to suits by parties claiming that what we believe to be licensed open source software infringes their intellectual property rights.

Use and distribution of open source software may entail greater risks than use of third-party commercial software, as open source licensors generally do not provide warranties or other contractual protections regarding infringement claims or the quality of the code.

In addition, certain open source licenses require that source code for software programs that are subject to the license be made available to the public and that any modifications or derivative works to such open source software continue to be licensed under the same terms.

Although we monitor our use of open source software in an effort both to comply with the terms of the applicable open source licenses and to avoid subjecting our products to conditions we do not intend, the terms of many open source licenses have not been interpreted by U.S.

courts, and there is a risk that these licenses could be construed in a way that could impose unanticipated conditions or restrictions on our ability to commercialize our products.

The terms of certain open source licenses require us to release the source code of our applications and to make our applications available under those open source licenses if we combine or distribute our applications with open source software in a certain manner.

In the event that portions of our applications are determined to be subject to an open source license, we could be required to publicly release the affected portions of our source code, re-engineer all, or a portion of, those applications or otherwise be limited in the licensing of our applications.

Disclosing our proprietary source code could allow our competitors to create similar products with lower development effort and time and ultimately, could result in a loss of sales for us.

Disclosing the source code of our proprietary software could also make it easier for cyber attackers and other third parties to discover vulnerabilities in or to defeat the protections of our products, which could result in our products failing to provide our customers with the security they expect.

Any of these events could have a material adverse effect on our business, operating results and financial condition.

Our technology alliance partnerships expose us to a range of business risks and uncertainties that could have a material adverse impact on our business and financial results.

8 unchanged sentences

For example, many of our customers subscribe to our vulnerability management offerings to help them comply with the security standards developed and maintained by the Payment Card Industry Security Standards Council (the “PCI Council”), which apply to companies that process, transmit or store cardholder data.

In addition, our vulnerability management offerings are used by customers in the

health care industry to help them comply with numerous federal and state laws and regulations related to patient privacy.

In particular, HIPAA, and the 2009 Health Information Technology for Economic and Clinical Health Act include privacy standards that protect individual privacy by limiting the uses and disclosures of individually identifiable health information and implementing data security standards.

In addition, our vulnerability management offerings are used by customers in the health care industry to help them comply with numerous federal and state laws and regulations related to patient privacy.

particular, HIPAA, and the 2009 Health Information Technology for Economic and Clinical Health Act include privacy standards that protect individual privacy by limiting the uses and disclosures of individually identifiable health information and implementing data security standards.

The foregoing and other state, federal and international legal and regulatory regimes may affect our customers’ requirements for, and demand for, our products and professional services.

Governments and industry organizations, such as the PCI Council, may also adopt new laws, regulations or requirements, or make changes to existing laws or regulations, that could impact the demand for, or value of, our products.

If we are unable to adapt our products to changing legal and regulatory standards or other requirements in a timely manner, or if our products fail to assist with, or expedite, our customers’ cyber security defense and compliance efforts, our customers may lose confidence in our products and could switch to products offered by our competitors or threaten or bring legal actions against us.

If we are unable to adapt our products to changing legal and regulatory standards or other requirements in a timely manner, or if our products fail to assist with, or expedite, our customers’ cybersecurity defense and compliance efforts, our customers may lose confidence in our products and could switch to products offered by our competitors or threaten or bring legal actions against us.

In addition, if laws, regulations or standards related to data security, vulnerability management and other IT security and compliance requirements are relaxed or the penalties for non-compliance are changed in a manner that makes them less onerous, our customers may view government and industry regulatory compliance as less critical to their businesses, and our customers may be less willing to purchase our products.

5 unchanged sentences

Government demand and payment for our products and professional services may also be impacted by public sector budgetary cycles and funding authorizations, with funding reductions or delays adversely affecting public sector demand for our offerings.

Government entities also have heightened sensitivity surrounding the purchase of cyber security solutions due to the critical importance of their IT infrastructures, the nature of the information contained within those infrastructures and the fact that they are highly-visible targets for cyber attacks.

Government entities also have heightened sensitivity surrounding the purchase of cybersecurity solutions due to the critical importance of their IT infrastructures, the nature of the information contained within those infrastructures and the fact that they are highly-visible targets for cyber attacks.

Accordingly, increasing sales of our products and professional services to government entities may be more challenging than selling to commercial organizations.

4 unchanged sentences

dollar and we generate a majority of our revenue in U.S.

However, for the nine months ended September 30, 2021 and 2020 we incurred 15%, and 13%, respectively, of our expenses outside of the United States in foreign currencies, primarily the British pound sterling and euro, principally with respect to salaries and related personnel expenses associated with our sales and research and development operations.

Additionally, for the nine months ended September 30, 2021 and 2020, 9% and 8%, respectively, of our revenue was generated in foreign currencies.

However, for the three months ended March 31, 2022 and 2021 we incurred 19% and 14%, respectively, of our expenses outside of the United States in foreign currencies, primarily the British pound sterling and euro, principally with respect to salaries and related personnel expenses associated with our sales and research and development operations.

Additionally, for the three months ended March 31, 2022 and 2021, 10% and 9%, respectively, of our revenue was generated in foreign currencies.

Accordingly, changes in exchange rates may have an adverse effect on our business, operating results and financial condition.

3 unchanged sentences

dollar could increase the cost in local currency of our products and services to customers outside the United States, which could adversely affect our business, results of operations, financial condition and cash flows.

W e implemented a hedging program during 2020 and have entered into forward contracts designated as cash flow hedges in order to mitigate our exposure to foreign currency fluctuations resulting from certain operating expenses denominated in certain foreign currencies.

We implemented a hedging program during 2020 and have entered into forward contracts designated as cash flow hedges in order to mitigate our exposure to foreign currency fluctuations resulting from certain operating expenses denominated in certain foreign currencies.

These forward contracts and other hedging strategies such as options and foreign exchange swaps related to transaction exposures that we may implement to mitigate this risk in the future may not eliminate our exposure to foreign exchange fluctuations.

Changes in financial accounting standards may adversely impact our reported results of operations.

A change in accounting standards or practices could adversely affect our operating results and may even affect our reporting of transactions completed before the change is effective.

New accounting pronouncements and varying interpretations of accounting pronouncements have occurred and may occur in the future.

Changes to existing rules or the questioning of current practices may adversely affect our operating results.

We may require additional capital to support business growth, and this capital might not be available on acceptable terms, if at all.

We intend to continue to make investments to support our business growth and may require additional funds to respond to business challenges, including the need to develop new features or enhance our products, improve our operating infrastructure or acquire complementary businesses and technologies.

Accordingly, we may need to engage in equity or debt financings to secure additional funds.

If we raise additional funds through future issuances of equity or convertible debt securities, our existing stockholders could suffer significant dilution, and any new equity securities we issue could have rights, preferences and privileges superior to those of holders of our common stock.

Any debt financing that we may secure in the future could involve restrictive covenants relating to our capital raising activities and other financial and operational matters, which may make it more difficult for us to obtain additional capital and to pursue business opportunities, including potential acquisitions.

We may not be able to obtain additional financing on terms favorable to us, if at all.

For example, while the potential impact and duration of the COVID-19 pandemic on the global economy and our business in particular may be difficult to assess or predict, the pandemic has resulted in, and may continue to result in significant disruption of global financial markets, reducing our ability to access capital, which could in the future negatively affect our liquidity.

Although we expect that current cash and cash equivalent balances and cash flows that are generated from operations will be sufficient to meet our domestic and international working capital needs and other capital and liquidity requirements for at least the next 12 months, if we are unable to obtain adequate financing or financing on terms satisfactory to us if and when we require it, our ability to continue to support our business growth and to respond to business challenges could be significantly impaired, and our business may be adversely affected.

Risks Related to Intellectual Property, Litigation and Government Regulation

19 unchanged sentences

Such litigation could result in substantial costs and diversion of resources and could result in impairment or loss of portions of our intellectual property.

Furthermore, our efforts to enforce our intellectual property rights may be met with defenses, counterclaims and countersuits attacking the validity and enforceability of our intellectual property

Furthermore, our efforts to enforce our intellectual property rights may be met with defenses, counterclaims and countersuits attacking the validity and enforceability of our intellectual property rights.

Our failure to secure, protect and enforce our intellectual property rights could negatively affect our brand and adversely impact our business, operating results and financial condition.

21 unchanged sentences

Any of the foregoing events could seriously harm our business, financial condition and results of operations.

We could be subject to suits by parties claiming that what we believe to be licensed open source software infringes their intellectual property rights.

courts, and there is a risk that these licenses could be construed in a way that could impose unanticipated conditions or restrictions on our ability to commercialize our products.

Disclosing our proprietary source code could allow our competitors to create similar products with lower development effort and time and ultimately, could result in a loss of sales for us.

Likewise, some open source projects have known security and other vulnerabilities and architecture instabilities, or are otherwise subject to security attacks due to their wide availability, and are provided on an “as-is” basis.

Any of these events could have a material adverse effect on our business, operating results and financial condition.

We are subject to governmental export and import controls that could impair our ability to compete in international markets and/or subject us to liability if we are not in compliance with applicable laws.

7 unchanged sentences

Complying with export control laws and regulations, including obtaining the necessary licenses or authorizations, for a particular sale may be time-consuming, is not guaranteed and may result in the delay or loss of sales opportunities.

could also result in decreased use of our products by, or in our decreased ability to export or sell our products to, existing or potential customers.

Changes in export or import laws and regulations, shifts in the enforcement or scope of existing laws and regulations, or changes in the countries, governments, persons, products or services targeted by such laws and regulations, could also result in decreased use of our products by, or in our decreased ability to export or sell our products to, existing or potential customers.

For example, in response to the armed conflict between Russia and Ukraine, countries such as Canada, the

United Kingdom, the European Union, the United States and other countries and organizations have implemented new and stricter sanctions and export controls against officials, individuals, regions, and industries in Russia, Ukraine and Belarus.

Each country’s potential response to such sanctions, export controls, tensions, and military actions could damage or disrupt international commerce and the global economy and could have a material adverse effect on our business and results of operations or impact our ability to continue to operate in affected regions.

A decreased use of our products or limitation on our ability to export or sell our products could adversely affect our business, financial condition and results of operations.

17 unchanged sentences

federal, state, local and sales taxes in the United States and foreign income taxes, withholding taxes and transaction taxes in numerous foreign jurisdictions.

We generally conduct our international operations through wholly-owned subsidiaries and report our taxable income in various jurisdictions worldwide based upon our business operations in those juri sdictions.

Our intercompany relationships are and will continue to be subject to complex transfer pricing regulations administered by taxing authorities in various jurisdictions.

6 unchanged sentences

Real or perceived failures, errors or defects in our solutions could adversely affect our brand and reputation, which could have an adverse effect on our business and results of operations.

If our products or professional services fail to detect vulnerabilities in our customers’ cyber security infrastructure, or if our products or professional services fail to identify and respond to new and increasingly complex methods of cyber attacks, our business and reputation may suffer.

If our products or professional services fail to detect vulnerabilities in our customers’ cybersecurity infrastructure, or if our products or professional services fail to identify and respond to new and increasingly complex methods of cyber attacks, our business and reputation may suffer.

There is no guarantee that our products or professional services will detect all vulnerabilities and threats, especially in light of the rapidly changing security landscape to which we must respond, including the constantly evolving techniques used by attackers to access or sabotage data.

If we fail to update our solutions in a timely or

effective manner to respond to these threats, our customers could experience security breaches.

If we fail to update our solutions in a timely or effective manner to respond to these threats, our customers could experience security breaches.

Many federal, state and foreign governments have enacted laws requiring companies to notify individuals of data security breaches involving their personal data.

26 unchanged sentences

Prolonged delays or unforeseen difficulties in connection with adding capacity or upgrading our network architecture when required may cause our service quality to suffer.

Problems with the reliability or security of our systems or third-party systems on which we rely could harm our reputation.

Problems with the reliability or security of our systems or third-party systems

on which we rely could harm our reputation.

Damage to our reputation and the cost of remedying these problems could negatively affect our business, financial condition, and operating results.

2 unchanged sentences

Any disruptions or other performance problems with our products could harm our reputation and business and may damage our customers’ businesses.

Interruptions in our service delivery might reduce our revenue, cause us to issue credits to customers, subject us to potential liability and cause customers to not renew their purchases or our products.

Interruptions in our service delivery might reduce our revenue, cause us to issue credits to customers, due to our inability to meet stated service level commitments, subject us to potential liability and cause customers to not renew their purchases or our products.

If we or our third party service providers experience a security breach or unauthorized parties otherwise obtain access to our customers’ data, our reputation may be harmed, demand for our solutions may be reduced and we may incur significant liabilities.

We sell cyber security and data analytics products.

As a result, we have been and will be a target of cyber attacks designed to impede the performance of our products, penetrate our network security or the security of our cloud platform or our internal systems, or that of our customers, misappropriate proprietary information and/or cause interruptions to our services.

We sell cybersecurity and data analytics products.

As a result, we have been and will continue to be a target of cyber attacks designed to impede the performance of our products, penetrate our network security or the security of our cloud platform or our internal systems, or that of our customers, misappropriate proprietary information and/or cause interruptions to our services.

For example, because Metasploit serves as an introduction to hacking for many individuals, a successful cyber attack on us may be perceived as a victory for the cyber attacker, thereby increasing the likelihood that we may be a target of cyber attacks, even absent financial motives.

In addition, with so many of our employees now working remotely due to the global COVID-19 pandemic, we may face an increased risk of attempted security breaches and incidents.

Also, since many of our customers continue working remotely, we expect there will continue to be an increased amount of personal, confidential and proprietary information that is stored in our solutions, which increases the exposure and risk of cyberattacks and other malicious internet-based activity.

While we have taken steps to protect such information that we have access to, including information we may obtain through our customer support services or customer usage of our offerings, our security measures or those of our third-party service providers could be breached or otherwise fail to prevent unauthorized access to or disclosure, modification, misuse, loss or destruction of such information.

Computer malware, viruses, social engineering (phishing attacks), and increasingly sophisticated network attacks have become more prevalent in our industry, particularly against cloud services.

We also process, store and transmit our own data as part of our business and operations, including personal, confidential or proprietary information.

As many of our customers and employees will continue to work remotely, we expect there will continue to be an increased amount of such information that is stored in our solutions, which increases the exposure and risk of attempted security breaches, cyberattacks and other malicious internet-based activity.

Additionally, we make use of third-party technology and systems for a variety of reasons, including, without limitation, encryption and authentication technology, employee email, content delivery to customers, back-office support, credit card processing, customer relationship management, human resources services and other functions.

Computer malware, ransomware, cyber viruses, social engineering (phishing attacks), supply-chain attacks, denial of service or other attacks, employee theft or misuse and increasingly sophisticated network attacks have become more prevalent in our industry, particularly against cloud services.

In particular, ransomware attacks, including by organized criminal threat actors, nation-states, and nation-state-supported actors, are becoming increasingly prevalent and severe and can lead to significant interruptions in our operations, loss of data and income, reputational harm, and diversion of funds.

While extortion payments may alleviate the negative impact of a ransomware attack, we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments.

Similarly, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties and infrastructure in our supply chain or our third-party partners’ supply chains have not been compromised or that they do not contain exploitable defects or bugs that could result in a breach of or disruption to our information technology systems (including our products) or the third-party information technology systems that support us and our services.

Such attacks may also include exploitation of vulnerabilities in third party or open source software code that may be incorporated into our own or our customers’ or supplier’s systems, such as the vulnerability in the Java logging library known as “log4j” identified in late 2021 that affected many in our industry.

Further, if our systems or those of our third-party service providers are breached as a result of third-party action, employee error or misconduct, attackers could learn critical information about how our products operate to help protect our customers’ IT infrastructures from cyber risk, thereby making our customers more vulnerable to cyber attacks.

We also process, store and transmit our own data as part of our business and operations.

This data may include personal, confidential or proprietary information.

We make use of third-party technology and systems for a variety of reasons, including, without limitation, encryption and authentication technology, employee email, content delivery to customers, back-office support, credit card processing, human resources services, customer relationship management, enterprise risk planning and other functions.

Although we have developed systems and processes that are designed to protect customer information and prevent data and financial loss and other security breaches and incidents, and to reduce the impact of a security breach or incident at a third-party vendor, such measures cannot provide absolute security.

There can be no assurance that any security measures that we or our third-party service providers have implemented will be effective against current or future security threats.

While we maintain measures designed to protect the integrity, confidentiality and security of our data, our security measures could fail and those of our third-party service providers have failed and could fail, any of which could result in unauthorized access to or disclosure, modification, misuse, loss or destruction of such data or financial loss.

Any security breach or other security incident, or the perception that one has occurred, could result in a loss of customer confidence in the security of our offerings and damage to our brand, reduce the demand for our offerings, disrupt normal business operations, require us to spend material resources to investigate or correct the breach and to prevent future security breaches and incidents, expose us to legal liabilities, including litigation, regulatory enforcement, and indemnity obligations, and adversely affect our revenues and operating results.

Additionally, the growth in state sponsored cyber activity, including those actions taken in connections with the armed conflict in Russia and Ukraine, demonstrates the increasing sophistication and evolution of cyber threats.

As a result, we may be unable to anticipate the techniques used or implement adequate measures to prevent an electronic intrusion into our customers through our cloud platform or to prevent breaches and other security incidents affecting our cloud platform, internal networks, systems or data.

Further, once identified, we may be unable to remediate or otherwise respond to a breach or other incident in a timely manner.

Actual or perceived security breaches of our cloud platform could result in actual or perceived breaches of our customers’ networks and systems.

Since our business is focused on providing reliable security solutions to our customers, a security breach or other security incident, or the perception that one has occurred, could result in a loss of customer confidence in the security of our offerings

and damage to our brand, reduce the demand for our offerings, disrupt normal business operations, require us to spend material resources to investigate or correct the breach and to prevent future security breaches and incidents, expose us to legal liabilities, including litigation, regulatory enforcement, and indemnity obligations, and adversely affect our revenues and operating results.

These risks may increase as we continue to grow the number and scale of our cloud services, and process, store, and transmit increasing amounts of data.

1 unchanged sentence

The successful assertion of one or more large claims against us that exceed available insurance coverage, or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, could have a material adverse effect on our business, including our financial condition, operating results, and reputation.

If Metasploit were to be used by attackers to exploit vulnerabilities in the cyber security infrastructures of third parties, our reputation and business could be harmed.

Although Metasploit is a penetration testing tool that is intended to allow organizations to test the effectiveness of their cyber security programs, Metasploit has in the past and may in the future be used to exploit vulnerabilities in the cyber security infrastructures of third parties.

If Metasploit were to be used by attackers to exploit vulnerabilities in the cybersecurity infrastructures of third parties, our reputation and business could be harmed.

Although Metasploit is a penetration testing tool that is intended to allow organizations to test the effectiveness of their cybersecurity programs, Metasploit has in the past and may in the future be used to exploit vulnerabilities in the cybersecurity infrastructures of third parties.

While we have incorporated certain features into Metasploit to deter misuse, there is no guarantee that these controls will not be circumvented or that Metasploit will only be used defensively or for research purposes.

Any actual or perceived security breach, malicious intrusion or theft of sensitive data in which Metasploit is believed to have been used could adversely affect perception of, and demand for, our offerings.

Further, the identification of new exploits and

vulnerabilities by the Metasploit community may enhance the knowledge base of cyber attackers or enable them to undertake new forms of attacks.

Further, the identification of new exploits and vulnerabilities by the Metasploit community may enhance the knowledge base of cyber attackers or enable them to undertake new forms of attacks.

If any of the foregoing were to occur, we could suffer negative publicity and loss of customers and sales, as well as possible legal claims.

Because our products collect and store user and related information, domestic and international privacy and cyber security concerns, and other laws and regulations, could result in additional costs and liabilities to us or inhibit sales of our products.

We, and our customers, are subject to a number of domestic and international laws and regulations that apply to online services and the internet generally.

These laws, rules and regulations address a range of issues including data privacy and cyber security, and restrictions or technological requirements regarding the collection, use, storage, protection, retention or transfer of data.

The regulatory framework for online services, data privacy and cyber security issues worldwide can vary substantially from jurisdiction to jurisdiction, is rapidly evolving and is likely to remain uncertain for the foreseeable future.

Many federal, state and foreign government bodies and agencies have adopted or are considering adopting laws, rules and regulations regarding the collection, use, storage and disclosure of information, web browsing and geolocation data collection, data analytics, cyber security and breach notification procedures.

Interpretation of these laws, rules and regulations and their application to our products and professional services in the United States and foreign jurisdictions is ongoing and cannot be fully determined at this time.

In the United States, these include rules and regulations promulgated under the authority of the Federal Trade Commission, the Electronic Communications Privacy Act, Computer Fraud and Abuse Act, the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the Gramm Leach Bliley Act and state breach notification laws, as well as regulator enforcement positions and expectations reflected in federal and state regulatory actions, settlements, consent decrees and guidance documents.

In June 2018, California enacted the California Consumer Privacy Act (CCPA), which took effect on January 1, 2020.

The CCPA requires a broad range of companies that do business in California to honor the requests of California residents to access and require deletion of their personal information, opt out of certain personal information sharing and receive detailed information about how their personal information is used and shared.

The CCPA provides for civil penalties of up to $7,500 for violations, and a private right of action for data breaches that allows private plaintiffs to seek the greater of actual damages or statutory damages of up to $750 per affected consumer per data breach.

These statutory remedies are expected to prompt an increase in data breach litigation and the cost to resolve it.

The CCPA has prompted a number of proposals for new federal and state privacy legislation in the United States that, if passed, could increase our potential liability, increase our compliance costs and adversely affect our business.

Internationally, virtually every jurisdiction in which we operate has established its own data security and privacy legal frameworks with which we, and/or our customers, must comply, including the European Union's General Data Protection Regulation, (EU) 2016/679 (GDPR), laws implemented by European Union (EU) member states which contain derogations from, or exemptions or authorizations for the purposes of, the GDPR, or which are otherwise intended to supplement the GDPR and, following the withdrawal in the United Kingdom (UK), the so-called ‘UK GDPR’ (i.e., the GDPR as it continues to form part of UK law by virtue of section 3 of the European Union (Withdrawal) Act 2018, as amended (including by the various Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations) (European Data Protection Laws).

Because our products collect and store user and related information, domestic and international privacy and cybersecurity concerns, and other laws and regulations, could have a material adverse effect on our business.

We, and our customers, are subject to a number of stringent and changing obligations in domestic and international laws, regulations, guidance, industry standards, external and internal policies and contracts and other obligations that address a range of issues including data privacy and cybersecurity, and restrictions or technological requirements regarding the collection, use, storage, protection, retention or transfer of data.

The regulatory framework for online services, data privacy and cybersecurity issues worldwide can vary substantially from jurisdiction to jurisdiction, is rapidly evolving and is likely to remain uncertain for the foreseeable future.

This creates some uncertainty as to the effective legal frameworks and our obligations may be subject to differing applications and interpretations, which may be inconsistent or in conflict among jurisdictions.

Preparation for and compliance with these obligations requires us to devote significant resources (including, without limitation, financial and time-related resources).

These obligations may necessitate changes to our business including our information technologies, systems and practices and to those of any third parties that process personal data on our behalf.

Although we strive to comply with all applicable data privacy and security obligations, we may at times fail (or be perceived to have failed) to do so.

Moreover, despite our efforts, our personnel or third parties upon whom we rely may fail to comply with such obligations.

If we (or third parties upon whom we rely) fail, or are perceived to have failed, to address and comply with data privacy and security obligations, we could face significant consequences.

These consequences may include but are not limited to:

government enforcement actions (e.g., investigations, fines, penalties, audits, inspections and similar consequences);

litigation (including class-related claims);

additional reporting requirements and oversight;

bans on processing personal data;

orders to destroy and not to use personal data;

and imprisonment of company officials.

Any of these events could have a material adverse effect on our reputation and our business, and financial condition, including but not limited to:

loss of customers;

interruptions or stoppages in our business or operations;

inability to process personal data;

inability to operate in specific jurisdictions;

limitations in our ability to develop our products and professional services;

management's time and other resource expenditures;

adverse publicity;

and revisions to our operations.

In the United States, federal, state and local governments have enacted numerous data privacy and cybersecurity laws (including data breach notification laws, personal data privacy laws and consumer protection laws).

For example, the California Consumer Privacy Act of 2018 (“CCPA”), imposes obligations on businesses to which it applies.

These obligations include but are not limited to providing specific disclosures in privacy notices and affording California residents certain rights related to their personal data.

The CCPA allows for statutory fines for non-compliance (up to $7,500 per violation).

Other states have proposed data privacy laws.

If we become subject to new data privacy or security laws, the risk of enforcement action against us could increase because we may become subject to additional obligations, and the number of individuals or entities that can initiate actions against us may increase (including individuals, via a private right of action, and state actors).

Internationally, virtually every jurisdiction in which we operate has established its own data security and cyberprivacy legal frameworks with which we, and/or our customers, must comply, including the European Union's General Data Protection Regulation, 2016/679 (“GDPR”), laws implemented by European Union (“EU”) member states and, following the withdrawal of the United Kingdom (“UK”) from the EU, the so-called ‘UK GDPR’ (“European Data Protection Laws”).

The UK’s decision to leave the EU and ongoing developments in the UK have created uncertainty with regard to data protection regulation in the UK.

Going forward, there may be an increasing scope for divergence in the application, interpretation and enforcement of data protection laws as between the UK and EU.

The European Data Protection Laws present significantly greater risks, compliance burdens and costs for companies with users and operations in the EU and UK.

6 unchanged sentences

We could be adversely affected if legislation or regulations are expanded to require changes in our business practices or if governing jurisdictions interpret or implement their legislation or regulations in ways that negatively affect our business, results of operations or financial condition.

European Data Protection Laws generally prohibit the transfer of personal data from the European Economic Area (EEA), the UK and Switzerland (Europe), to the United States and most other countries unless the parties to the transfer have implemented specific safeguards to protect the transferred personal data.

One of the primary safeguards used for transfers of personal data from Europe to the United States was the Privacy Shield framework which is administered by the U.S.

Department of Commerce.

To facilitate the transfer of both customer and employee personal data from Europe to the United States, we self-certified under the EU-US Privacy Shield framework on December 20, 2016.

However, this framework was invalidated by a decision of the EU’s highest court in July 2020 and authorities in the UK and Switzerland have similarly invalidated use of the Privacy Shield as a vehicle for lawful data transfers from those countries to the United States.

The same decision also required

parties using one of the primary alternatives to the Privacy Shield, namely, the European Commission’s Standard Contractual Clauses (SCCs), to lawfully transfer personal data from Europe to the United States and most other countries, to adopt additional safeguards to protect personal data being transferred.

In addition, certain jurisdictions have enacted data localization laws and cross-border personal data transfer laws.

For example, European Data Protection Laws generally prohibit the transfer of personal data from the European Economic Area (“EEA”) and, the UK and Switzerland (collectively, “Europe”), to most other non-European countries unless the parties to the transfer have implemented specific safeguards to protect the transferred personal data.

In particular, government regulators in Europe have found that the United States does not provide an adequate level of data privacy and cybersecurity protection and although there are legal mechanisms to allow for the transfer of personal data from Europe to the United States, uncertainty remains about compliance and such mechanisms may not be available or applicable with respect to our personal data processing activities.

For example, the “Standard Contractual Clauses” (“SCCs) that are designed to be a valid mechanism by which parties can transfer personal data out of Europe to jurisdictions that are not found to provide an adequate level of protection, must be assessed on a case-by-case basis taking into account the legal regime applicable in the destination country.

Specifically, the parties to the cross-border personal data transfer must evaluate the importing jurisdiction’s laws and implement supplemental security measures as necessary to protect the at-issue personal data.

It is likely that there will continue to be some uncertainty regarding the mechanisms by which parties transfer personal data out of Europe to jurisdictions such as the United States.

At present, there are few if any viable alternatives to the SCCs.

As such, our transfer and processing of personal data from Europe may not comply with European Data Protection Law.

This may increase our exposure to the GDPR’s and UK GDPR’s heightened sanctions for violations of its cross-border data transfer restrictions, including injunctions against transferring personal data subject to the GDPR and UK GDPR.

If we cannot implement and maintain a valid mechanism for cross-border personal data transfers, we may face increased exposure to regulatory actions, substantial fines and injunctions against processing (including prohibitions on transferring personal data out of the EU and UK).

This may also reduce demand for our services from companies subject to European Data Protection Laws.

Loss of our ability to import personal data from the EU and UK may also require us to increase our data processing capabilities in the EEA at significant expense.

Although by virtue of the UK GDPR, the GDPR applies in the UK in substantially unvaried form, going forward there will be increasing scope for divergence in application, interpretation and enforcement between the UK and the EU and such divergence could jeopardize the European Commission's adequacy decision in respect of the UK allowing transfers of personal data to the UK from EU member states for a period of four years.

Additionally, other countries outside of Europe have enacted or are considering enacting similar cross-border data transfer restrictions and laws requiring local data residency, which could increase the cost and complexity of delivering our services and operating our business.

In addition to government regulation, privacy advocates and industry groups may propose new and different self-regulatory standards that either legally or contractually apply to us.

Because the interpretation and application of privacy and data protection laws are still uncertain, it is possible that these laws may be interpreted and applied in a manner that is inconsistent with our existing practices or the features of our products.

We may also be subject to claims of liability or responsibility for the actions of third parties with whom we interact or upon whom we rely in relation to various services, including but not limited to vendors and business partners.

If so, in addition to the possibility of fines, lawsuits and other claims, we could be required to fundamentally change our business activities and practices or modify our products, which could have an adverse effect on our business.

Any inability to adequately address privacy concerns, even if unfounded, or comply with applicable privacy or data protection laws, regulations and policies, could result in additional cost and liability to us, damage our reputation, inhibit sales and adversely affect our business.

The costs of compliance with, and other burdens imposed by, the laws, rules, regulations and policies that are applicable to the businesses of our customers may limit the use and adoption of, and reduce the overall demand for, our software.

Privacy or cyber security concerns, whether valid or not valid, may inhibit market adoption of our products particularly in certain industries and foreign countries.

Privacy or cybersecurity concerns, whether valid or not valid, may inhibit market adoption of our products particularly in certain industries and foreign countries.

Further, there are active legislative discussions regarding the implementation of laws or regulations that could restrict the manner in which security research is conducted and that could restrict or possibly bar the conduct of penetration testing and the use of exploits, which are an essential component of our Metasploit product and our business strategy more generally.

1 unchanged sentence

Organizations may be reluctant to purchase our cloud-based offerings due to the actual or perceived vulnerability of cloud solutions.

Some organizations have been reluctant to use cloud solutions for cyber security, such as our InsightVM, InsightIDR, InsightAppSec, InsightConnect and InsightCloudSec (formerly known as DivvyCloud), because they have concerns regarding the risks associated with the reliability or security of the technology delivery model associated with this solution.

Some organizations have been reluctant to use cloud solutions for cybersecurity, such as our InsightVM, InsightIDR, InsightAppSec, InsightConnect, InsightCloudSec and Threat Intelligence, because they have concerns regarding the risks associated with the reliability or security of the technology delivery model associated with this solution.

If we or other cloud service providers experience security incidents, breaches of customer data, disruptions in service delivery or other problems, the market for cloud solutions as a whole may be negatively impacted, which could harm our business.

2 unchanged sentences

The market price of our common stock may be highly volatile and may fluctuate substantially as a result of a variety of factors, some of which are related in complex ways.

Since shares of our common stock were sold in our initial public offering, or IPO, in July 2015 at a price of $16.00 per share, our stock price has ranged from an intraday low of $9.05 to an intraday high of $130.17 through October 31, 2021.

Since shares of our common stock were sold in our initial public offering (“IPO”), in July 2015 at a price of $16.00 per share, our stock price has ranged from an intraday low of $9.05 to an intraday high of $145.00 through April 29, 2022.

Factors that may affect the market price of our common stock include:

13 unchanged sentences

• general economic, regulatory and market conditions.

Recently, the stock markets, and in particular the market on which our common stock is listed, have experienced extreme price and volume fluctuations that have affected and continue to affect the market prices of equity securities of many companies due to, among other factors, the actions of market participants or other actions outside of our control, including general market volatility caused by the COVID-19 pandemic.

Recently, the stock markets, and in particular the market on which our common stock is listed, have experienced price and volume fluctuations that have affected and continue to affect the market prices of equity securities of many companies due to, among other factors, the actions of market participants or other actions outside of our control, including general market volatility caused by the COVID-19 pandemic.

These fluctuations have often been unrelated or disproportionate to the operating performance of those companies.

14 unchanged sentences

In the future, we may sell additional shares of our common stock or equity-linked securities to raise capital.

In addition, a substantial number of shares of our common stock is reserved for issuance upon the exercise of stock options, settlement of other equity incentive awards and upon conversion of the Notes.

In addition, a substantial number of shares of our common stock is reserved for issuance upon the exercise of stock options, settlement of

other equity incentive awards and upon conversion of the Notes.

The indentures for the Notes do not restrict our ability to issue additional common stock or equity-linked securities in the future.

4 unchanged sentences

We may not have sufficient cash flow from our business to pay our substantial debt when due.

In August 2018, we issued $230.0 million aggregate principal amount of the 2023 Notes, in May 2020, we issued $230.0 million aggregate principal amount of 2025 Notes and in March 2021, we issued $600.0 million aggregate principal amount of

2027 Notes (collectively, the Notes).

In March 2021, concurrently with the issuance of the 2027 Notes, we used $182.6 million of the proceeds from the issuance of the 2027 Notes to repurchase and retire $182.6 million aggregate principal amount of the 2023 Notes.

In addition, we may also incur indebtedness under our senior secured credit facility.

In May 2020, we issued $230.0 million aggregate principal amount of 2025 Notes and in March 2021, we issued $600.0 million aggregate principal amount of 2027 Notes (collectively, the (“Notes”).

In addition, we may also incur indebtedness under our revolving credit facility.

Our indebtedness may:

6 unchanged sentences

Further, the indentures governing the Notes do not restrict our ability to incur additional indebtedness, secure existing or future debt, recapitalize our existing or future debt or take a number of other actions that could intensify the risks discussed above and below.

Further, we and our subsidiaries may incur substantial additional indebtedness in the future, subject to the restrictions contained in our senior secured credit facility and any future debt instruments existing at the time, some of which may be secured indebtedness.

While our senior secured credit facility restricts our ability to incur additional indebtedness, if our senior secured credit facility is terminated, we may not be subject to such restriction under the terms of such indebtedness.

Further, we and our subsidiaries may incur substantial additional indebtedness in the future, subject to the restrictions contained in our revolving credit facility and any future debt instruments existing at the time, some of which may be secured indebtedness.

While our revolving credit facility restricts our ability to incur additional indebtedness, if our revolving credit facility is terminated, we may not be subject to such restriction under the terms of such indebtedness.

Our ability to pay our debt when due or to refinance our indebtedness, including the Notes, depends on our future performance, which is subject to economic, financial, competitive, and other factors beyond our control.

4 unchanged sentences

We may not be able to engage in any of these activities or engage in these activities on desirable terms, which could result in a default on our debt obligations.

In addition, our senior secured credit facility contains, and any future additional indebtedness that we may incur may contain, financial and other restrictive covenants that limit our ability to operate our business, raise capital, pay dividends and/or make payments under our other indebtedness.

In addition, our revolving credit facility contains, and any future additional indebtedness that we may incur may contain, financial and other restrictive covenants that limit our ability to operate our business, raise capital, pay dividends and/or make payments under our other indebtedness.

If we fail to comply with these covenants or to make payments under our indebtedness when due, then we would be in default under that indebtedness, which could, in turn, result in that and our other indebtedness becoming immediately payable in full.

Any such event of default under our senior secured credit facility would give the lenders the right to terminate their commitments to provide additional loans under our senior secured credit facility and to declare any and all borrowings outstanding, together with accrued and unpaid interest and fees, to be immediately due and payable.

In addition, the lenders under our senior secured credit facility would have the right to proceed against the collateral in which we granted a security interest to them, which consists of substantially all our assets.

If the debt under our senior secured credit facility were to be accelerated, we may not have sufficient cash or be able to borrow sufficient funds to refinance the debt or sell sufficient assets to repay the debt, which could immediately materially and adversely affect our cash flows, business, results of operations, financial condition and our ability to make payments under our indebtedness, including the Notes, when due.

Any such event of default under our revolving credit facility would give the lenders the right to terminate their commitments to provide additional loans under our revolving credit facility and to declare any and all borrowings outstanding, together with accrued and unpaid interest and fees, to be immediately due and payable.

In addition, the lenders under our revolving credit facility would have the right to proceed against the collateral in which we granted a security interest to them, which consists of substantially all our assets.

If the debt under our revolving credit facility were to be accelerated, we may not have sufficient cash or be able to borrow sufficient funds to refinance the debt or sell sufficient assets to repay the debt, which could immediately materially and adversely affect our cash flows, business, results of operations, financial condition and our ability to make payments under our indebtedness, including the Notes, when due.

Further, the terms of any new or additional financing may be on terms that are more restrictive or on terms that are less desirable to us.

2 unchanged sentences

If one or more holders elect to convert their Notes, unless we elect to satisfy our conversion obligation by delivering solely shares of our common stock (other than paying cash in lieu of delivering any fractional share), we would be required to settle a portion or all of our conversion obligation in cash, which could adversely affect our liquidity.

As disclosed in Note 10 to our unaudited consolidated financial statements, the conditional conversion features of the 2023 Notes and the 2025 Notes were triggered as of September 30, 2021, and the 2023 Notes and 2025 Notes are convertible at the option of the holders, in whole or in part, between October 1, 2021 and December 31, 2021.

During the first quarter of 2021, an immaterial principal amount of the 2023 Notes was requested for conversion, which was settled during the second quarter of 2021.

Whether the 2025 Notes will be convertible following such fiscal quarter will depend on the continued satisfaction of this condition or another conversion condition in the future.

On September 16, 2021, we issued a notice of

redemption for the remaining $45.4 million aggregate principal amount outstanding of the 2023 Notes.

Pursuant to the redemption notice, on the redemption date of November 30, 2021, we will redeem any 2023 Notes that have not been converted prior to such date at a redemption price in cash equal to 100% of the principal amount of such notes, plus accrued and unpaid interest, if any, from August 1, 2021 to, but not including, the redemption date.

We have classified the 2023 Notes as a current liability on our consolidated balance sheet as of September 30, 2021 as we expect to redeem these 2023 Notes on the November 30, 2021 redemption date.

As of September 30, 2021, the 2027 Notes are not convertible at the option of the holder.

As disclosed in Note 10, Debt , to our consolidated financial statements, the conditional conversion features of the 2025 Notes were triggered as of March 31, 2022, and the 2025 Notes are convertible at the option of the holders, in whole or in part, between April 1, 2022 and June 30, 2022.

Whether the 2025 Notes will be convertible following the fiscal quarter ending June 30, 2022, will depend on the continued satisfaction of this condition or another conversion condition in the future.

As of March 31, 2022, the 2027 Notes are not convertible at the option of the holder.

In addition, even if holders of Notes do not elect to convert their Notes, we could be required under applicable accounting rules to reclassify all or a portion of the outstanding principal of the Notes as a current rather than long-term liability, which would result in a material reduction of our net working capital.

The phaseout of LIBOR, or the replacement of LIBOR with a different reference rate, may adversely affect interest rates.

On July 27, 2017, the Financial Conduct Authority (the authority that regulates LIBOR) announced that it would phase out LIBOR by the end of 2021.

It is unclear whether new methods of calculating LIBOR will be established such that it continues to exist after 2021, or if alternative rates or benchmarks will be adopted.

Changes in the method of calculating LIBOR, or the replacement of LIBOR with an alternative rate or benchmark, may adversely affect interest rates and result in higher borrowing costs.

This could materially and adversely affect our results of operations, cash flows and liquidity.

We cannot predict the effect of the potential changes to LIBOR or the establishment and use of alternative rates or benchmarks.

We may need to renegotiate our senior secured credit facility or incur other indebtedness, and changes in the method of calculating LIBOR, or the use of an alternative rate or benchmark, may negatively impact the terms of such indebtedness.

If changes are made to the method of calculating LIBOR or LIBOR ceases to exist, we may need to amend certain contracts, including our senior secured credit facility, and we cannot predict what alternative rate or benchmark would be negotiated.

This may result in an increase to our interest expense.

The capped call transactions may affect the value of the Notes and our common stock.

In connection with the pricing of the Notes and the exercise by the initial purchasers of their option to purchase additional Notes, we entered into capped call transactions with certain counterparties (Capped Calls).

The Capped Calls cover, subject to customary adjustments, the number of shares of our common stock initially underlying the Notes.

The Capped Calls are expected to offset the potential dilution as a result of conversion of the Notes.

In connection with establishing their initial hedge of the capped call transactions, the counterparties or their respective affiliates entered into various derivative transactions with respect to our common stock concurrently with or shortly after the pricings of the Notes, including with certain investors in the Notes.

The counterparties and/or or their respective affiliates may modify or unwind their hedge positions by entering into or unwinding various derivatives with respect to our common stock and/or purchasing or selling our common stock or other securities of ours in secondary market transactions prior to the maturity of the Notes (and are likely to do so on each exercise date of the capped call transactions, which are scheduled to occur during the applicable observation period relating to any conversion of the 2023 Notes on or after February 1, 2023, relating to any conversion of the 2025 Notes on or after November 1, 2024 or relating to any conversion of the 2027 Notes on or after December 15, 2026, in each case that is not in connection with a redemption).

In connection with the issuance of the 2023 Notes, the 2025 Notes and the 2027 Notes, we entered into capped call transactions with certain counterparties (the “Capped Calls”).

The Capped Calls cover, subject to customary adjustments, the number of shares of our common stock initially underlying each of the 2023 Notes, the 2025 Notes and the 2027 Notes.

The Capped Calls are expected to offset the potential dilution as a result of conversion of such Notes.

In connection with establishing their initial hedge of the capped call transactions, the counterparties or their respective affiliates entered into various derivative transactions with respect to our common stock concurrently with or shortly after the pricings of the respective Notes, including with certain investors in the applicable Notes.

The counterparties and/or or their respective affiliates may modify or unwind their hedge positions by entering into or unwinding various derivatives with respect to our common stock and/or purchasing or selling our common stock or other securities of ours in secondary market transactions prior to the maturity of the applicable Notes (and are likely to do so on each exercise date of the capped call transactions, which are scheduled to occur during the applicable observation period relating to any conversion of the 2025 Notes on or after November 1, 2024 or relating to any conversion of the 2027 Notes on or after December 15, 2026, in each case that is not in connection with a redemption).

We redeemed the 2023 Notes in November 2021.

As described elsewhere in this Quarterly Report on Form 10-Q, the 2023 capped calls were not redeemed with the redemption of the 2023 Notes.

We cannot make any prediction as to the direction or magnitude of any potential effect that the transactions described above may have on the prices of the Notes or the shares of our common stock.

10 unchanged sentences

If a fundamental change occurs prior to the maturity date of the Notes, holders of the Notes, will have the right, at their option, to require us to repurchase all or a portion of their Notes.

In addition, if a “make-whole fundamental change” (as defined in the

indentures) occurs prior the maturity date, we will in some cases be required to increase the conversion rate of the Notes for a holder that elects to convert its Notes in connection with such make-whole fundamental change.

In addition, if a “make-whole fundamental change” (as defined in the indentures) occurs prior the maturity date, we will in some cases be required to increase the conversion rate of the Notes for a holder that elects to convert its Notes in connection with such make-whole fundamental change.

Furthermore, the indentures governing the Notes prohibit us from engaging in certain mergers or acquisitions unless, among other things, the surviving entity assumes our obligations under the Notes.

2 unchanged sentences

The conversion of some or all of the Notes will dilute the ownership interests of existing stockholders to the extent we deliver shares of our common stock upon conversion of any of the Notes.

As disclosed in Note 10 to our consolidated financial statements, the conditional conversion features of the 2023 Notes and the 2025 Notes were triggered as of September 30, 2021, and the 2023 Notes and the 2025 Notes are convertible at the option of the holders, in whole or in part, between October 1, 2021 and December 31, 2021.

On September 16, 2021, we issued a notice of redemption for the remaining $45.4 million aggregate principal amount outstanding of the 2023 Notes.

Whether the 2025 Notes will be convertible following the fiscal quarter from October 1, 2021 and December 31, 2021 will depend on the continued satisfaction of the applicable conversion condition or another conversion condition in the future.

As of September 30, 2021, the 2027 Notes are not convertible at the option of the holder.

Whether the 2025 Notes will be convertible following the fiscal quarter from April 1, 2022 and June 30, 2022 will depend on the continued satisfaction of the applicable conversion condition or another conversion condition in the future.

As of March 31, 2022, the 2027 Notes are not convertible at the option of the holder.

Any sales in the public market of the common stock issuable upon such conversion could adversely affect prevailing market prices of our common stock.

8 unchanged sentences

Enforcement actions and sanctions could harm our business, reputation, results of operations and financial condition.

Our business is subject to the risks of pandemics, earthquakes, fire, power outages, floods and other catastrophic events, and to interruption by manmade problems such as terrorism.

A significant public health crisis, epidemic or pandemic (including the ongoing COVID-19 pandemic), or a natural disaster, such as an earthquake, fire or a flood, or a significant power outage could have a material adverse impact on our business, operating results and financial condition.

In addition, public health crises or natural disasters could affect our channel partners’ ability to perform services for us on a timely basis.

Our business is subject to the risks of climate change, pandemics, earthquakes, fire, power outages, floods and other catastrophic events, and to interruption by manmade problems such as terrorism.

A significant public health crisis, epidemic or pandemic (including the ongoing COVID-19 pandemic), or climate change, or a natural disaster, such as an earthquake, fire or a flood, or a significant power outage could have a material adverse impact on our business, operating results and financial condition.

In addition, public health crises, climate change, or natural disasters could affect our channel partners’ ability to perform services for us on a timely basis.

In the event we or our channel partners are hindered by any of the events discussed above, our ability to provide our products or professional services to customers could be delayed.

In addition, our facilities and those of our third-party data centers and hosting providers are vulnerable to damage or interruption from human error, intentional bad acts, pandemics, earthquakes, hurricanes, floods, fires, war, terrorist attacks, power losses, hardware failures, systems failures, telecommunications failures and similar events.

The occurrence of a public health crisis, natural disaster, power failure or an act of terrorism, vandalism or other misconduct, a decision by a third party to close a facility on which we rely without adequate notice, or other unanticipated problems could result in lengthy interruptions in provision or delivery of our products, potentially leaving our customers vulnerable to cyber attacks.

In addition, our facilities and those of our third-party data centers and hosting providers are vulnerable to damage or interruption from human error, intentional bad acts, pandemics, earthquakes, hurricanes, floods, fires, war (including the armed conflict between Russia and Ukraine), terrorist attacks, power losses, hardware failures, systems failures, telecommunications failures and similar events.

The occurrence of a public health crisis, climate change, natural disaster, power failure or an act of terrorism, vandalism or other misconduct, a decision by a third party to close a facility on which we rely without adequate notice, or other unanticipated problems could result in lengthy interruptions in provision or delivery of our products, potentially leaving our customers vulnerable to cyber attacks.

The occurrence of any of the foregoing events could damage our systems and hardware or could cause them to fail completely, and our insurance may not cover such events or may be insufficient to compensate us for the potentially significant losses, including the potential harm to the future growth of our business, that may result from interruptions in our service as a result of system failures.

12 unchanged sentences

Failure to remediate any material weakness in our internal control over financial reporting, or to maintain other effective control systems required of public companies, could also restrict our future access to the capital markets.

Changes in financial accounting standards may adversely impact our reported results of operations.

A change in accounting standards or practices could adversely affect our operating results and may even affect our reporting of transactions completed before the change is effective.

New accounting pronouncements and varying interpretations of accounting pronouncements have occurred and may occur in the future.

Changes to existing rules or the questioning of current practices may adversely affect our operating results.

We may require additional capital to support business growth, and this capital might not be available on acceptable terms, if at all.

Accordingly, we may need to engage in equity or debt financings to secure additional funds.

We may not be able to obtain additional financing on terms favorable to us, if at all.

Anti-takeover provisions in our charter documents and under Delaware law could make an acquisition of us more difficult, limit attempts by our stockholders to replace or remove our current management and limit the market price of our common stock.

4 unchanged sentences

• establish an advance notice procedure for stockholder proposals to be brought before an annual meeting, including proposed nominations of persons for director nominees;

• establish that our board of directors is divided into three classes, with directors in each class elected prior to our 2021 annual meeting serving three-year staggered terms;

• prior to June 30, 2022 require the approval of holders of two-thirds of the shares entitled to vote at an election of directors to adopt, amend or repeal our amended and restated bylaws or amend or repeal the provisions of our amended and restated certificate of incorporation regarding the election and removal of directors and the ability of stockholders to take action by written consent or call a special meeting;

• establish that directors elected prior to our 2021 annual meeting serve three-year staggered terms and subsequent to the 2023 annual meeting, each director will hold office for a term of one year;

• (i) prior to June 30, 2022 require the approval of holders of two-thirds of the shares entitled to vote at an election of directors and (ii) on or following June 30, 2022, require the approval of the holders of a majority of the voting power of all of the then-outstanding shares of capital stock of the Company entitled to vote generally at an election of

directors, voting together as a single class, to adopt, amend or repeal our amended and restated bylaws or amend or repeal the provisions of our amended and restated certificate of incorporation regarding the election and removal of directors and the ability of stockholders to take action by written consent or call a special meeting;

• prohibit cumulative voting in the election of directors;

16 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-Q

Item 1A. Risk Factors