What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2023-02-24 compared with 2022-02-24 · 164 added, 163 removed, 577 unchanged (36% of the section changed)

1 unchanged sentence

Our operations and financial results are subject to various risks and uncertainties including those described below.

You should consider carefully the risks and uncertainties described below, in addition to other information contained in this Annual Report on Form 10-K, including our consolidated financial statements and related notes, as well as our other public filings with the Securities and Exchange Commission (the SEC), before making an investment decision.

The risks and uncertainties described below are not the only ones we face.

Additional risks and uncertainties that we are unaware of, or that we currently believe are not material, may also become important factors that adversely affect our business.

Furthermore, the ongoing COVID-19 pandemic (including federal, state and local governmental responses, broad economic impacts and market disruptions) has heightened risks discussed in the risk factors described below.

If any of the following risks or others not specified below materialize, our business, financial condition and results of operations could be materially adversely affected.

3 unchanged sentences

Our quarterly operating results may vary from period to period, which could result in our failure to meet expectations with respect to operating results and cause the trading price of our stock to decline.

Our operating results, including the levels of our revenue, ARR, cash flow, deferred revenue and gross margins, have historically varied from period to period, and we expect that they will continue to do so as a result of a number of factors, many of which are outside of our control, including:

• business disruptions in regions affecting our operations, stemming from actual, imminent or perceived outbreak or reemergence of contagious disease, including the COVID-19 pandemic;

Our operating results, including the levels of our revenue, annualized recurring revenue (“ARR”), cash flow, deferred revenue and gross margins, have historically varied from period to period, and we expect that they will continue to do so as a result of a number of factors, many of which are outside of our control, including:

• the level of demand for our products and professional services;

2 unchanged sentences

• the mix of our products, as well as professional services, sold during a period;

• the ability to successfully grow our sales of our cloud-based solutions;

• the ability to successfully grow our sales of our cloud-based solutions, including through the shift to a consolidated platform sales approach;

• the level of perceived threats to organizations’ cybersecurity;

9 unchanged sentences

(“IntSights”), and including without limitation, the amount and timing of expenses and potential future charges for impairment of goodwill from acquired companies;

• business disruptions in regions affecting our operations, stemming from actual, imminent or perceived outbreak or reemergence of contagious disease, including the COVID-19 pandemic;

• our ability to increase, retain and incentivize the channel partners that market and sell our products and professional services;

1 unchanged sentence

• the amount and timing of operating expenses related to the maintenance and expansion of our business, operations and infrastructure;

• the announcement or adoption of new regulations and policy mandates or changes to existing regulations and policy mandates that impact our business;

• the announcement or adoption of new regulations and policy mandates or changes to existing regulations and policy mandates that impact our business or industry;

• the cost or results of existing or unforeseen litigation and intellectual property infringement;

• the strength of regional, national and global economies;

• the impact of climate change, natural disasters or manmade problems such as terrorism or war;

• the impact of climate change, natural disasters or manmade problems, including terrorism or war (such as the Russia- Ukraine war);

• future accounting pronouncements or changes in our accounting policies or practices.

Fluctuations in our quarterly operating results, key metrics, non-GAAP metrics and the price of our common stock may be particularly pronounced in the current economic environment due to the uncertainty caused by and the unprecedented nature of the current COVID-19 pandemic.

Each factor above or discussed elsewhere herein or the cumulative effect of some of these factors may result in fluctuations in our operating results.

1 unchanged sentence

If we fail to meet or exceed expectations for our operating results for these or any other reasons, the market price of our stock could fall and we could face costly lawsuits, including securities class action suits.

We are a rapidly growing company, which makes it difficult to evaluate our future operating and financial results and may increase the risk that we will not be successful.

We are a rapidly growing company.

Our ability to forecast our future operating and financial results is subject to a number of uncertainties, including our ability to plan for and model future growth.

We have encountered and will continue to encounter risks and uncertainties frequently experienced by growing companies in rapidly evolving industries.

If our assumptions regarding these uncertainties, which we use to plan our business, are incorrect or change in reaction to changes in our markets, or if we do not address these risks successfully, our operating and financial results could differ materially from our expectations, our business could suffer and the trading price of our common stock may decline.

If we do not effectively manage our future growth, our business and results of operations will be adversely affected.

Our business and operations have experienced significant growth, and if we do not appropriately manage any future growth, or are unable to maintain and scale our infrastructure, systems and processes, our business and results of operations may be negatively affected.

From the year ended December 31, 2018 to the year ended December 31, 2022, our revenue grew from $244.1 million to $685.1 million and our headcount grew from 1,246 to 2,623 employees.

Although we have experienced rapid growth historically, we may not sustain our current growth rates and our investments to support our growth may not be successful.

The growth and expansion of our business will require us to invest significant financial and operational resources and will continue to place significant demands on our management team.

Our future growth is dependent upon our ability to continue to meet the expanding needs of our customers and to attract new customers.

Although we have experienced rapid growth historically, we cannot provide any assurance that our business will continue to grow at the same rate or at all.

As existing customers gain more experience with our products, they may broaden their reliance on our products, which will require that we expand our operations infrastructure.

We also seek to maintain excess capacity in our operations infrastructure to facilitate the rapid provision of new customer deployments.

In addition, we need to properly manage our technological operations infrastructure in order to support changes in hardware and software parameters and the evolution of our products, all of which require significant lead time.

If we do not accurately predict our infrastructure requirements, our existing customers may experience service outages that may subject us to financial penalties, financial liabilities and customer losses.

If our operations infrastructure fails to keep pace with increased sales, customers may experience delays as we seek to obtain additional capacity, which could adversely affect our reputation and our revenue.

To continue to grow and expand our business while meeting the performance and other requirements of our customers, we intend to continue to make significant financial and operational investments.

Our future success will depend in part on our ability to manage our growth effectively, which will require us to, among other things:

• maintain and expand our customer base;

• maintain and expand our customer base, including through continued investments and strategies to evolve to a consolidated platform sales approach;

• increase revenues from existing customers through increased or broader use of our products and professional services within their organizations;

4 unchanged sentences

• continue to improve our key business applications, processes and IT infrastructure to support our business needs and appropriately documenting such systems and processes;

• continue to effectively attract, integrate and retain a large number of new employees, particularly members of our sales and marketing and research and development teams;

• continue to effectively attract, integrate and retain employees, particularly members of our sales and marketing and research and development teams;

• enhance our information and communication systems to ensure that our employees and offices around the world are well coordinated and can effectively communicate with each other and our growing base of customers and partners;

18 unchanged sentences

If our revenue growth does not meet our expectations in future periods, our financial performance may be harmed, and we may not achieve or maintain profitability in the future.

The ongoing COVID-19 pandemic could materially and adversely affect our business, results of operations and financial condition, and we could be subject to risks from further health pandemics or epidemics, as well as uncertainty regarding returning to work and re-openings.

Our business could be adversely affected by the effects of health pandemics or epidemics, including the ongoing COVID-19 pandemic, which continues to have a negative impact on the local, regional, national and global scale.

We are unable to accurately predict the full impact that the COVID-19 pandemic will have on our results from operations, financial condition, liquidity and cash flows due to numerous uncertainties, including the duration and severity of the pandemic, the emergence of any new variants, the results of vaccination efforts, vaccine mandate requirements, and containment measures.

The implementation of measures to help contain the virus has impacted our day-to-day operations and could disrupt our business and operations, as well as that of our customers, partners, suppliers and others with whom we work, for an indefinite period of time.

To support the health and well-being of our employees, customers, partners and communities, a vast majority of our employees began working remotely as of late March 2020, but we have begun to selectively reopen certain offices in a phased approach and to hold in-person or hybrid meetings, on a voluntary basis, taking into consideration government restrictions and employee safety.

In addition, many of our customers and prospective customers are working remotely.

The disruptions to our operations caused by the COVID-19 pandemic may negatively impact employee retention and result in inefficiencies, delays and additional costs in our sales and marketing, professional service and research and development efforts, which cannot be predicted or quantified at this time.

To the extent that disruptions occur, we may not be able to fully mitigate any such inefficiencies, delays and additional costs through remote or other alternative work arrangements.

In addition, given the economic uncertainty created by COVID-19, we have and may continue to see delays in our sales cycle, failures of customers to renew at all or to renew the anticipated scope their subscriptions with us, requests from customers for payment term deferrals as well as pricing or bundling concessions, which, if significant, could materially and adversely affect our business, results of operations and financial condition.

Negative conditions in the general economy both in the United States and abroad resulting from health pandemics or epidemics, such as the COVID-19 pandemic, could cause a decrease in consumer discretionary spending and business investment and diminish growth expectations in the U.S.

economy and abroad.

More generally, the COVID-19 pandemic continues to present the possibility of an extended global economic downturn and has caused volatility in financial markets, which could materially and adversely affect demand for our products and professional services and could materially and adversely impact our results and financial condition even after the pandemic is contained.

For example, we may be unable to collect receivables from those customers significantly impacted by COVID-19, which may be more pronounced in industry verticals more directly impacted by the COVID-19 pandemic.

Also, a decrease in subscriptions and/or renewals in a given period could negatively affect our ARR as well as our revenues in future periods, particularly if experienced on a sustained basis, because a substantial proportion of our software subscriptions yield revenue recognized over time.

The pandemic may also have the effect of heightening many of the other risks described in this “Risk Factors” section, including risks associated with our guidance, our customers, our

potential customers, our market opportunity, renewals and sales cycle, among others.

We will continue to evaluate the nature and extent of the impact of the COVID-19 pandemic on our business.

Although we expect that current cash and cash equivalent balances, including the proceeds of our convertible senior notes offering in March 2021, together with cash flows that are generated from operations and availability under our revolving credit facility, will be sufficient to meet our domestic and international working capital needs and other capital and liquidity requirements for at least the next 12 months, if our access to capital is restricted or our borrowing costs increase, our operations and financial condition could be adversely impacted.

The full extent of the COVID-19 pandemic’s impact on our operations and financial performance depends on future developments that are uncertain and unpredictable, including the ultimate duration, spread and reemergence of the pandemic, including any new variants, its impact on capital and financial markets, the timing of economic recovery and any new information that may emerge concerning the severity of the virus, its spread to or reemergence in other geographic regions as well as the actions taken to contain it, including the distribution and acceptance of vaccines, among others.

Any of these impacts could have a material adverse impact on our business, results of operations and financial condition and ability to execute and capitalize on our strategies.

Due to the current uncertainty regarding the severity and duration of the COVID-19 pandemic, we cannot predict whether our response to date or the actions we may take in the future will be effective in mitigating the effects of COVID-19 pandemic on our business, results of operations or financial condition.

Accordingly, we are unable at this time to predict the impact of the COVID-19 pandemic on our operations, liquidity, and financial results, and, depending on the magnitude and duration of the COVID-19 pandemic, such impact may be material.

Our business and growth depend substantially on customers renewing their subscriptions with us.

Prolonged economic uncertainties or downturns could adversely affect our business.

Prolonged economic uncertainties or downturns could adversely affect our business operations or financial results.

Negative conditions in the general economy in either the United States or abroad, including conditions resulting from financial and credit market fluctuations, changes in economic policy, inflation, foreign currency exchange rate fluctuations, trade uncertainty, including changes in tariffs, sanctions, international treaties, and other trade restrictions, the occurrence of a natural disaster, outbreaks of epidemics or pandemics such as COVID-19, political unrest and social strife, including acts of terrorism, armed conflicts, such as the one between Russia and Ukraine, have caused and could continue to cause a decrease in corporate spending on security offerings or information technology in general and negatively affect the rate of growth of our business.

Our customer base spans a variety of industries, including the business services, energy, financial services, healthcare and pharmaceuticals, technology, manufacturing, media and entertainment, online services, retail, telecommunications and travel and transportation industries.

A substantial downturn in any of these industries may cause companies to reduce their capital expenditures in general or by specifically reducing their spending on information technology or security offerings.

As a result, our current or prospective customers in these industries may delay or cancel information technology projects or seek to lower their costs by renegotiating vendor contracts.

For example, due to economic volatility as a result of the continued impact of the ongoing COVID-19 pandemic, inflationary pressures and other global events, we have and may continue to see delays in our sales cycle, failures of customers to renew at all or to renew the anticipated scope their subscriptions with us, requests from customers for payment term deferrals as well as pricing or bundling concessions, which, if significant, could materially and adversely affect our business, results of operations and financial condition.

To the extent purchases of our offerings are perceived by customers and potential customers to be discretionary, our revenues may be disproportionately affected by delays or reductions in general information technology spending.

Also, customers may choose to develop in-house software as an alternative to using our offerings.

Moreover, competitors may respond to market conditions by lowering prices and attempting to lure away our customers.

In addition, the increased pace of consolidation in certain industries may result in reduced overall spending on our offerings.

In addition, adverse economic conditions, including inflation, may also increase the costs of operating our business, including vendor, supplier and workforce expenses.

We cannot predict the timing, strength or duration of any economic slowdown, instability or recovery, generally or within any particular industry or geography.

Although we expect that our current cash and cash equivalent balances, including the proceeds of our convertible senior notes offering in March 2021, together with cash flows that are generated from operations and availability under our revolving credit facility, will be sufficient to meet our domestic and international working capital needs and other capital and liquidity requirements for at least the next 12 months, if the economic conditions of the general economy or industries in which we operate worsen from present levels, our business operations and financial results could be adversely affected.

Macroeconomic events and conditions, such as those discussed above, may also have the effect of heightening many of the other risks described in this “Risk Factors” section, including risks associated with our guidance, our customers, our potential customers, our market opportunity, renewals and sales cycle, among others.

Our business and growth depend substantially on customers renewing and expanding their subscriptions with us.

Any decline in our customer renewals or failure to convince customers to expand their use of our subscription offerings could adversely affect our future operating results.

2 unchanged sentences

Our customers have no obligation to renew their subscriptions with us and we may not be able to accurately predict customer renewal rates.

Our customers’ renewal rates may decline or fluctuate as a result of a number of factors, including their satisfaction or dissatisfaction with our new or current product offerings, our pricing, the effects of economic conditions, including due to the global economic uncertainty and financial market conditions caused by the COVID-19 pandemic, competitive offerings, our customers' perception of their exposure, or alterations or reductions in their spending levels.

Our customers’ renewal rates may decline or fluctuate as a result of a number of factors, including their satisfaction or dissatisfaction with our new or current product offerings, our pricing, the effects of economic conditions, including due to a global economic slowdown, inflation, foreign currency exchange rate fluctuation, the Russia-Ukraine war and the global economic uncertainty and financial market conditions caused by the COVID-19 pandemic, competitive offerings, our customers' perception of their exposure, or alterations or reductions in their spending levels.

If our customers do not renew their agreements with us or renew on terms less favorable to us, our revenues and results of operations may be adversely impacted.

5 unchanged sentences

Demand for Insight Platform solutions are affected by a number of factors beyond our control, including continued market acceptance of cloud-based offerings, the timing of development and release of new products by our competitors, technological change, and growth or contraction in our market and the economy in general.

If we are unable to continue to meet customer demands or to achieve more widespread market acceptance of our Insight Platform solutions, our business operations, financial results and growth prospects will be materially and adversely affected .

If we are unable to continue to meet customer demands or to achieve more widespread market acceptance of our Insight Platform solutions, including through evolution of our sales model to a consolidated platform sales approach, our business operations, financial results and growth prospects will be materially and adversely affected.

We spend substantial amounts of time and money to research and develop or acquire new offerings and enhanced versions of our existing offerings to incorporate additional features, improve functionality or other enhancements in order to meet our customers’ rapidly evolving demands.

2 unchanged sentences

Therefore, when we develop or acquire new or enhanced offerings, their introduction must achieve high levels of market acceptance in order to justify the amount of our investment in developing and bringing them to market.

For example, if our recent product expansions and offerings, such as our Cloud Security and Threat Intelligence offerings, do not garner widespread market adoption and implementation, our financial results and competitive position could suffer.

For example, if our recent product expansions and offerings, such as our Cloud Security and Threat Intelligence offerings, do not garner widespread market adoption and implementation, or our consolidated platform sales approach is not successful, our financial results and competitive position could suffer.

Further, we may make changes to our offerings that our customers do not like, find useful or agree with.

1 unchanged sentence

Our new and existing offerings or product enhancements and changes to our existing offerings could fail to attain sufficient market acceptance for many reasons, including:

• our failure to predict market demand accurately in terms of product functionality and to supply offerings that meet this demand in a timely fashion, including changes in demand as a result of the COVID-19 pandemic;

• our failure to predict market demand accurately in terms of product functionality and to supply offerings that meet this demand in a timely fashion, including declines in demand as a result of the broader macroeconomic environment;

• the failure of our consolidated platform sales approach in execution or timing or both;

• real or perceived defect, errors or failures;

7 unchanged sentences

The adverse effect on our financial results may be particularly acute because of the significant research, development, marketing, sales and other expenses we will have incurred in connection with the new offerings or enhancements.

We face intense competition in our market.

We face intense competition in our market, which could adversely affect our business, financial condition, and results of operations.

The market for SecOps solutions is highly fragmented, intensely competitive and constantly evolving.

1 unchanged sentence

With the introduction of new technologies and market entrants, we expect the competitive environment to remain intense going forward.

Our primary competitors in Vulnerability Risk Management include Qualys and Tenable;

in Incident Detection and Response include Splunk, Micro Focus, LogRhythm and Microsoft (Sentinel);

in Application Security include Micro Focus and IBM;

in Security Orchestration and Automation Response include Splunk and Palo Alto Networks;

in Cloud Security include Palo Alto Networks and Check Point Software Technologies;

in Threat Intelligence include Recorded Future and Digital Shadows and finally, while the competition in our professional services business is diverse, our competitors include Mandiant, SecureWorks and NCC Group.

Our primary competitors in XDR and SIEM include CrowdStrike, Exabeam, LogRhythm, Microsoft, and Splunk;

in Cloud Security include Orca Security, Palo Alto Networks, and Wiz;

in Vulnerability Risk Management include Qualys and Tenable;

in Application Security include IBM and Micro Focus;

in Threat Intelligence include Digital Shadows and Recorded Future and finally, while the competition in our professional services business is diverse, our competitors include Crowdstrike, Mandiant (Google), and SecureWorks.

Some of our actual and potential competitors have advantages over us, such as longer operating histories, significantly greater financial, technical, marketing or other resources, stronger brand and business user recognition, larger and more mature intellectual property portfolios and broader global distribution and presence.

11 unchanged sentences

As a result of such relationships and acquisitions, our current or potential competitors might be able to adapt more quickly to new technologies and customer needs, devote greater resources to the promotion or sale of their products and services, initiate or withstand substantial price competition, take advantage of other opportunities more readily or develop and expand their product and service offerings more quickly than we do.

These competitive pressures in our market or our failure to compete effectively may result in price reductions, fewer orders, reduced renewals, reduced revenue and gross margins, and loss of market share.

Any failure to address these factors could seriously harm our business and operating results.

For all of these reasons, we may not be able to compete successfully against our current or future competitors, or we may be required to expend significant resources in order to remain competitive.

4 unchanged sentences

In addition, in recent years, recruiting, hiring and retaining employees with expertise in the cybersecurity industry has become increasingly difficult as the demand for cybersecurity professionals has increased as a result of the recent cybersecurity attacks on global corporations and governments.

We face intense competition for these employees from numerous technology, software and other companies, especially in certain geographic areas in which we operate, and we cannot ensure that we will be able to attract, motivate and/or retain sufficient qualified employees in the future particularly in tight labor markets.

We face intense competition for these employees from numerous technology, software and other companies, especially in

certain geographic areas in which we operate, and we cannot ensure that we will be able to attract, motivate and/or retain sufficient qualified employees in the future particularly in tight labor markets.

If we are unable to attract new employees and retain our current employees, we may not be able to adequately develop and maintain new products or professional services or market our existing products or professional services at the same levels as our competitors and we may, therefore, lose customers and market share.

8 unchanged sentences

We sell our products primarily to IT departments that are managing a growing set of user and compliance demands, which has increased the complexity of customer requirements to be met and confirmed during the sales cycle and prolonged our sales cycle.

Further, the length of time that potential customers devote to their testing and evaluation, contract negotiation and budgeting processes varies significantly, depending on the size of the organization and nature of the product or service under consideration.

Further, the length of time that potential customers devote to their testing and evaluation, contract negotiation and budgeting processes varies significantly, depending on the size of the organization, budgetary constraints, nature of the product or service under consideration and the seniority of the approval required.

In addition, we might devote substantial time and effort to a particular unsuccessful sales effort, and as a result, we could lose other sales opportunities or incur expenses that are not offset by an increase in revenue, which could harm our business.

If we fail to continue to effectively scale and manage our operations infrastructure, our customers may experience service outages and/or delays.

Our future growth is dependent upon our ability to continue to meet the expanding needs of our customers and to attract new customers.

As existing customers gain more experience with our products, they may broaden their reliance on our products, which will require that we expand our operations infrastructure.

We also seek to maintain excess capacity in our operations infrastructure to facilitate the rapid provision of new customer deployments.

To date, we have derived a significant amount of our revenue from customers using our vulnerability management offerings.

9 unchanged sentences

• our inability to release enhanced versions of our vulnerability management offerings on a timely basis in response to the dynamic threat landscape;

• a decline in overall IT spending due to the global economic uncertainty and financial market conditions caused by the COVID-19 pandemic.

• a decline in overall IT spending due to inflation, weakness or deterioration in global macroeconomic and market conditions and foreign currency exchange rate pressure.

Our inability to renew or increase sales of our vulnerability management offerings, including cloud-based subscriptions, content subscriptions, managed services and content and maintenance and support subscriptions, or a decline in prices of our vulnerability management offerings would harm our business and operating results more seriously than if we derived significant revenues from a variety of offerings.

25 unchanged sentences

• costs associated with language localization of our products;

• increased exposure to climate change, natural disasters, acts of war, terrorism, epidemics, or pandemics and other health crises, including the ongoing COVID-19 pandemic;

• increased exposure to climate change, natural disasters, acts of war (including the Russia-Ukraine war), terrorism, epidemics, or pandemics and other health crises, including the ongoing COVID-19 pandemic;

• costs of compliance with multiple and possibly overlapping tax structures.

5 unchanged sentences

Violations of laws or key control policies by our employees, contractors, channel partners or agents could result in delays in revenue recognition, financial reporting misstatements, fines, penalties or the prohibition of the importation or exportation of our products and could have a material adverse effect on our business and results of operations.

Further, in late February 2022, Russian military forces launched a significant military action against Ukraine.

While our business and operations have not been significantly impacted, it is not possible to predict the broader or longer-term consequences of this crisis.

Consequences of the crisis could include further sanctions, embargoes, regional instability, geopolitical shifts and adverse effects on macroeconomic conditions, security conditions, currency exchange rates and financial

There can be no assurance that the Russia-Ukraine war, including any resulting sanctions, export controls or other restrictive actions, will not have a material adverse impact on our future operations and results.

If we are unable to successfully manage the challenges of international expansion and operations, our business and operating results could be adversely affected.

9 unchanged sentences

We may be unable to rapidly and efficiently adjust our cost structure in response to significant revenue declines, which could adversely affect our operating results.

If our customers are unable to implement our products successfully, customer perceptions of our offerings may be impaired or our reputation and brand may suffer.

Our products are deployed in a wide variety of IT environments, including large-scale, complex infrastructures.

Some of our customers have experienced difficulties implementing our products in the past and may experience implementation difficulties in the future.

If our customers are unable to implement our products successfully or we fail to maintain high quality customer support, customer perceptions of our offerings may be impaired or our reputation and brand may suffer.

Our products are deployed in a wide variety of IT environments, including large-scale, complex infrastructures, and we often must assist our customers in achieving successful implementations for such large, complex deployments.

In the past, some of our customers have experienced difficulties implementing our products and may experience implementation difficulties in the future.

If our customers are unable to implement our products successfully, customer perceptions of our offerings may be impaired or our reputation and brand may suffer.

In addition, in order for our products to achieve their functional potential, our products must effectively integrate into our customers’ IT infrastructures, which have different specifications, utilize varied protocol standards, deploy products from multiple different vendors and contain multiple layers of products that have been added over time.

Our customers’ IT infrastructures are also dynamic, with a myriad of devices and endpoints entering and exiting the customers’ IT systems on a regular basis, and our products must be able to effectively adapt to and track these changes.

Our customers’ IT infrastructures are also dynamic, with a myriad of devices and endpoints entering and exiting the customers’ IT systems on a regular basis, including remote devices, and our products must be able to effectively adapt to and track these changes.

We must be able to interoperate and provide our security offerings to customers with these highly complex and customized networks, which requires significant coordination between our customers, our customer support teams and our channel partners.

Once our products are deployed within our customers’ networks, our customers depend on our technical and other customer support services to resolve any issues relating to the implementation and maintenance of our products.

If we do not effectively assist our customers in deploying our products, help our customers quickly resolve post-deployment issues or provide effective ongoing support, our ability to renew or sell additional products or professional services to existing customers would be adversely affected and our reputation with potential customers could be damaged.

Further, to the extent that we are unsuccessful in hiring, training and retaining adequate technical and customer support and success personnel, our ability to provide adequate and timely support to our customers will be negatively impacted, and our customers’ satisfaction with our offerings will be adversely affected.

Any failure by our customers to appropriately implement our products or any failure of our products to effectively integrate and operate within our customers’ IT infrastructures could result in customer dissatisfaction, impact the perceived reliability of our products, result in negative press coverage, negatively affect our reputation and harm our financial results.

3 unchanged sentences

Achieving the anticipated benefits of past or future acquisitions will depend in part upon whether we can integrate acquired operations, products and technology in a timely and cost-effective manner and successfully market and sell these as new product offerings, or as new features within our existing offerings.

For example, on July 16, 2021, we acquired IntSights, a provider of contextualized external threat intelligence and proactive threat remediation which were intended to extend the cloud security capabilities of our Insight Platform.

For example, on July 16, 2021, we acquired IntSights, a provider of contextualized external threat intelligence and proactive threat remediation which were intended to extend the cloud

security capabilities of our Insight Platform.

The integration of IntSights and any other acquisition may prove to be difficult due to the necessity of coordinating geographically separate organizations and integrating personnel with disparate business backgrounds and accustomed to different corporate cultures and business operations and internal systems.

We may need to implement or improve controls, procedures, and policies at a business that prior to the acquisition may have lacked sufficiently

effective controls, procedures and policies.

We may need to implement or improve controls, procedures, and policies at a business that prior to the acquisition may have lacked sufficiently effective controls, procedures and policies.

The acquisition and integration processes are complex, expensive and time consuming, and may cause an interruption of, or loss of momentum in, product development, sales activities and operations of both companies.

7 unchanged sentences

In developing this guidance, our management must make certain assumptions and judgments about our future performance.

Some of those key assumptions relate to the impact of the COVID-19 pandemic and the associated economic uncertainty on our business and the timing and scope of economic recovery globally, which are inherently difficult to predict.

Some of those key assumptions relate to the impact of macroeconomic pressures on our business and the timing and scope of economic recovery globally, which are inherently difficult to predict.

While presented with numerical specificity, this guidance is necessarily speculative in nature, and is inherently subject to significant business, economic and competitive uncertainties and contingencies, many of which are beyond our control and are based upon specific assumptions with respect to future business decisions or economic conditions, some of which may change.

This guidance, which inherently consists of forward-looking statements, is also qualified by, and subject to, assumptions, estimates and expectations as of the date given.

Forward-looking statements are subject to a number of risks, uncertainties, assumptions and other factors that could cause actual results and the timing of certain events to differ materially from future results expressed or implied by the forward-looking statements including the risks described in this Risk Factors section and in the Risk Factors section of any future SEC filings we make.

It can be expected that some or all of the assumptions, estimates and expectations of any guidance we furnished will not materialize or will vary significantly from actual results.

It can be expected that some or all of the assumptions, estimates and expectations of any guidance we have furnished will not materialize or will vary significantly from actual results.

Accordingly, our guidance is only an estimate of what management believes is realizable as of the date of release of such guidance.

Furthermore, analysts and investors may develop and publish their own projections of our business, which may form a consensus about our future performance.

Our business results may vary significantly from such projections or that consensus due to a number of factors, many of which are outside of our control, including due to the global economic uncertainty and financial market conditions caused by the COVID-19 pandemic and which could adversely affect our operations and operating results.

There are no comparable recent events that provide guidance as to the probable effect of the COVID-19 pandemic, and, as a result, the ultimate impact of the COVID-19 outbreak is highly uncertain and subject to change.

If we fail to accurately predict the full impact that the COVID-19 pandemic will have on all aspects of our business, the guidance and other forward-looking statements provided may also be incorrect or incomplete.

Our business results may vary significantly from such projections or that consensus due to a number of factors, many of which are outside of our control, including due to the global economic uncertainty and financial market conditions which could adversely affect our operations and operating results.

Furthermore, if we make downward revisions of our previously announced guidance, or if our publicly announced guidance of future operating results fails to meet expectations of securities analysts, investors or other interested parties, the price of our common stock would decline.

17 unchanged sentences

If we do not successfully maintain and enhance our brand, our business may not grow, we may have reduced pricing power relative to competitors with stronger brands, and we could lose customers and channel partners, all of which would adversely affect our business operations and financial results.

Failure to maintain high-quality customer support could have a material adverse effect on our business.

Further, to the extent that we are unsuccessful in hiring, training and retaining adequate technical and customer success personnel, our ability to provide adequate and timely support to our customers will be negatively impacted, and our customers’ satisfaction with our offerings will be adversely affected.

We are dependent on the continued services and performance of our senior management and other key employees, the loss of any of whom could adversely affect our business, operating results and financial condition.

2 unchanged sentences

Our senior management and key employees are employed on an at-will basis, which means that they could terminate their employment with us at any time.

Further, members of our management and other key personnel in critical functions across our organization may be unable to perform their duties or have limited availability due to COVID-19.

The temporary or permanent loss of the services of our senior management, particularly Mr.

Thomas, or other key employees for any reason could significantly delay or prevent the achievement of our development and strategic objectives and harm our business, financial condition and results of operations.

We rely on third-party software to operate certain functions of our business.

We rely on software vendors to operate certain critical functions of our business, including financial management, customer relationship management and human resource management.

We use third-party software and data to operate certain functions of our business and deliver our offerings that may be difficult to replace or that may cause errors or failures of our solutions, which could lead to lost customers or harm to our reputation and our operating results.

We use software vendors to operate certain critical functions of our business, including financial management, customer relationship management and human resource management.

If we experience difficulties in implementing new software or if these services become unavailable due to extended outages or interruptions or because they are no longer available on commercially reasonable terms or prices, our expenses could increase, our ability to manage our finances could be interrupted and our processes for managing sales of our solutions and supporting our customers could be impaired until equivalent services, if available, are identified, obtained and integrated, all of which could harm our business.

We use third-party software and data that may be difficult to replace or that may cause errors or failures of our solutions, which could lead to lost customers or harm to our reputation and our operating results.

We license third-party software and security and compliance data from various third parties that are used in our solutions in order to deliver our offerings.

Additionally, we license third-party software and security and compliance data from various third parties to utilize in our solutions to deliver our offerings.

In the future, this software or data may not be available to us on commercially reasonable terms, or at all.

1 unchanged sentence

In addition, any errors or defects in or failures of this third-party software could result in errors or defects in our products or cause our products to fail, which could harm our business and be costly to correct.

Many of these providers attempt to impose limitations on their liability for such errors, defects or failures, and if enforceable, we may have additional liability to

our customers or third-party providers that could harm our reputation and increase our operating costs.

Many of these providers attempt to impose limitations on their liability for such errors, defects or failures, and if enforceable, we may have additional liability to our customers or third-party providers that could harm our reputation and increase our operating costs.

We will need to maintain our relationships with third-party software and data providers, and to obtain software and data from such providers that do not contain errors or defects.

4 unchanged sentences

If these third parties no longer allow us to integrate with their APIs, or if we determine not to maintain these integrations, the functionality of our products may be reduced and our products may not be as marketable to certain potential customers.

Technology alliance partnerships require significant coordination between the parties involved, particularly if a partner requires that we integrate its products with our products.

Technology alliance partnerships require significant coordination between the parties

involved, particularly if a partner requires that we integrate its products with our products.

Further, we have invested and will continue to invest significant time, money and resources to establish and maintain relationships with our technology alliance partners, but we have no assurance that any particular relationship will continue for any specific period of time, result in new offerings that we can effectively commercialize or result in enhancements to our existing offerings.

16 unchanged sentences

Government entities also have heightened sensitivity surrounding the purchase of cybersecurity solutions due to the critical importance of their IT infrastructures, the nature of the information contained within those infrastructures and the fact that they are highly-visible targets for cyber attacks.

For example, the conflict in Ukraine and associated activities in Ukraine and Russia may increase the risk of cyberattacks on various types of infrastructure and operations, and the United States government has warned companies to be prepared for a significant increase in Russian cyberattacks in response to the sanctions on Russia.

Accordingly, increasing sales of our products and professional services to government entities may be more challenging than selling to commercial organizations.

Further, in the course of providing our products and professional services to government entities, our employees and those of our channel partners may be exposed to sensitive government information.

Any failure by

us or our channel partners to safeguard and maintain the confidentiality of such information could subject us to liability and reputational harm, which could materially and adversely affect our results of operations and financial performance.

Any failure by us or our channel partners to safeguard and maintain the confidentiality of such information could subject us to liability and reputational harm, which could materially and adversely affect our results of operations and financial performance.

Additionally, in the United States, federal government agencies may promulgate regulations, and the President may issue executive orders, requiring federal contractors to adhere to different or additional requirements after a contract is signed.

If we do not meet applicable requirements of law or contract, we could be subject to significant liability from our customers or regulators.

We are exposed to fluctuations in currency exchange rates, which could negatively affect our financial condition and results of operations.

1 unchanged sentence

dollar and we generate a majority of our revenue in U.S.

However, for the years ended December 31, 2021, 2020 and 2019 we incurred 15%, 12% and 13%, respectively, of our expenses outside of the United States in foreign currencies, primarily the British pound sterling and euro, principally with respect to salaries and related personnel expenses associated with our sales and research and development operations.

However, for the years ended December 31, 2022, 2021 and 2020 we incurred 16%, 15% and 12%, respectively, of our expenses outside of the

United States in foreign currencies, primarily the British pound sterling and euro, principally with respect to salaries and related personnel expenses associated with our sales and research and development operations.

Additionally, for the years ended December 31, 2022, 2021 and 2020, 10%, 10% and 9%, respectively, of our revenue was generated in foreign currencies.

1 unchanged sentence

The exchange rate between the U.S.

dollar and foreign currencies has fluctuated in recent years and may fluctuate substantially in the future.

dollar and foreign currencies has fluctuated substantially in recent years and may fluctuate in the future.

Furthermore, a strengthening of the U.S.

dollar could increase the cost in local currency of our products and services to customers outside the United States, which could adversely affect our business, results of operations, financial condition and cash flows.

W e implemented a hedging program during 2020 and have entered into forward contracts designated as cash flow hedges in order to mitigate our exposure to foreign currency fluctuations resulting from certain operating expenses denominated in certain foreign currencies.

We enter into forward contracts designated as cash flow hedges in order to mitigate our exposure to foreign currency fluctuations resulting from certain operating expenses denominated in certain foreign currencies.

These forward contracts and other hedging strategies such as options and foreign exchange swaps related to transaction exposures that we may implement to mitigate this risk in the future may not eliminate our exposure to foreign exchange fluctuations.

8 unchanged sentences

however, we cannot assure you that any future trademark registrations will be issued for pending or future applications or that any registered trademarks will be enforceable or provide adequate protection of our proprietary rights.

While we have copyrights in our software, we do not typically register such copyrights with the Copyright Office.

While we have copyrights in our software, we do not typically register such copyrights with the United States Copyright Office.

This failure to register the copyrights in our software may preclude us from obtaining statutory damages for infringement under certain circumstances.

9 unchanged sentences

Such litigation could result in substantial costs and diversion of resources and could result in impairment or loss of portions of our intellectual property.

Furthermore, our efforts to enforce our intellectual property rights may be met with defenses, counterclaims and countersuits attacking the validity and enforceability of our intellectual property

Furthermore, our efforts to enforce our intellectual property rights may be met with defenses, counterclaims and countersuits attacking the validity and enforceability of our intellectual property rights.

Our failure to secure, protect and enforce our intellectual property rights could negatively affect our brand and adversely impact our business, operating results and financial condition.

4 unchanged sentences

Many of these companies have the capability to dedicate substantially greater resources to enforce their intellectual property rights.

Third parties have in the past and may in the future assert claims of infringement, misappropriation or other violations of intellectual property rights against us and we are currently involved in legal proceedings with Finjan, Inc., which has filed a complaint against us and our wholly-owned subsidiary, Rapid7 LLC, in the United States District Court, District of Delaware, alleging patent infringement.

Third parties have in the past and may in the future

assert claims of infringement, misappropriation or other violations of intellectual property rights against us and we are currently involved in legal proceedings with Finjan, Inc., which has filed a complaint against us and our wholly-owned subsidiary, Rapid7 LLC, in the United States District Court, District of Delaware, alleging patent infringement.

Third parties may also assert claims against our customers or channel partners, whom we typically indemnify against claims that our solutions infringe, misappropriate or otherwise violate the intellectual property rights of third parties.

20 unchanged sentences

In addition, certain open source licenses require that source code for software programs that are subject to the license be made available to the public and that any modifications or derivative works to such open source software continue to be licensed under the same terms.

Although we monitor our use of open source software in an effort both to comply with the terms of the applicable open source licenses and to avoid subjecting our products to conditions we do not intend, the terms of many open source licenses have not

been interpreted by U.S.

courts, and there is a risk that these licenses could be construed in a way that could impose unanticipated conditions or restrictions on our ability to commercialize our products.

15 unchanged sentences

Changes in export or import laws and regulations, shifts in the enforcement or scope of existing laws and regulations, or changes in the countries, governments, persons, products or services targeted by such laws and regulations, could also result in decreased use of our products by, or in our decreased ability to export or sell our products to, existing or potential customers.

For example, in response to the Russia-Ukraine war, countries such as Canada, the United Kingdom, the European Union, the United States and other countries and organizations have implemented new and stricter sanctions and export controls against officials, individuals, regions, and industries in Russia, Ukraine and Belarus.

Each country’s potential response to such sanctions, export controls, tensions, and military actions could damage or disrupt international commerce and the global economy and could have a material adverse effect on our business and results of operations or impact our ability to continue to operate in affected regions.

A decreased use of our products or limitation on our ability to export or sell our products could adversely affect our business, financial condition and results of operations.

5 unchanged sentences

Our ability to use net operating losses to offset future taxable income may be subject to certain limitations.

As of December 31, 2021, we had federal and state net operating loss carryforwards (NOLs), of $510.3 million and $400.7 million, respectively, available to offset future taxable income, which expire in various years beginning in 2022 if not utilized.

As of December 31, 2022, we had federal and state net operating loss carryforwards (“NOLs”) , o f $450.5 million and $345.4 million, respectively, available to offset future taxable income, which expire in various years beginning in 2023 if not utilized.

A lack of future taxable income would adversely affect our ability to utilize these NOLs before they expire.

1 unchanged sentence

Section 382 of the Internal Revenue Code imposes limitations on a company’s ability to use NOLs if a company experiences a more-than-50-percentage point ownership change over a three-year testing period.

Base d upon our historical analysis, we determined that although a limitation on our historical NOLs exists, we do not expect this limitation to impair our ability to use our NOLs prior to expiration.

Based upon our historical analysis, we determined that although a limitation on our historical NOLs exists, we do not expect this limitation to impair our ability to use our NOLs prior to expiration.

However, if changes in our ownership occur in the future, our ability to use our NOLs may be further limited.

5 unchanged sentences

federal, state, local and sales taxes in the United States and foreign income taxes, withholding taxes and transaction taxes in numerous foreign jurisdictions.

We generally conduct our international operations through wholly-owned subsidiaries and report our taxable income in various jurisdictions worldwide based upon our business operations in those juri sdictions.

We generally conduct our international operations through wholly-owned

subsidiaries and report our taxable income in various jurisdictions worldwide based upon our business operations in those jurisdictions.

Our intercompany relationships are and will continue to be subject to complex transfer pricing regulations administered by taxing authorities in various jurisdictions.

8 unchanged sentences

There is no guarantee that our products or professional services will detect all vulnerabilities and threats, especially in light of the rapidly changing security landscape to which we must respond, including the constantly evolving techniques used by attackers to access or sabotage data.

If we fail to update our solutions in a timely or effective manner to respond to these threats, our customers could experience security breaches.

16 unchanged sentences

A material liability claim or other occurrence that harms our reputation or decreases market acceptance of our products may harm our business and operating results.

Limitation of liability provisions in our standard terms and conditions and our other

agreements may not adequately or effectively protect us from any claims related to errors or defects in our solutions, including as a result of federal, state or local laws or ordinances or unfavorable judicial decisions in the United States or other countries.

Limitation of liability provisions in our standard terms and conditions and our other agreements may not adequately or effectively protect us from any claims related to errors or defects in our solutions, including as a result of federal, state or local laws or ordinances or unfavorable judicial decisions in the United States or other countries.

Our brand, reputation and ability to attract, retain and serve our customers are dependent in part upon the reliable performance of our products and network infrastructure.

16 unchanged sentences

We sell cybersecurity and data analytics products.

As a result, we have been and will be a target of cyber attacks designed to impede the performance of our products, penetrate our network security or the security of our cloud platform or our internal systems, or that of our customers, misappropriate proprietary information and/or cause interruptions to our services.

As a result, we have been and will continue to be a target of cyber attacks designed to impede the performance of our products, penetrate our network security or the security of our cloud platform or our internal systems, or that of our customers, misappropriate proprietary information and/or cause interruptions to our services.

For example, because Metasploit serves as an introduction to hacking for many individuals, a successful cyber attack on us may be perceived as a victory for the cyber attacker, thereby increasing the likelihood that we may be a target of cyber attacks, even absent financial motives.

In addition, with so many of our employees now working remotely due to the global COVID-19 pandemic, we may face an increased risk of attempted security breaches and incidents.

Also, since many of our customers continue working remotely, we expect there will continue to be an increased amount of personal, confidential and proprietary information that is stored in our solutions, which increases the exposure and risk of cyberattacks and other malicious internet-based activity.

While we have taken steps to protect such information that we have access to, including information we may obtain through our customer support services or customer usage of our offerings, our security measures or those of our third-party service providers could be breached or otherwise fail to prevent unauthorized access to or disclosure, modification, misuse, loss or destruction of such information.

Computer malware, ransomware, cyber viruses, social engineering (phishing attacks), denial of service or other attacks, employee theft or misuse and increasingly sophisticated network attacks have become more prevalent in our industry, particularly against cloud services.

Such attacks may also include exploitation of vulnerabilities in third party or open source software code that may be incorporated into our own or our customers’ or supplier’s systems, such as the vulnerability in the Java logging library known as “log4j” identified in late 2021 that affected many in our industry.

We also process, store and transmit our own data as part of our business and operations, including personal, confidential or proprietary information.

As many of our customers and employees will continue to work remotely, we expect there will continue to be an increased amount of such information that is stored in our solutions, which increases the exposure and risk of attempted security breaches, cyberattacks and other malicious internet-based activity.

Additionally, we make use of third-party technology and systems for a variety of reasons, including, without limitation, encryption and authentication technology, employee email, content delivery to customers, back-office support, credit card processing, customer relationship management, human resources services and other functions.

Computer malware, ransomware, cyber viruses, social engineering (phishing attacks), supply-chain attacks, denial of service or other attacks, employee theft or misuse and increasingly sophisticated network attacks have become more prevalent in our industry, particularly against cloud services.

In particular, ransomware attacks, including by organized criminal threat actors, nation-states, and nation-state-supported actors, are becoming increasingly prevalent and severe and can lead to significant interruptions in our operations, loss of data and income, reputational harm, and diversion of funds.

While extortion payments may alleviate the negative impact of a ransomware attack, we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments.

Similarly, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties and infrastructure in our supply chain or our third-party partners’ supply chains have not been compromised or that they do not contain exploitable defects or bugs that could result in a breach of or disruption to our information technology systems (including our products) or the third-party information technology systems that support us and our services.

Such attacks may also include exploitation of vulnerabilities in third party or open source

software code that may be incorporated into our own or our customers’ or supplier’s systems, such as the vulnerability in the Java logging library known as “log4j” identified in late 2021 that affected many in our industry.

Further, if our systems or those of our third-party service providers are breached as a result of third-party action, employee error or misconduct, attackers could learn critical information about how our products operate to help protect our customers’ IT infrastructures from cyber risk, thereby making our customers more vulnerable to cyber attacks.

We also process, store and transmit our own data as part of our business and operations.

This data may include personal, confidential or proprietary information.

We make use of third-party technology and systems for a variety of reasons, including, without limitation, encryption and authentication technology, employee email, content delivery to customers, back-office support, credit card processing, human resources services, customer relationship management, enterprise risk planning and other functions.

Although we have developed systems and processes that are designed to protect customer information and prevent data and financial loss and other security breaches and incidents, and to reduce the impact of a security breach or incident at a third-party vendor, such measures cannot provide absolute security.

There can be no assurance that any security measures that we or our third-party service providers have implemented will be effective against current or future security threats.

While we maintain measures designed to protect the integrity, confidentiality and security of our data, our security measures could fail and those of our third-party service providers have failed and could fail, any of which could result in unauthorized access to or disclosure, modification, misuse, loss or destruction of such data or financial loss.

Additionally, the growth in state sponsored cyber activity, including those actions taken in connections with the Russia-Ukraine war, demonstrates the increasing sophistication and evolution of cyber threats.

As a result, we may be unable to anticipate the techniques used or implement adequate measures to prevent an electronic intrusion into our customers through our cloud platform or to prevent breaches and other security incidents affecting our cloud platform, internal networks, systems or data.

Further, once identified, we may be unable to remediate or otherwise respond to a breach or other incident in a timely manner.

Actual or perceived security breaches of our cloud platform could result in actual or perceived breaches of our customers’ networks and systems.

Since our business is focused on providing reliable security solutions to our customers, a security breach or other security incident, or the perception that one has occurred, could result in a loss of customer confidence in the security of our offerings and damage to our brand, reduce the demand for our offerings, disrupt normal business operations, require us to spend material resources to investigate or correct the breach and to prevent future security breaches and incidents, expose us to legal liabilities, including litigation, regulatory enforcement, and indemnity obligations, and adversely affect our revenues and operating results.

16 unchanged sentences

Moreover, despite our efforts, our personnel or third parties upon whom we rely may fail to comply with such obligations.

If we (or third parties upon whom we rely) fail, or are perceived to have failed, to address and comply with data privacy and security obligations, we could face significant consequences.

If we (or third parties upon whom we rely) fail, or are perceived to have failed, to address and comply with data privacy and security

obligations, we could face significant consequences.

These consequences may include but are not limited to:

7 unchanged sentences

loss of customers;

interruptions or

stoppages in our business or operations;

interruptions or stoppages in our business or operations;

inability to process personal data;

4 unchanged sentences

and revisions to our operations.

In the United States, federal, state and local governments have enacted numerous data privacy and security laws (including data breach notification laws, personal data privacy laws and consumer protection laws).

For example, the California Consumer Privacy Act of 2018 (CCPA), imposes obligations on businesses to which it applies.

In the United States, federal, state and local governments have enacted numerous data privacy and cybersecurity laws (including data breach notification laws, personal data privacy laws and consumer protection laws).

For example, the California Privacy Rights Act, which updated the California Consumer Privacy Act of 2018 (“CCPA”), went into effect on January 1, 2023, (“CPRA”), imposes obligations on businesses, service providers, third parties and contractors to which it applies.

These obligations include, but are not limited to, providing specific disclosures in privacy notices and affording California residents certain rights related to their personal data.

The CCPA allows for statutory fines for non-compliance (up to $7,500 per violation).

Other states have similarly enacted data privacy laws.

If we become subject to new data privacy or security laws, at the state level, the risk of enforcement action against us could increase because we may become subject to additional obligations, and the number of individuals or entities that can initiate actions against us may increase (including individuals, via a private right of action, and state actors).

Internationally, virtually every jurisdiction in which we operate has established its own data security and privacy legal frameworks with which we, and/or our customers, must comply, including the European Union's General Data Protection Regulation, (EU) 2016/679 (GDPR), laws implemented by European Union (EU) member states and, following the withdrawal of the United Kingdom (UK) from the EU, the so-called ‘UK GDPR’ (European Data Protection Laws).

Other states have proposed data privacy laws which may come into effect.

If we become subject to new data privacy or security laws, the risk of enforcement action against us could increase because we may become subject to additional obligations, and the number of individuals or entities that can initiate actions against us may increase (including individuals, via a private right of action, and state actors).

Internationally, virtually every jurisdiction in which we operate has established its own data security and cyberprivacy legal frameworks with which we, and/or our customers, must comply, including the European Union's General Data Protection Regulation, 2016/679 (“GDPR”), laws implemented by European Union (“EU”) member states and, following the withdrawal of the United Kingdom (“UK”) from the EU, the so-called ‘UK GDPR’ (“European Data Protection Laws”).

The UK’s decision to leave the EU and ongoing developments in the UK have created uncertainty with regard to data protection regulation in the UK.

10 unchanged sentences

For example, European Data Protection Laws generally prohibit the transfer of personal data from the European Economic Area (“EEA”) and, the UK and Switzerland (collectively, “Europe”), to most other non-European countries unless the parties to the transfer have implemented specific safeguards to protect the transferred personal data.

In particular, government regulators in Europe have found that the United States does nor provide an adequate level of data privacy and security protection and although there are legal mechanisms to allow for the transfer of personal data from Europe to the United States, uncertainty remains about compliance and such mechanisms may not be available or applicable with respect to our personal data processing activities.

In particular, government regulators in Europe have found that the United States does not provide an adequate level of data privacy and cybersecurity protection and although there are legal mechanisms to allow for the transfer of personal data from Europe to the United States, uncertainty remains about compliance and such mechanisms may not be available or applicable with respect to our personal data processing activities.

For example, the “Standard Contractual Clauses” (“SCCs”) that are designed to be a valid mechanism by which parties can transfer personal data out of Europe to jurisdictions that are not found to provide an adequate level of protection, must be assessed on a case-by-case basis taking into account the legal regime applicable in the destination country.

6 unchanged sentences

The costs of compliance with, and other burdens imposed by, the laws, rules, regulations and policies that are applicable to the businesses of our customers may limit the use and adoption of, and reduce the overall demand for, our software.

Privacy or cybersecurity concerns, whether valid or not valid, may inhibit market adoption of our products particularly in certain industries and foreign countries.

cybersecurity concerns, whether valid or not valid, may inhibit market adoption of our products particularly in certain industries and foreign countries.

Further, there are active legislative discussions regarding the implementation of laws or regulations that could restrict the manner in which security research is conducted and that could restrict or possibly bar the conduct of penetration testing and the use of exploits, which are an essential component of our Metasploit product and our business strategy more generally.

divergent operating models, which may have a material and adverse impact on our business, results of operations, and financial condition.

Our failure to comply with existing laws, rules or regulations, changes to existing laws or their interpretation, or the imposition of new laws, rules or regulations, could result in additional costs and may necessitate changes to our business practices and divergent operating models, which may have a material and adverse impact on our business, results of operations, and financial condition.

Organizations may be reluctant to purchase our cloud-based offerings due to the actual or perceived vulnerability of cloud solutions.

4 unchanged sentences

The market price of our common stock may be highly volatile and may fluctuate substantially as a result of a variety of factors, some of which are related in complex ways.

Since shares of our common stock were sold in our initial public offering, or IPO, in July 2015 at a price of $16.00 per share, our stock price has ranged from an intraday low of $9.05 to an intraday high of $145.00 through February 18, 2022.

Since shares of our common stock were sold in our initial public offering (“IPO”), in July 2015 at a price of $16.00 per share, our stock price has ranged from an intraday low of $9.05 to an intraday high of $145.00 through February 17, 2023.

Factors that may affect the market price of our common stock include:

10 unchanged sentences

• price and volume fluctuations in the overall stock market;

• effects of inflation and increased interest rates;

• changes in the anticipated future size and growth rate of our market;

• sales of shares of our common stock by us or our stockholders, including sales and purchases of any common stock issued upon conversion of our convertible senior notes;

• general economic, regulatory and market conditions.

Recently, the stock markets, and in particular the market on which our common stock is listed, have experienced price and volume fluctuations that have affected and continue to affect the market prices of equity securities of many companies due to, among other factors, the actions of market participants or other actions outside of our control, including general market volatility caused by the COVID-19 pandemic.

• general economic, regulatory and market conditions and/or market speculation or rumors.

These fluctuations have often been unrelated or disproportionate to the operating performance of those companies.

14 unchanged sentences

In the future, we may sell additional shares of our common stock or equity-linked securities to raise capital.

In addition, a substantial number of shares of our common stock is reserved for issuance upon the exercise of stock options, settlement of other equity incentive awards and upon conversion of the Notes.

The indentures for the Notes do not restrict our ability to issue additional common stock or equity-linked securities in the future.

4 unchanged sentences

We may not have sufficient cash flow from our business to pay our substantial debt when due.

In May 2020, we issued $230.0 million aggregate principal amount of 2025 Notes and in March 2021, we issued $600.0 million aggregate principal amount of 2027 Notes (collectively, the Notes).

In addition, we may also incur indebtedness under our senior secured credit facility.

In May 2020, we issued $230.0 million aggregate principal amount of 2025 Notes and in March 2021, we issued $600.0 million aggregate principal amount of 2027 Notes.

In addition, we may also incur indebtedness under our revolving credit facility.

Our indebtedness may:

6 unchanged sentences

Further, the indentures governing the Notes do not restrict our ability to incur additional indebtedness, secure existing or future debt, recapitalize our existing or future debt or take a number of other actions that could intensify the risks discussed above and below.

Further, we and our subsidiaries may incur substantial additional indebtedness in the future, subject to the restrictions contained in our senior secured credit facility and any future debt instruments existing at the time, some of which may be secured indebtedness.

While our senior secured credit facility restricts our ability to incur additional indebtedness, if our senior secured credit facility is terminated, we may not be subject to such restriction under the terms of such indebtedness.

Further, we and our subsidiaries may incur substantial additional indebtedness in the future, subject to the restrictions contained in our revolving credit facility and any future debt instruments existing at the time, some of which may be secured indebtedness.

While our revolving credit facility restricts our ability to incur additional indebtedness, if our revolving credit facility is terminated, we may not be subject to such restriction under the terms of such indebtedness.

Our ability to pay our debt when due or to refinance our indebtedness, including the Notes, depends on our future performance, which is subject to economic, financial, competitive, and other factors beyond our control.

1 unchanged sentence

In addition, any required repurchase of the Notes for cash as a result of a fundamental change or voluntary redemption (in each case, pursuant to the terms of the Notes) would lower our current cash on hand such that we would not have that cash available to fund operations.

If we are unable to generate sufficient cash flow, we may be required to adopt one or more alternatives, such as selling assets, restructuring our debt or obtaining additional equity capital on terms that may be onerous or highly dilutive.

If we are unable to generate sufficient cash flow, we may be required to adopt one or more alternatives, such as

selling assets, restructuring our debt or obtaining additional equity capital on terms that may be onerous or highly dilutive.

Our ability to refinance our indebtedness will depend on the capital markets and our financial condition at such time.

We may not be able to engage in any of these activities or engage in these activities on desirable terms, which could result in a default on our debt obligations.

In addition, our senior secured credit facility contains, and any future additional indebtedness that we may incur may contain, financial and other restrictive covenants that limit our ability to operate our business, raise capital, pay dividends and/or make payments under our other indebtedness.

If we fail to comply with these covenants or to make payments under our indebtedness

when due, then we would be in default under that indebtedness, which could, in turn, result in that and our other indebtedness becoming immediately payable in full.

Any such event of default under our senior secured credit facility would give the lenders the right to terminate their commitments to provide additional loans under our senior secured credit facility and to declare any and all borrowings outstanding, together with accrued and unpaid interest and fees, to be immediately due and payable.

In addition, the lenders under our senior secured credit facility would have the right to proceed against the collateral in which we granted a security interest to them, which consists of substantially all our assets.

If the debt under our senior secured credit facility were to be accelerated, we may not have sufficient cash or be able to borrow sufficient funds to refinance the debt or sell sufficient assets to repay the debt, which could immediately materially and adversely affect our cash flows, business, results of operations, financial condition and our ability to make payments under our indebtedness, including the Notes, when due.

In addition, our revolving credit facility contains, and any future additional indebtedness that we may incur may contain, financial and other restrictive covenants that limit our ability to operate our business, raise capital, pay dividends and/or make payments under our other indebtedness.

If we fail to comply with these covenants or to make payments under our indebtedness when due, then we would be in default under that indebtedness, which could, in turn, result in that and our other indebtedness becoming immediately payable in full.

Any such event of default under our revolving credit facility would give the lenders the right to terminate their commitments to provide additional loans under our revolving credit facility and to declare any and all borrowings outstanding, together with accrued and unpaid interest and fees, to be immediately due and payable.

In addition, the lenders under our revolving credit facility would have the right to proceed against the collateral in which we granted a security interest to them, which consists of substantially all our assets.

If the debt under our revolving credit facility were to be accelerated, we may not have sufficient cash or be able to borrow sufficient funds to refinance the debt or sell sufficient assets to repay the debt, which could immediately materially and adversely affect our cash flows, business, results of operations, financial condition and our ability to make payments under our indebtedness, including the Notes, when due.

Further, the terms of any new or additional financing may be on terms that are more restrictive or on terms that are less desirable to us.

2 unchanged sentences

If one or more holders elect to convert their Notes, unless we elect to satisfy our conversion obligation by delivering solely shares of our common stock (other than paying cash in lieu of delivering any fractional share), we would be required to settle a portion or all of our conversion obligation in cash, which could adversely affect our liquidity.

As disclosed in Note 10, Debt , to our consolidated financial statements, the conditional conversion features of the 2025 Notes were triggered as of December 31, 2021, and the 2025 Notes are convertible at the option of the holders, in whole or in part, between January 1, 2022 and March 31, 2022.

Whether the 2025 Notes will be convertible following the fiscal quarter ending March 31, 2022, will depend on the continued satisfaction of this condition or another conversion condition in the future.

As of December 31, 2021, the 2027 Notes are not convertible at the option of the holder.

As disclosed in Note 10, Debt , to our consolidated financial statements, during the six months ended June 30, 2022, the 2025 Notes were convertible at the option of the holders.

During this period an immaterial principal amount of the 2025 Notes were requested for conversion and settled in cash.

As of December 31, 2022, the 2025 Notes and the 2027 Notes were not convertible at the option of the holder.

Whether the Notes will be convertible following the year ended December 31, 2022, will depend on the future satisfaction of a conversion condition.

In addition, even if holders of Notes do not elect to convert their Notes, we could be required under applicable accounting rules to reclassify all or a portion of the outstanding principal of the Notes as a current rather than long-term liability, which would result in a material reduction of our net working capital.

The capped call transactions may affect the value of the Notes and our common stock.

In connection with the pricing of the Notes and the exercise by the initial purchasers of their option to purchase additional Notes, we entered into capped call transactions with certain counterparties (Capped Calls).

The Capped Calls cover, subject to customary adjustments, the number of shares of our common stock initially underlying the Notes.

The Capped Calls are expected to offset the potential dilution as a result of conversion of the Notes.

In connection with establishing their initial hedge of the capped call transactions, the counterparties or their respective affiliates entered into various derivative transactions with respect to our common stock concurrently with or shortly after the pricings of the Notes, including with certain investors in the Notes.

The counterparties and/or or their respective affiliates may modify or unwind their hedge positions by entering into or unwinding various derivatives with respect to our common stock and/or purchasing or selling our common stock or other securities of ours in secondary market transactions prior to the maturity of the Notes (and are likely to do so on each exercise date of the capped call transactions, which are scheduled to occur during the applicable observation period relating to any conversion of the 2025 Notes on or after November 1, 2024 or relating to any conversion of the 2027 Notes on or after December 15, 2026, in each case that is not in connection with a redemption).

In connection with the issuance of the 2023 Notes, the 2025 Notes and the 2027 Notes, we entered into capped call transactions with certain counterparties (the “Capped Calls”).

The Capped Calls cover, subject to customary adjustments, the number of shares of our common stock initially underlying each of the 2023 Notes, the 2025 Notes and the 2027 Notes.

The Capped Calls are expected to offset the potential dilution as a result of conversion of such Notes.

In connection with establishing their initial hedge of the capped call transactions, the counterparties or their respective affiliates entered into various derivative transactions with respect to our common stock concurrently with or shortly after the pricings of the respective Notes, including with certain investors in the applicable Notes.

The counterparties and/or or their respective affiliates may modify or unwind their hedge positions by entering into or unwinding various derivatives with respect to our common stock and/or purchasing or selling our common stock or other securities of ours in secondary market transactions prior to the maturity of the applicable Notes (and are likely to do so on each exercise date of the capped call transactions, which are scheduled to occur during the applicable observation period relating to any conversion of the 2025 Notes on or after November 1, 2024 or relating to any conversion of the 2027 Notes on or after December 15, 2026, in each case that is not in connection with a redemption).

We redeemed the 2023 Notes in November 2021.

As described elsewhere in this Annual Report on Form 10-K, the 2023 Capped Calls were not redeemed with the redemption of the 2023 Notes.

We cannot make any prediction as to the direction or magnitude of any potential effect that the transactions described above may have on the prices of the Notes or the shares of our common stock.

5 unchanged sentences

If an option counterparty becomes subject to insolvency proceedings, we will become an unsecured creditor in those proceedings with a claim equal to our exposure at the time under such transaction.

Our exposure will depend on many factors but, generally, our exposure will increase if the market price or the volatility of our common stock increases.

Our exposure will depend on many factors but, generally,

our exposure will increase if the market price or the volatility of our common stock increases.

In addition, upon a default or other failure to perform, or a termination of obligations, by an option counterparty, we may suffer adverse tax consequences and more dilution than we currently anticipate with respect to our common stock.

We can provide no assurances as to the financial stability or viability of the option counterparties.

Provisions in the indentures for the Notes may deter or prevent a business combination that may be favorable to our stockholders.

If a fundamental change occurs prior to the maturity date of the Notes, holders of the Notes, will have the right, at their option, to require us to repurchase all or a portion of their Notes.

In addition, if a “make-whole fundamental change” (as defined in the

indentures) occurs prior the maturity date, we will in some cases be required to increase the conversion rate of the Notes for a holder that elects to convert its Notes in connection with such make-whole fundamental change.

Furthermore, the indentures governing the Notes prohibit us from engaging in certain mergers or acquisitions unless, among other things, the surviving entity assumes our obligations under the Notes.

These and other provisions in the indentures could deter or prevent a third party from acquiring us even when the acquisition may be favorable to our stockholders.

Conversion of the Notes will dilute the ownership interest of existing stockholders, including holders who had previously converted their Notes, or may otherwise depress the price of our common stock.

The conversion of some or all of the Notes will dilute the ownership interests of existing stockholders to the extent we deliver shares of our common stock upon conversion of any of the Notes.

Whether the 2025 Notes will be convertible following the fiscal quarter from January 1, 2022 and March 31, 2022 will depend on the continued satisfaction of the applicable conversion condition or another conversion condition in the future.

As of December 31, 2021, the 2027 Notes are not convertible at the option of the holder.

As disclosed in Note 10, Debt , as of December 31, 2022 the Notes were not convertible at the option of the holder.

Any sales in the public market of the common stock issuable upon such conversion could adversely affect prevailing market prices of our common stock.

12 unchanged sentences

In the event we or our channel partners are hindered by any of the events discussed above, our ability to provide our products or professional services to customers could be delayed.

In addition, our facilities and those of our third-party data centers and hosting providers are vulnerable to damage or interruption from human error, intentional bad acts, pandemics, earthquakes, hurricanes, floods, fires, war, terrorist attacks, power losses, hardware failures, systems failures, telecommunications failures and similar events.

In addition, our facilities and those of our third-party data centers and hosting providers are vulnerable to damage or interruption from human error, intentional bad acts, pandemics, earthquakes, hurricanes, floods, fires, war (including the Russia-Ukraine war), terrorist attacks, power losses, hardware failures, systems failures, telecommunications failures and similar events.

The occurrence of a public health crisis, climate change, natural disaster, power failure or an act of terrorism, vandalism or other misconduct, a decision by a third party to close a facility on which we rely without adequate notice, or other unanticipated problems could result in lengthy interruptions in provision or delivery of our products, potentially leaving our customers vulnerable to cyber attacks.

The occurrence of any of the foregoing events could damage our systems and hardware or could cause them to fail completely, and our insurance may not cover such events or may be insufficient to compensate us for the potentially significant losses, including the potential harm to the future growth of our business, that may result from interruptions in our service as a result of system failures.

In addition, while the long-term effects of climate change on the global economy and the technology industry in particular are unclear, we recognize that there are inherent climate related risks wherever business is conducted.

Any of our primary locations may be vulnerable to the adverse effects of climate change.

Climate-related events, including the increasing frequency of extreme weather events and their impact on critical infrastructure in the United States and elsewhere, have the potential to disrupt our business, our third-party suppliers, and/or the business of our customers, and may cause us to experience higher attrition, losses and additional costs to maintain and resume operations.

Transitional climate change risks that result from a shift to a low-carbon economy may subject us to increased regulations, reporting requirements, standards, or expectations regarding the environmental impacts of our business and untimely or inaccurate disclosure could adversely affect our reputation, business or financial performance.

All of the aforementioned risks may be exacerbated if our disaster recovery plans or the disaster recovery plans established for our third-party data centers and hosting providers prove to be inadequate.

23 unchanged sentences

Although we expect that current cash and cash equivalent balances and cash flows that are generated from operations will be sufficient to meet our domestic and international working capital needs and other capital and liquidity requirements for at least the next 12 months, if we are unable to obtain adequate financing or financing on terms satisfactory to us if and when we require it, our ability to continue to support our business growth and to respond to business challenges could be significantly impaired, and our business may be adversely affected.

Anti-takeover provisions in our charter documents and under Delaware law could make an acquisition of us more difficult, limit attempts by our stockholders to replace or remove our current management and limit the market price of our common stock.

Anti-takeover provisions in our charter documents, our indenture and under Delaware law could make acquiring us more difficult, limit attempts by our stockholders to replace or remove our current management and limit the market price of our common stock.

Provisions in our amended and restated certificate of incorporation and amended and restated bylaws may have the effect of delaying or preventing a change in control or changes in our management.

3 unchanged sentences

• establish an advance notice procedure for stockholder proposals to be brought before an annual meeting, including proposed nominations of persons for director nominees;

• establish that our board of directors is divided into three classes, with directors in each class elected prior to our 2021 annual meeting serving three-year staggered terms;

• prior to June 30, 2022 require the approval of holders of two-thirds of the shares entitled to vote at an election of directors to adopt, amend or repeal our amended and restated bylaws or amend or repeal the provisions of our amended and restated certificate of incorporation regarding the election and removal of directors and the ability of stockholders to take action by written consent or call a special meeting;

• establish that directors elected prior to our 2021 annual meeting serve three-year staggered terms and subsequent to the 2023 annual meeting, each director will hold office for a term of one year;

• require the approval of the holders of a majority of the voting power of all of the then-outstanding shares of capital stock of the Company entitled to vote generally at an election of directors, voting together as a single class, to adopt, amend or repeal our amended and restated bylaws or amend or repeal the provisions of our amended and restated certificate of incorporation regarding the election and removal of directors and the ability of stockholders to take action by written consent or call a special meeting;

• prohibit cumulative voting in the election of directors;

1 unchanged sentence

These provisions may frustrate or prevent any attempts by our stockholders to replace or remove our current management by making it more difficult for stockholders to replace members of our board of directors, who are responsible for appointing the members of our management.

If a fundamental change occurs prior to the maturity date of the Notes, holders of the Notes will have the right, at their option, to require us to repurchase all or a portion of their Notes.

In addition, if a “make-whole fundamental change” (as defined in the indentures) occurs prior the maturity date, we will in some cases be required to increase the conversion rate of the Notes for a holder that elects to convert its Notes in connection with such make-whole fundamental change.

Furthermore, the indentures governing the Notes prohibit us from engaging in certain mergers or acquisitions unless, among other things, the surviving entity assumes our obligations under the Notes.

These and other provisions in the indentures could deter or prevent a third party from acquiring us even when the acquisition may be favorable to our stockholders.

In addition, because we are incorporated in Delaware, we are governed by the provisions of Section 203 of the Delaware General Corporation Law, which generally prohibits a Delaware corporation from engaging in any of a broad range of business combinations with any “interested” stockholder for a period of three years following the date on which the stockholder became an “interested” stockholder.

6 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors