What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2023-05-10 compared with 2022-11-03 · 118 added, 121 removed, 657 unchanged (27% of the section changed)

9 unchanged sentences

• Our quarterly operating results may vary from period to period, which could result in our failure to meet expectations with respect to operating results and cause the trading price of our stock to decline.

• We are a rapidly growing company, which makes it difficult to evaluate our future operating and financial results and may increase the risk that we will not be successful.

• If we do not effectively manage our future growth rate, our business and results of operations may be adversely affected.

• The ongoing COVID-19 pandemic could materially and adversely affect our business, results of operations and financial condition, and we could be subject to risks from further health pandemics or epidemics, as well as uncertainty regarding returning to work and re-openings.

• Our business and operations have experienced significant growth, and if we do not appropriately manage any future growth, or are unable to maintain and scale our infrastructure, systems and processes, our business and results of operations may be negatively affected.

• Prolonged economic uncertainties or downturns could adversely affect our business.

• Real or perceived failures, errors or defects in our solutions could adversely affect our brand and reputation, which could have an adverse effect on our business and results of operations.

• Our brand, reputation and ability to attract, retain and serve our customers are dependent in part upon the reliable performance of our products and network infrastructure.

• Our business and growth depend substantially on customers renewing their subscriptions with us.

• Our business and growth depend substantially on customers renewing and expanding their subscriptions with us.

Any decline in our customer renewals or failure to convince customers to expand their use of our subscription offerings could adversely affect our future operating results.

• If we or our third party service providers experience a security breach or unauthorized parties otherwise obtain access to our customers’ data, our reputation may be harmed, demand for our solutions may be reduced and we may incur significant liabilities.

• We face intense competition in our market.

• We face intense competition in our market, which could adversely affect our business, financial condition, and results of operations.

• If we are unable to successfully hire, train, and retain qualified personnel our business may suffer.

• If we fail to continue to effectively scale and manage our operations infrastructure, our customers may experience service outages and/or delays.

• A component of our growth strategy is dependent on our continued international expansion, which adds complexity to our operations.

• Because our products collect and store user and related information, domestic and international privacy and cybersecurity concerns, and other laws and regulations, could have a material adverse effect on our business.

• If our customers are unable to implement our products successfully, customer perceptions of our offerings may be impaired or our reputation and brand may suffer.

• If our customers are unable to implement our products successfully or we fail to maintain high quality customer support, customer perceptions of our offerings may be impaired or our reputation and brand may suffer.

• We may fail to meet our publicly announced guidance or other expectations about our business and future operating results, which would cause our stock price to decline.

• If we are not able to maintain and enhance our brand, our business and operating results may be adversely affected.

• Failure to maintain high-quality customer support could have a material adverse effect on our business.

• We rely on third-party software to operate certain functions of our business.

• We use third-party software and data that may be difficult to replace or that may cause errors or failures of our solutions, which could lead to lost customers or harm to our reputation and our operating results.

• We use third-party software and data to operate certain functions of our business and deliver our offerings that may be difficult to replace or that may cause errors or failures of our solutions, which could lead to lost customers or harm to our reputation and our operating results.

• Assertions by third parties of infringement or other violations by us of their intellectual property rights, whether or not correct, could result in significant costs and harm our business and operating results.

6 unchanged sentences

Additional risks and uncertainties not precisely known to us or that we currently deem to be immaterial may also materially adversely affect our business, financial condition, results of operations, and future growth prospects.

Risks Related to Our Business and Industry

Our quarterly operating results may vary from period to period, which could result in our failure to meet expectations with respect to operating results and cause the trading price of our stock to decline.

Our operating results, including the levels of our revenue, ARR, cash flow, deferred revenue and gross margins, have historically varied from period to period, and we expect that they will continue to do so as a result of a number of factors, many of which are outside of our control, including:

Our operating results, including the levels of our revenue, annualized recurring revenue (“ARR”), cash flow, deferred revenue and gross margins, have historically varied from period to period, and we expect that they will continue to do so as a result of a number of factors, many of which are outside of our control, including:

• the level of demand for our products and professional services;

12 unchanged sentences

• price competition;

• our ability to successfully manage and integrate any acquired businesses, including IntSights Cyber Intelligence Ltd.

(“IntSights”), and including without limitation, the amount and timing of expenses and potential future charges for impairment of goodwill from acquired companies;

• our ability to successfully manage and integrate any acquired businesses, including without limitation, the amount and timing of expenses and potential future charges for impairment of goodwill from acquired companies;

• business disruptions in regions affecting our operations, stemming from actual, imminent or perceived outbreak or reemergence of contagious disease, including the COVID-19 pandemic;

10 unchanged sentences

If we fail to meet or exceed expectations for our operating results for these or any other reasons, the market price of our stock could fall and we could face costly lawsuits, including securities class action suits.

We are a rapidly growing company, which makes it difficult to evaluate our future operating and financial results and may increase the risk that we will not be successful.

We are a rapidly growing company.

Our ability to forecast our future operating and financial results is subject to a number of uncertainties, including our ability to plan for and model future growth.

We have encountered and will continue to encounter risks and uncertainties frequently experienced by growing companies in rapidly evolving industries.

If our assumptions regarding these uncertainties, which we use to plan our business, are incorrect or change in reaction to changes in our markets, or if we do not address these risks successfully, our operating and financial results could differ materially from our expectations, our business could suffer and the trading price of our common stock may decline.

If we do not effectively manage our future growth, our business and results of operations will be adversely affected.

Our business and operations have experienced significant growth, and if we do not appropriately manage any future growth, or are unable to maintain and scale our infrastructure, systems and processes, our business and results of operations may be negatively affected.

From the year ended December 31, 2018 to the year ended December 31, 2022, our revenue grew from $244.1 million to $685.1 million and our headcount grew from 1,246 to 2,623 employees.

Although we have experienced rapid growth historically, we may not sustain our current growth rates and our investments to support our growth may not be successful.

The growth and expansion of our business will require us to invest significant financial and operational resources and will continue to place significant demands on our management team.

Our future growth is dependent upon our ability to continue to meet the expanding needs of our customers and to attract new customers.

Although we have experienced rapid growth historically, we cannot provide any assurance that our business will continue to grow at the same rate or at all.

As existing customers gain more experience with our products, they may broaden their reliance on our products, which will require that we expand our operations infrastructure.

We also seek to maintain excess capacity in our operations infrastructure to facilitate the rapid provision of new customer deployments.

In addition, we need to properly manage our technological operations infrastructure in order to support changes in hardware and software parameters and the evolution of our products, all of which require significant lead time.

If we do not accurately predict our infrastructure requirements, our existing customers may experience service outages that may subject us to financial penalties, financial liabilities and customer losses.

If our operations infrastructure fails to keep pace with increased sales, customers may experience delays as we seek to obtain additional capacity, which could adversely affect our reputation and our revenue.

To continue to grow and expand our business while meeting the performance and other requirements of our customers, we intend to continue to make significant financial and operational investments.

Our future success will depend in part on our ability to manage our growth effectively, which will require us to, among other things:

6 unchanged sentences

• continue to improve our key business applications, processes and IT infrastructure to support our business needs and appropriately documenting such systems and processes;

• continue to effectively attract, integrate and retain a large number of new employees, particularly members of our sales and marketing and research and development teams;

• continue to effectively attract, integrate and retain employees, particularly members of our sales and marketing and research and development teams;

• enhance our information and communication systems to ensure that our employees and offices around the world are well coordinated and can effectively communicate with each other and our growing base of customers and partners;

5 unchanged sentences

We have posted a net loss in each year since inception, including net losses of $124.7 million, $146.3 million and $98.8 million in the years ended December 31, 2022, 2021 and 2020, respectively.

As of September 30, 2022, we had an accumulated deficit of $849.4 million.

As of March 31, 2023, we had an accumulated deficit of $886.7 million.

While we have experienced significant revenue growth in recent periods, we may not obtain a high enough volume of sales of our products and professional services to sustain or increase our growth or achieve or maintain profitability in the future.

10 unchanged sentences

If our revenue growth does not meet our expectations in future periods, our financial performance may be harmed, and we may not achieve or maintain profitability in the future.

The ongoing COVID-19 pandemic could materially and adversely affect our business, results of operations and financial condition, and we could be subject to risks from further health pandemics or epidemics, as well as uncertainty regarding returning to work and re-openings.

Our business could be adversely affected by the effects of health pandemics or epidemics, including the ongoing COVID-19 pandemic, which continues to have a negative impact on the local, regional, national and global scale.

The implementation of measures to help contain the virus has impacted our day-to-day operations and could continue to disrupt our business and operations, as well as that of our customers, partners, suppliers and others with whom we work, for an indefinite period of time.

The full extent of the COVID-19 pandemic’s impact on our operations and financial performance depends on future developments that are uncertain and unpredictable, including the ultimate duration, spread and reemergence of the pandemic, including any new variants, its impact on capital and financial markets, the timing of economic recovery and any new information that may emerge concerning the severity of the virus, its spread to or reemergence in other geographic regions as well as the actions taken to contain it, including the distribution and acceptance of vaccines, among others.

Any of these impacts could have a material adverse impact on our business, results of operations and financial condition and ability to execute and capitalize on our strategies.

Due to the current uncertainty regarding the severity and duration of the COVID-19 pandemic, we cannot predict whether our response to date or the actions we may take in the future will be effective in

mitigating the effects of COVID-19 pandemic on our business, results of operations or financial condition.

Accordingly, we are unable at this time to predict the impact of the COVID-19 pandemic on our operations, liquidity, and financial results, and, depending on the magnitude and duration of the COVID-19 pandemic, such impact may be material.

Negative conditions in the general economy both in the United States and abroad resulting from health pandemics or epidemics, such as the COVID-19 pandemic, could cause a decrease in consumer discretionary spending and business investment and diminish growth expectations in the U.S.

economy and abroad.

As a result of the COVID-19 pandemic, we have and may continue to see delays in our sales cycle, failures of customers to renew at all or to renew the anticipated scope their subscriptions with us, requests from customers for payment term deferrals as well as pricing or bundling concessions, which, if significant, could materially and adversely affect our business, results of operations and financial condition.

More generally, the COVID-19 pandemic continues to present the possibility of an extended global economic downturn and has caused volatility in financial markets, which could materially and adversely affect demand for our products and professional services and could materially and adversely impact our results and financial condition even after the pandemic is contained.

Although we expect that current cash and cash equivalent balances, including the proceeds of our convertible senior notes offering in March 2021, together with cash flows that are generated from operations and availability under our revolving credit facility, will be sufficient to meet our domestic and international working capital needs and other capital and liquidity requirements for at least the next 12 months, if our access to capital is restricted or our borrowing costs increase, our operations and financial condition could be adversely impacted.

A health pandemic or epidemic, such as the COVID-19 pandemic, may also have the effect of heightening many of the other risks described in this “Risk Factors” section, including risks associated with our guidance, our customers, our potential customers, our market opportunity, renewals and sales cycle, among others.

We will continue to evaluate the nature and extent of the impact of the COVID-19 pandemic on our business.

Our business and growth depend substantially on customers renewing their subscriptions with us.

Prolonged economic uncertainties or downturns could adversely affect our business.

Prolonged economic uncertainties or downturns could adversely affect our business operations or financial results.

Negative conditions in the general economy in either the United States or abroad, including conditions resulting from financial and credit market fluctuations, changes in economic policy, inflation, foreign currency exchange rate fluctuations, trade uncertainty, including changes in tariffs, sanctions, international treaties, and other trade restrictions, the occurrence of a natural disaster, outbreaks of epidemics or pandemics such as COVID-19, political unrest and social strife, including acts of terrorism, armed conflicts, such as the one between Russia and Ukraine, have caused and could continue to cause a decrease in corporate spending on security offerings or information technology in general and negatively affect the rate of growth of our business.

Our customer base spans a variety of industries, including the business services, energy, financial services, healthcare and pharmaceuticals, technology, manufacturing, media and entertainment, online services, retail, telecommunications and travel and transportation industries.

A substantial downturn in any of these industries may cause companies to reduce their capital expenditures in general or by specifically reducing their spending on information technology or security offerings.

As a result, our current or prospective customers in these industries may delay or cancel information technology projects or seek to lower their costs by renegotiating vendor contracts.

For example, due to economic volatility as a result of the continued impact of the ongoing COVID-19 pandemic, inflationary pressures and other global events, we have and may continue to see delays in our sales cycle, failures of customers to renew at all or to renew the anticipated scope their subscriptions with us, requests from customers for payment term deferrals as well as pricing or bundling concessions, which, if significant, could materially and adversely affect our business, results of operations and financial condition.

To the extent purchases of our offerings are perceived by customers and potential customers to be discretionary, our revenues may be disproportionately affected by delays or reductions in general information technology spending.

Also, customers may choose to develop in-house software as an alternative to using our offerings.

Moreover, competitors may respond to market conditions by lowering prices and attempting

to lure away our customers.

In addition, the increased pace of consolidation in certain industries may result in reduced overall spending on our offerings.

In addition, adverse economic conditions, including inflation, may also increase the costs of operating our business, including vendor, supplier and workforce expenses.

We cannot predict the timing, strength or duration of any economic slowdown, instability or recovery, generally or within any particular industry or geography.

Although we expect that our current cash and cash equivalent balances, including the proceeds of our convertible senior notes offering in March 2021, together with cash flows that are generated from operations and availability under our revolving credit facility, will be sufficient to meet our domestic and international working capital needs and other capital and liquidity requirements for at least the next 12 months, if the economic conditions of the general economy or industries in which we operate worsen from present levels, our business operations and financial results could be adversely affected.

Macroeconomic events and conditions, such as those discussed above, may also have the effect of heightening many of the other risks described in this “Risk Factors” section, including risks associated with our guidance, our customers, our potential customers, our market opportunity, renewals and sales cycle, among others.

Our business and growth depend substantially on customers renewing and expanding their subscriptions with us.

Any decline in our customer renewals or failure to convince customers to expand their use of our subscription offerings could adversely affect our future operating results.

15 unchanged sentences

Therefore, when we develop or acquire new or enhanced offerings, their introduction must achieve high levels of market acceptance in order to justify the amount of our investment in developing and bringing them to market.

For example, if our

recent product expansions and offerings, such as our Cloud Security and Threat Intelligence offerings, do not garner widespread market adoption and implementation, or our consolidated platform sales approach is not successful, our financial results and competitive position could suffer.

For example, if our recent product expansions and offerings, such as our Cloud Security and Threat Intelligence offerings, do not garner widespread market adoption and implementation, or our consolidated platform sales approach is not successful, our financial results and competitive position could suffer.

Further, we may make changes to our offerings that our customers do not like, find useful or agree with.

12 unchanged sentences

The adverse effect on our financial results may be particularly acute because of the significant research, development, marketing, sales and other expenses we will have incurred in connection with the new offerings or enhancements.

We face intense competition in our market.

We face intense competition in our market, which could adversely affect our business, financial condition, and results of operations.

The market for SecOps solutions is highly fragmented, intensely competitive and constantly evolving.

1 unchanged sentence

With the introduction of new technologies and market entrants, we expect the competitive environment to remain intense going forward.

Our primary competitors in Vulnerability Risk Management include Qualys and Tenable;

in Incident Detection and Response include Splunk, Micro Focus, LogRhythm and Microsoft (Sentinel);

in Application Security include Micro Focus and IBM;

in Security Orchestration and Automation Response include Splunk and Palo Alto Networks;

in Cloud Security include Palo Alto Networks and Check Point Software Technologies;

in Threat Intelligence include Recorded Future and Digital Shadows and finally, while the competition in our professional services business is diverse, our competitors include Mandiant (Google), SecureWorks and NCC Group.

Our primary competitors in XDR and SIEM include CrowdStrike, Exabeam, LogRhythm, Microsoft, and Splunk;

in Cloud Security include Orca Security, Palo Alto Networks, and Wiz;

in Vulnerability Risk Management include Qualys and Tenable;

in Application Security include IBM and Micro Focus;

in Threat Intelligence include Digital Shadows and Recorded Future and finally, while the competition in our professional services business is diverse, our competitors include Crowdstrike, Mandiant (Google), and SecureWorks.

Some of our actual and potential competitors have advantages over us, such as longer operating histories, significantly greater financial, technical, marketing or other resources, stronger brand and business user recognition, larger and more mature intellectual property portfolios and broader global distribution and presence.

8 unchanged sentences

These larger competitors are also often in a better position to withstand any significant reduction in spending by customers, and will therefore not be as susceptible to economic downturns.

These competitive pressures in our market or our failure to compete effectively may result in price reductions, fewer orders, reduced renewals, reduced revenue and gross margins, and loss of market share.

Any failure to meet and address these factors could seriously harm our business and operating results.

Furthermore, our current and potential competitors may establish cooperative relationships among themselves or with third parties that may further enhance their resources and product and services offerings in the markets we address.

1 unchanged sentence

As a result of such relationships and acquisitions, our current or potential competitors might be able to adapt more quickly to new technologies and customer needs, devote greater resources to the promotion or sale of their products and services, initiate or withstand substantial price competition, take advantage of other opportunities more readily or develop and expand their product and service offerings more quickly than we do.

Any failure to address these factors could seriously harm our business and operating results.

For all of these reasons, we may not be able to compete successfully against our current or future competitors, or we may be required to expend significant resources in order to remain competitive.

15 unchanged sentences

We sell our products primarily to IT departments that are managing a growing set of user and compliance demands, which has increased the complexity of customer requirements to be met and confirmed during the sales cycle and prolonged our sales cycle.

Further, the length of time that potential customers devote to their testing and evaluation, contract negotiation and budgeting processes varies significantly, depending on the size of the organization, budgetary constraints and nature of the product or service under consideration.

Further, the length of time that potential customers devote to their testing and evaluation, contract negotiation and budgeting processes varies significantly, depending on the size of the organization, budgetary constraints, nature of the product or service under consideration and the seniority of the approval required.

In addition, we might devote substantial time and effort to a particular unsuccessful sales effort, and as a result, we could lose other sales opportunities or incur expenses that are not offset by an increase in revenue, which could harm our business.

If we fail to continue to effectively scale and manage our operations infrastructure, our customers may experience service outages and/or delays.

Our future growth is dependent upon our ability to continue to meet the expanding needs of our customers and to attract new customers.

As existing customers gain more experience with our products, they may broaden their reliance on our products, which will require that we expand our operations infrastructure.

We also seek to maintain excess capacity in our operations infrastructure to facilitate the rapid provision of new customer deployments.

To date, we have derived a significant amount of our revenue from customers using our vulnerability management offerings.

9 unchanged sentences

• our inability to release enhanced versions of our vulnerability management offerings on a timely basis in response to the dynamic threat landscape;

• a decline in overall IT spending due to inflation, weakness or deterioration in global macroeconomic and market conditions, foreign currency exchange rate pressure and the global economic uncertainty and financial market conditions caused by the COVID-19 pandemic.

• a decline in overall IT spending due to inflation, weakness or deterioration in global macroeconomic and market conditions and foreign currency exchange rate pressure.

Our inability to renew or increase sales of our vulnerability management offerings, including cloud-based subscriptions, content subscriptions, managed services and content and maintenance and support subscriptions, or a decline in prices of our vulnerability management offerings would harm our business and operating results more seriously than if we derived significant revenues from a variety of offerings.

3 unchanged sentences

We market and sell our products and professional services throughout the world and have personnel in many parts of the world.

For the nine months ended September 30, 2022 and 2021, operations located outside of North America generated 21% and 19%, respectively, of our revenue.

For each of the three months ended March 31, 2023 and 2022, operations located outside of North America generated 21% of our revenue.

Our growth strategy is dependent, in part, on our continued international expansion.

22 unchanged sentences

Our business, including the sales of our products and professional services by us and our channel partners, may be subject to foreign governmental regulations, which vary substantially from country to country and change from time to time.

Our failure, or the failure by our channel partners, to comply with these regulations could adversely affect our business.

or the failure by our channel partners, to comply with these regulations could adversely affect our business.

Further, in many foreign countries it is common for others to engage in business practices that are prohibited by our internal policies and procedures or U.S.

14 unchanged sentences

Our model also makes it difficult for us to rapidly increase our revenue through additional sales in any period, as revenue from new customers generally will be recognized over the applicable term.

We also intend to increase our investment in research and development, sales and marketing, general and administrative functions and other areas to grow our business.

We also intend to increase our investment in research and development, sales and marketing, and general and administrative functions and other areas to grow our business.

We are likely to recognize the costs associated with these increased investments earlier than some of the anticipated benefits and the return on these investments may be lower, or may develop more slowly, than we expect, which could adversely affect our operating results.

We may be unable to rapidly and efficiently adjust our cost structure in response to significant revenue declines, which could adversely affect our operating results.

If our customers are unable to implement our products successfully, customer perceptions of our offerings may be impaired or our reputation and brand may suffer.

Our products are deployed in a wide variety of IT environments, including large-scale, complex infrastructures.

Some of our customers have experienced difficulties implementing our products in the past and may experience implementation difficulties in the future.

If our customers are unable to implement our products successfully or we fail to maintain high quality customer support, customer perceptions of our offerings may be impaired or our reputation and brand may suffer.

Our products are deployed in a wide variety of IT environments, including large-scale, complex infrastructures, and we often must assist our customers in achieving successful implementations for such large, complex deployments.

In the past, some of our customers have experienced difficulties implementing our products and may experience implementation difficulties in the future.

If our customers are unable to implement our products successfully, customer perceptions of our offerings may be impaired or our reputation and brand may suffer.

In addition, in order for our products to achieve their functional potential, our products must effectively integrate into our customers’ IT infrastructures, which have different specifications, utilize varied protocol standards, deploy products from multiple different vendors and contain multiple layers of products that have been added over time.

Our customers’ IT infrastructures are also dynamic, with a myriad of devices and endpoints entering and exiting the customers’ IT systems on a regular basis, and our products must be able to effectively adapt to and track these changes.

Our customers’ IT infrastructures are also dynamic, with a myriad of devices and endpoints entering and exiting the customers’ IT systems on a regular basis, including remote devices, and our products must be able to effectively adapt to and track these changes.

We must be able to interoperate and provide our security offerings to customers with these highly complex and customized networks, which requires significant coordination between our customers, our customer support teams and our channel partners.

Once our products are deployed within our customers’ networks, our customers depend on our technical and other customer support services to resolve any issues relating to the implementation and maintenance of our products.

If we do not effectively assist our customers in deploying our products, help our customers quickly resolve post-deployment issues or provide effective ongoing support, our ability to renew or sell additional products or professional services to existing customers would be adversely affected and our reputation with potential customers could be damaged.

Further, to the extent that we are unsuccessful in hiring, training and retaining adequate technical and customer support and success personnel, our ability to provide adequate and timely support to our customers will be negatively impacted, and our customers’ satisfaction with our offerings will be adversely affected.

Any failure by our customers to appropriately implement our products or any failure of our products to effectively integrate and operate within our customers’ IT infrastructures could result in customer dissatisfaction, impact the perceived reliability of our products, result in negative press coverage, negatively affect our reputation and harm our financial results.

3 unchanged sentences

Achieving the anticipated benefits of past or future acquisitions will depend in part upon whether we can integrate acquired operations, products and technology in a timely and cost-effective manner and successfully market and sell these as new product offerings, or as new features within our existing offerings.

For example, on July 16, 2021, we acquired IntSights, a provider of contextualized external threat intelligence and proactive threat remediation which were intended to extend the cloud security capabilities of our Insight Platform.

The integration of IntSights and any other acquisition may prove to be difficult due to the necessity of coordinating geographically separate organizations and integrating personnel with disparate business backgrounds and accustomed to different corporate cultures and business operations and internal systems.

For example, on March 14, 2023, we acquired Minerva Labs Ltd., a leading provider of anti-evasion and ransomware prevention technology.

The integration of Minerva and any other acquisition may prove to be difficult due to the necessity of coordinating geographically separate organizations and integrating personnel with disparate business backgrounds and accustomed to different corporate cultures and business operations and internal systems.

We may need to implement or improve controls, procedures, and policies at a business that prior to the acquisition may have lacked sufficiently effective controls, procedures and policies.

8 unchanged sentences

In developing this guidance, our management must make certain assumptions and judgments about our future performance.

Some of those key assumptions relate to the impact of the COVID-19 pandemic and the associated economic uncertainty on our business and the timing and scope of economic recovery globally, which are inherently difficult to predict.

Some of those key assumptions relate to the impact of macroeconomic pressures on our business and the timing and scope of economic recovery globally, which are inherently difficult to predict.

While presented with numerical specificity, this guidance is necessarily speculative in nature, and is inherently subject to significant business, economic and competitive uncertainties and contingencies, many of which are beyond our control and are based upon specific assumptions with respect to future business decisions or economic conditions, some of which may change.

4 unchanged sentences

Furthermore, analysts and investors may develop and publish their own projections of our business, which may form a consensus about our future performance.

Our business results may vary significantly from such projections or that consensus due to a number of factors, many of which are outside of our control, including due to the global economic uncertainty and financial market conditions caused by the COVID-19 pandemic and which could adversely affect our operations and operating results.

There are no comparable recent events that provide guidance as to the probable effect of the COVID-19 pandemic, and, as a result, the ultimate impact of the COVID-19 outbreak is highly uncertain and subject to change.

If we fail to accurately predict the full impact that the COVID-19 pandemic will have on all aspects of our business, the guidance and other forward-looking statements provided may also be incorrect or incomplete.

Our business results may vary significantly from such projections or that consensus due to a number of factors, many of which are outside of our control, including due to the global economic uncertainty and financial market conditions which could adversely affect our operations and operating results.

Furthermore, if we make downward revisions of our previously announced guidance, or if our publicly announced guidance of future operating results fails to meet expectations of securities analysts, investors or other interested parties, the price of our common stock would decline.

2 unchanged sentences

We anticipate that we will continue to rely on these partners in order to help facilitate sales of our offerings as part of larger purchases in the United States and to grow our business internationally.

For the years ended December 31, 2021, 2020 and 2019, we derived approximately 52%, 47%, and 43%, respectively, of our revenue from sales of products and professional services through channel partners, and the percentage of revenue derived from channel partners may increase in future periods.

For the years ended December 31, 2022, 2021 and 2020, we derived approximately 57%, 52%, and 47%, respectively, of our revenue from sales of products and professional services through channel partners, and the percentage of

revenue derived from channel partners may increase in future periods.

Our agreements with our channel partners are non-exclusive and do not prohibit them from working with our competitors or offering competing solutions, and some of our channel partners may have more established relationships with our competitors.

12 unchanged sentences

If we do not successfully maintain and enhance our brand, our business may not grow, we may have reduced pricing power relative to competitors with stronger brands, and we could lose customers and channel partners, all of which would adversely affect our business operations and financial results.

Failure to maintain high-quality customer support could have a material adverse effect on our business.

We are dependent on the continued services and performance of our senior management and other key employees, the loss of any of whom could adversely affect our business, operating results and financial condition.

2 unchanged sentences

Our senior management and key employees are employed on an at-will basis, which means that they could terminate their employment with us at any time.

Further, members of our management and other key personnel in critical functions across our organization may be unable to perform their duties or have limited availability due to COVID-19.

The temporary or permanent loss of the services of our senior management, particularly Mr.

Thomas, or other key employees for any reason could significantly delay or prevent the achievement of our development and strategic objectives and harm our business, financial condition and results of operations.

We rely on third-party software to operate certain functions of our business.

We rely on software vendors to operate certain critical functions of our business, including financial management, customer relationship management and human resource management.

We use third-party software and data to operate certain functions of our business and deliver our offerings that may be difficult to replace or that may cause errors or failures of our solutions, which could lead to lost customers or harm to our reputation and our operating results.

We use software vendors to operate certain critical functions of our business, including financial management, customer relationship management and human resource management.

If we experience difficulties in implementing new software or if these services become unavailable due to extended outages or interruptions or because they are no longer available on commercially reasonable terms or prices, our expenses could increase, our ability to manage our finances could be interrupted and our processes for managing sales of our solutions and supporting our customers could be impaired until equivalent services, if available, are identified, obtained and integrated, all of which could harm our business.

We use third-party software and data that may be difficult to replace or that may cause errors or failures of our solutions, which could lead to lost customers or harm to our reputation and our operating results.

We license third-party software and security and compliance data from various third parties that are used in our solutions in order to deliver our offerings.

Additionally, we license third-party software and security and compliance data from various third parties to utilize in our solutions to deliver our offerings.

In the future, this software or data may not be available to us on commercially reasonable terms, or at all.

14 unchanged sentences

For example, many of our customers subscribe to our vulnerability management offerings to help them comply with the security standards developed and maintained by the Payment Card Industry Security Standards Council (the “PCI Council”), which apply to companies that process, transmit or store cardholder data.

In addition, our vulnerability management offerings are used by customers in the healthcare industry to help them comply with numerous federal and state laws and regulations related to patient privacy.

particular, HIPAA, and the 2009 Health Information Technology for Economic and Clinical Health Act include privacy standards that protect individual privacy by limiting the uses and disclosures of individually identifiable health information and implementing data security standards.

In addition, our vulnerability management offerings are used by customers in the health care industry to help them comply with numerous federal and state laws and regulations related to patient privacy.

In particular, HIPAA, and the 2009 Health Information Technology for Economic and Clinical Health Act include privacy standards that protect individual privacy by limiting the uses and disclosures of individually identifiable health information and implementing data security standards.

The foregoing and other state, federal and international legal and regulatory regimes may affect our customers’ requirements for, and demand for, our products and professional services.

9 unchanged sentences

Government entities also have heightened sensitivity surrounding the purchase of cybersecurity solutions due to the critical importance of their IT infrastructures, the nature of the information contained within those infrastructures and the fact that they are highly-visible targets for cyber attacks.

For example, the conflict in Ukraine and associated activities in Ukraine and Russia may increase the risk of cyberattacks on various types of infrastructure and operations, and the United States government has warned companies to be prepared for a significant increase in Russian cyberattacks in response to the sanctions on Russia.

Accordingly, increasing sales of our products and professional services to government entities may be more challenging than selling to commercial organizations.

1 unchanged sentence

Any failure by us or our channel partners to safeguard and maintain the confidentiality of such information could subject us to liability and reputational harm, which could materially and adversely affect our results of operations and financial performance.

Additionally, in the United States, federal government agencies may promulgate regulations, and the President may issue executive orders, requiring federal contractors to adhere to different or additional requirements after a contract is signed.

If we do not meet applicable requirements of law or contract, we could be subject to significant liability from our customers or regulators.

We are exposed to fluctuations in currency exchange rates, which could negatively affect our financial condition and results of operations.

1 unchanged sentence

dollar and we generate a majority of our revenue in U.S.

However, for the nine months ended September 30, 2022 and 2021 we incurred 17% and 15%, respectively, of our expenses outside of the United States in foreign currencies, primarily the British pound sterling and euro, principally with respect to salaries and related personnel expenses associated with our sales and research and development operations.

Additionally, for the nine months ended September 30, 2022 and 2021, 10% and 9%, respectively, of our revenue was generated in foreign currencies.

However, three months ended March 31, 2023 and 2022 we incurred 17% and 19%, respectively, of our expenses outside of the United States in foreign currencies, primarily the British pound sterling and euro, principally with respect to salaries and related personnel expenses associated with our sales and research and development operations.

Additionally, for three months ended March 31, 2023 and 2022, 11% and 10%, respectively, of our revenue was generated in foreign currencies.

Accordingly, changes in exchange rates may have an adverse effect on our business, operating results and financial condition.

10 unchanged sentences

We cannot assure you that any patents will issue from any patent applications, that patents that issue from such applications will give us the protection that we seek or that any such patents will not be challenged, invalidated, or circumvented.

that may issue in the future from our pending or future patent applications may not provide sufficiently broad protection and may not be enforceable in actions against alleged infringers.

Any patents that may issue in the future from our pending or future patent applications may not provide sufficiently broad protection and may not be enforceable in actions against alleged infringers.

We have registered the “Rapid7,” “Nexpose” and “Metasploit” names and logos in the United States and certain other countries.

12 unchanged sentences

From time to time, legal action by us may be necessary to enforce our patents and other intellectual property rights, to protect our trade secrets, to determine the validity and scope of the intellectual property rights of others or to defend against claims of infringement or invalidity.

Such litigation could result in substantial costs and diversion of resources and could result in impairment or loss of portions of our intellectual property.

Such litigation could result in substantial costs and diversion of resources and could result in

impairment or loss of portions of our intellectual property.

Furthermore, our efforts to enforce our intellectual property rights may be met with defenses, counterclaims and countersuits attacking the validity and enforceability of our intellectual property rights.

47 unchanged sentences

For example, in response to the Russia-Ukraine war, countries such as Canada, the United Kingdom, the European Union, the United States and other countries and organizations have implemented new and stricter sanctions and export controls against officials, individuals, regions, and industries in Russia, Ukraine and Belarus.

Each country’s potential

response to such sanctions, export controls, tensions, and military actions could damage or disrupt international commerce and the global economy and could have a material adverse effect on our business and results of operations or impact our ability to continue to operate in affected regions.

Each country’s potential response to such sanctions, export controls, tensions, and military actions could damage or disrupt international commerce and the global economy and could have a material adverse effect on our business and results of operations or impact our ability to continue to operate in affected regions.

A decreased use of our products or limitation on our ability to export or sell our products could adversely affect our business, financial condition and results of operations.

5 unchanged sentences

Our ability to use net operating losses to offset future taxable income may be subject to certain limitations.

As of December 31, 2021, we had federal and state net operating loss carryforwards (“NOLs”), of $510.3 million and $400.7 million, respectively, available to offset future taxable income, which expire in various years beginning in 2022 if not utilized.

As of December 31, 2022 , we had federal and state net operating loss carryforwards (“NOLs”) , o f $450.5 million and $345.4 million, respectively, available to offset future taxable income, which expire in various years beginning in 2023 if not utilized.

A lack of future taxable income would adversely affect our ability to utilize these NOLs before they expire.

19 unchanged sentences

If our products or professional services fail to detect vulnerabilities in our customers’ cybersecurity infrastructure, or if our products or professional services fail to identify and respond to new and increasingly complex methods of cyber attacks, our business and reputation may suffer.

There is no guarantee that our products or professional services will detect all

vulnerabilities and threats, especially in light of the rapidly changing security landscape to which we must respond, including the constantly evolving techniques used by attackers to access or sabotage data.

There is no guarantee that our products or professional services will detect all vulnerabilities and threats, especially in light of the rapidly changing security landscape to which we must respond, including the constantly evolving techniques used by attackers to access or sabotage data.

If we fail to update our solutions in a timely or effective manner to respond to these threats, our customers could experience security breaches.

10 unchanged sentences

Errors or defects may be more likely when a product is first introduced or as new versions are released, or when we introduce an acquired company's products.

We have experienced these errors or defects in the past in connection with new products, acquired products and product upgrades and we expect that these errors or defects will be found from time to time in the future in new, acquired or enhanced products after commercial release.

We have experienced these errors or defects in the past in connection with new products, acquired products and product upgrades and we expect that these

errors or defects will be found from time to time in the future in new, acquired or enhanced products after commercial release.

Defects may cause our products to be vulnerable to attacks, cause them to fail to detect vulnerabilities or threats, or temporarily interrupt customers’ networking traffic.

17 unchanged sentences

Additionally, our existing data center facilities and third-party hosting providers have no obligations to renew their agreements with us on commercially reasonable terms or at all, and certain of the agreements governing these relationships may be terminated by either party at any time.

If we are unable to maintain or renew our agreements with these providers on

commercially reasonable terms or if in the future we add additional data center facilities or third-party hosting providers, we may experience additional costs or downtime or delays as we transition our operations.

If we are unable to maintain or renew our agreements with these providers on commercially reasonable terms or if in the future we add additional data center facilities or third-party hosting providers, we may experience additional costs or downtime or delays as we transition our operations.

Any disruptions or other performance problems with our products could harm our reputation and business and may damage our customers’ businesses.

29 unchanged sentences

Because our products collect and store user and related information, domestic and international privacy and cybersecurity concerns, and other laws and regulations, could have a material adverse effect on our business.

We, and our customers, are subject to a number of stringent and changing obligations in domestic and international laws, regulations, guidance, industry standards, external and internal policies and contracts and other obligations that address a range of issues including data privacy and cybersecurity, and restrictions or technological requirements regarding the collection, use, storage, protection, retention or transfer of data.

of issues including data privacy and cybersecurity, and restrictions or technological requirements regarding the collection, use, storage, protection, retention or transfer of data.

The regulatory framework for online services, data privacy and cybersecurity issues worldwide can vary substantially from jurisdiction to jurisdiction, is rapidly evolving and is likely to remain uncertain for the foreseeable future.

22 unchanged sentences

In the United States, federal, state and local governments have enacted numerous data privacy and cybersecurity laws (including data breach notification laws, personal data privacy laws and consumer protection laws).

For example, the California Consumer Privacy Act of 2018 (“CCPA”), imposes obligations on businesses to which it applies.

For example, the California Privacy Rights Act, which updated the California Consumer Privacy Act of 2018 (“CCPA”), went into effect on January 1, 2023, (“CPRA”), imposes obligations on businesses, service providers, third parties and contractors to which it applies.

These obligations include, but are not limited to, providing specific disclosures in privacy notices and affording California residents certain rights related to their personal data.

The CCPA allows for statutory fines for non-compliance (up to $7,500 per violation).

Other states have proposed data privacy laws.

Other states have proposed data privacy laws which may come into effect.

If we become subject to new data privacy or security laws, the risk of enforcement action against us could increase because we may become subject to additional obligations, and the number of individuals or entities that can initiate actions against us may increase (including individuals, via a private right of action, and state actors).

1 unchanged sentence

The UK’s decision to leave the EU and ongoing developments in the UK have created uncertainty with regard to data protection regulation in the UK.

Going forward, there may be an increasing scope for divergence in the application, interpretation and enforcement of data

protection laws as between the UK and EU.

Going forward, there may be an increasing scope for divergence in the application, interpretation and enforcement of data protection laws as between the UK and EU.

The European Data Protection Laws present significantly greater risks, compliance burdens and costs for companies with users and operations in the EU and UK.

10 unchanged sentences

For example, the “Standard Contractual Clauses” (“SCCs”) that are designed to be a valid mechanism by which parties can transfer personal data out of Europe to jurisdictions that are not found to provide an adequate level of protection, must be assessed on a case-by-case basis taking into account the legal regime applicable in the destination country.

Specifically, the parties to the cross-border personal data transfer must evaluate the importing jurisdiction’s laws and implement supplemental security measures as necessary to protect the at-issue personal data.

Specifically,

the parties to the cross-border personal data transfer must evaluate the importing jurisdiction’s laws and implement supplemental security measures as necessary to protect the at-issue personal data.

It is likely that there will continue to be some uncertainty regarding the mechanisms by which parties transfer personal data out of Europe to jurisdictions such as the United States.

13 unchanged sentences

The market price of our common stock may be highly volatile and may fluctuate substantially as a result of a variety of factors, some of which are related in complex ways.

Since shares of our common stock were sold in our initial public offering (“IPO”), in July 2015 at a price of $16.00 per share, our stock price has ranged from an intraday low of $9.05 to an intraday high of $145.00 through October 31, 2022.

Factors that may affect the market price of our common stock include:

13 unchanged sentences

• sales of shares of our common stock by us or our stockholders, including sales and purchases of any common stock issued upon conversion of our convertible senior notes;

• general economic, regulatory and market conditions.

Recently, the stock markets, and in particular the market on which our common stock is listed, have experienced price and volume fluctuations that have affected and continue to affect the market prices of equity securities of many companies due to, among other factors, the actions of market participants or other actions outside of our control, including general market volatility caused by the COVID-19 pandemic.

• general economic, regulatory and market conditions and/or market speculation or rumors.

These fluctuations have often been unrelated or disproportionate to the operating performance of those companies.

31 unchanged sentences

Further, the indentures governing the Notes do not restrict our ability to incur additional indebtedness, secure existing or future debt, recapitalize our existing or future debt or take a number of other actions that could intensify the risks discussed above and below.

Further, we and our subsidiaries may incur substantial additional indebtedness in the future, subject to the restrictions contained in our revolving credit facility and any future debt instruments existing at the time, some of which may be secured indebtedness.

indebtedness.

While our revolving credit facility restricts our ability to incur additional indebtedness, if our revolving credit facility is terminated, we may not be subject to such restriction under the terms of such indebtedness.

15 unchanged sentences

As disclosed in Note 10, Debt , to our consolidated financial statements, during the six months ended June 30, 2022, the 2025 Notes were convertible at the option of the holders.

During this period an immaterial principal amount of the

2025 Notes were requested for conversion and settled in cash.

As of September 30, 2022, the 2025 Notes and the 2027 Notes were not convertible at the option of the holder.

Whether the Notes will be convertible following the fiscal quarter ending September 30, 2022, will depend on the future satisfaction of a conversion condition.

During this period an immaterial principal amount of the 2025 Notes were requested for conversion and settled in cash.

As of March 31, 2023, the 2025 Notes and the 2027 Notes were not convertible at the option of the holder.

Whether the Notes will be convertible following the fiscal quarter ending March 31, 2023, will depend on the future satisfaction of a conversion condition.

In addition, even if holders of Notes do not elect to convert their Notes, we could be required under applicable accounting rules to reclassify all or a portion of the outstanding principal of the Notes as a current rather than long-term liability, which would result in a material reduction of our net working capital.

17 unchanged sentences

We can provide no assurances as to the financial stability or viability of the option counterparties.

Provisions in the indentures for the Notes may deter or prevent a business combination that may be favorable to our stockholders.

If a fundamental change occurs prior to the maturity date of the Notes, holders of the Notes will have the right, at their option, to require us to repurchase all or a portion of their Notes.

In addition, if a “make-whole fundamental change” (as defined in the indentures) occurs prior the maturity date, we will in some cases be required to increase the conversion rate of the Notes for a holder that elects to convert its Notes in connection with such make-whole fundamental change.

Furthermore, the indentures governing the Notes prohibit us from engaging in certain mergers or acquisitions unless, among other things, the surviving entity assumes our obligations under the Notes.

These and other provisions in the indentures could deter or prevent a third party from acquiring us even when the acquisition may be favorable to our stockholders.

Conversion of the Notes will dilute the ownership interest of existing stockholders, including holders who had previously converted their Notes, or may otherwise depress the price of our common stock.

The conversion of some or all of the Notes will dilute the ownership interests of existing stockholders to the extent we deliver shares of our common stock upon conversion of any of the Notes.

As disclosed in Note 10, Debt , as of September 30, 2022, the 2025 Notes and the 2027 Notes were not convertible at the option of the holder.

As disclosed in Note 10, Debt , as of March 31, 2023 the Notes were not convertible at the option of the holder.

Any sales in the public market of the common stock issuable upon such conversion could adversely affect prevailing market prices of our common stock.

15 unchanged sentences

The occurrence of any of the foregoing events could damage our systems and hardware or could cause them to fail completely, and our insurance may not cover such events or may be insufficient to compensate us for the potentially significant losses, including the potential harm to the future growth of our business, that may result from interruptions in our service as a result of system failures.

In addition, while the long-term effects of climate change on the global economy and the technology industry in particular are unclear, we recognize that there are inherent climate related risks wherever business is conducted.

Any of our primary locations may be vulnerable to the adverse effects of climate change.

Climate-related events, including the increasing frequency of extreme weather events and their impact on critical infrastructure in the United States and elsewhere, have the potential to disrupt our business, our third-party suppliers, and/or the business of our customers, and may cause us to experience higher attrition, losses and additional costs to maintain and resume operations.

Transitional climate change risks that result from a shift to a low-carbon economy may subject us to increased regulations, reporting requirements, standards, or expectations regarding

the environmental impacts of our business and untimely or inaccurate disclosure could adversely affect our reputation, business or financial performance.

All of the aforementioned risks may be exacerbated if our disaster recovery plans or the disaster recovery plans established for our third-party data centers and hosting providers prove to be inadequate.

22 unchanged sentences

For example, while the potential impact and duration of the COVID-19 pandemic on the global economy and our business in particular may be difficult to assess or predict, the pandemic has resulted in, and may continue to result in significant disruption of global financial markets, reducing our ability to access capital, which could in the future negatively affect our liquidity.

Market conditions and changing circumstances, some of which may be beyond our control, could impair our ability to access our existing cash, cash equivalents and investments.

If banks and financial institutions with whom we have banking relationships enter receivership or become insolvent in the future, we may be unable to access, and we may lose, some or all of our existing cash, cash equivalents and investments to the extent those funds are not insured or otherwise protected by the FDIC.

For example, on March 10, 2023, Silicon Valley Bank (“SVB”), was placed into receivership with the Federal Deposit Insurance Corporation (“FDIC”) which resulted in all funds held at SVB being temporarily inaccessible by SVB’s customers.

Any delay in our ability to access our cash, cash equivalents and investments (or the loss of some or all of such funds) could

have a material adverse effect on our operations and cause us to need to seek additional capital sooner than planned and at a higher cost.

Although we expect that current cash and cash equivalent balances and cash flows that are generated from operations will be sufficient to meet our domestic and international working capital needs and other capital and liquidity requirements for at least the next 12 months, if we are unable to obtain adequate financing or financing on terms satisfactory to us if and when we require it, our ability to continue to support our business growth and to respond to business challenges could be significantly impaired, and our business may be adversely affected.

Anti-takeover provisions in our charter documents and under Delaware law could make an acquisition of us more difficult, limit attempts by our stockholders to replace or remove our current management and limit the market price of our common stock.

Anti-takeover provisions in our charter documents, our indenture and under Delaware law could make acquiring us more difficult, limit attempts by our stockholders to replace or remove our current management and limit the market price of our common stock.

Provisions in our amended and restated certificate of incorporation and amended and restated bylaws may have the effect of delaying or preventing a change in control or changes in our management.

8 unchanged sentences

These provisions may frustrate or prevent any attempts by our stockholders to replace or remove our current management by making it more difficult for stockholders to replace members of our board of directors, who are responsible for appointing the members of our management.

If a fundamental change occurs prior to the maturity date of the Notes, holders of the Notes will have the right, at their option, to require us to repurchase all or a portion of their Notes.

Furthermore, the indentures governing the Notes prohibit us from engaging in certain mergers or acquisitions unless, among other things, the surviving entity assumes our obligations under the Notes.

These and other provisions in the indentures could deter or prevent a third party from acquiring us even when the acquisition may be favorable to our stockholders.

In addition, because we are incorporated in Delaware, we are governed by the provisions of Section 203 of the Delaware General Corporation Law, which generally prohibits a Delaware corporation from engaging in any of a broad range of business combinations with any “interested” stockholder for a period of three years following the date on which the stockholder became an “interested” stockholder.

Any of the foregoing provisions could limit the opportunity for our

stockholders to receive a premium for their shares of our common stock and could also affect the price that some investors are willing to pay for our common stock.

Any of the foregoing provisions could limit the opportunity for our stockholders to receive a premium for their shares of our common stock and could also affect the price that some investors are willing to pay for our common stock.

Our amended and restated certificate of incorporation designates the Court of Chancery of the State of Delaware as the exclusive forum for certain litigation that may be initiated by our stockholders, which could limit our stockholders’ ability to obtain a favorable judicial forum for disputes with us.

Pursuant to our amended and restated certificate of incorporation, unless we consent in writing to the selection of an alternative forum, the Court of Chancery of the State of Delaware is the sole and exclusive forum for (1) any derivative action or proceeding brought on our behalf, (2) any action asserting a claim of breach of a fiduciary duty owed by any of our directors, officers or other employees to us or our stockholders, (3) any action asserting a claim arising pursuant to any provision of the Delaware General Corporation Law, our amended and restated certificate of incorporation or our amended and restated bylaws or (4) any action asserting a claim governed by the internal affairs doctrine.

officers or other employees to us or our stockholders, (3) any action asserting a claim arising pursuant to any provision of the Delaware General Corporation Law, our amended and restated certificate of incorporation or our amended and restated bylaws or (4) any action asserting a claim governed by the internal affairs doctrine.

Our amended and restated certificate of incorporation further provides that any person or entity purchasing or otherwise acquiring any interest in shares of our common stock is deemed to have notice of and consented to the foregoing provision.

9 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-Q

Item 1A. Risk Factors